Information protection is becoming a focal point for designing, creating and implementing software applications within highly integrated technology environments. The use of a safe coding technique in the software development process is required by many industrial IT security standards and policies. Despite current cyber protection measures and best practices, vulnerabilities still remain strong and become a huge threat to every developed software. It is crucial to understand the position of secure software development for security management, which is affected by causes such as human security-related factors. Although developers are often held accountable for security vulnerabilities, in reality, many problems often grow from a lack of organizational support during development tasks to handle security. While abstract safe coding guidelines are generally recognized, there are limited low-level secure coding guidelines for various programming languages. A good technique is required to standardize these guidelines for software developers. The goal of this paper is to address this gap by providing software designers and developers with direction by identifying a set of secure software development guidelines. Additionally, an overview of criteria for selection of safe coding guidelines is performed along with investigation of appropriate awareness methods for secure coding.
As software projects are very diverse, each software development process must be adjusted to the needs of the project and the corresponding development team. Frequently, we find different methods and practices combined in a so-called hybrid development method. Research has shown that these hybrid methods evolve over time and are devised based on experience. However, when devising a hybrid method, the methods and practices used should cover the whole software project with its different phases including, among others, project management, requirements analysis, quality management, risk management…
With recent advances in the development of more powerful quantum computers, the research area of quantum software engineering is emerging, having the goal to provide concepts, principles, and guidelines to develop high-quality quantum applications. In classical software engineering, lifecycles are used to document the process of designing, implementing, maintaining, analyzing, and adapting software. Such lifecycles provide a common understanding of how to develop and operate an application, which is especially important due to the interdisciplinary nature of quantum computing. Since today`s qu…
Sketching is an important activity for understanding, designing, and communicating different aspects of software systems such as their requirements or architecture. Often, sketches start on paper or whiteboards, are revised, and may evolve into a digital version. Users may then print a revised sketch, change it on paper, and digitize it again. Existing tools focus on a paperless workflow, i.e., archiving analog documents, or rely on special hardware - they do not focus on integrating digital versions into the analog-focused workflow that many users follow. In this paper, we present the concept…
Software design is crucial to successful software development, yet is a demanding multi-objective problem for software engineers. In an attempt to assist the software designer, interactive (i.e. human in-the-loop) meta-heuristic search techniques such as evolutionary computing have been applied and show promising results. Recent investigations have also shown that Ant Colony Optimization (ACO) can outperform evolutionary computing as a potential search engine for interactive software design. With a limited computational budget, ACO produces superior candidate design solutions in a smaller numb…
Nowadays automated dynamic analysis frameworks for continuous testing are in high demand to ensure software safety and satisfy the security development lifecycle (SDL) requirements. The security bug hunting efficiency of cutting-edge hybrid fuzzing techniques outperforms widely utilized coverage-guided fuzzing. We propose an enhanced dynamic analysis pipeline to leverage productivity of automated bug detection based on hybrid fuzzing. We implement the proposed pipeline in the continuous fuzzing toolset Sydr-Fuzz which is powered by hybrid fuzzing orchestrator, integrating our DSE tool Sydr wit…
Tech-leading organizations are embracing the forthcoming artificial intelligence revolution. Intelligent systems are replacing and cooperating with traditional software components. Thus, the same development processes and standards in software engineering ought to be complied in artificial intelligence systems. This study aims to understand the processes by which artificial intelligence-based systems are developed and how state-of-the-art lifecycle models fit the current needs of the industry. We conducted an exploratory case study at ING, a global bank with a strong European base. We intervie…
The paper considers enterprise content management (ECM) issues in global heterogeneous distributed computational environment. Present-day enterprises have accumulated a huge data burden. Manipulating with such a bulk becomes an essential problem, particularly due to its global distribution, heterogeneous and weak-structured character. The conceptual approach to integrated ECM lifecycle support is presented, including overview of formal models, software development methodology and innovative software development tools. Implementation results proved shortening terms and reducing costs of impleme…
Many enterprise software systems supporting IT services are characterised by a need for a high computing capability and resource consumption (Armbrust et al. 2010; Buyya et al. 2008; Koçak et al. 2013). Cloud Computing initiatives have received a significant attention as a viable solution to address these requirements through offering a wide range of services, which are universally accessible, acquirable and releasable in a dynamic fashion, and payable on the basis of service usage. Hence, organisations view the cloud services as an opportunity to empower their legacy systems.
With the advent of the Internet of Things (IoT), the percentage of global emissions attributable to Information Systems is expected to further increase in the coming years, due to a proliferation of Internet-connected devices omnipresent in our daily lives (e.g., electric meters, wearable devices, etc.). Although software systems do not directly consume energy, they strongly affect the energy consumption of the hardware. So, developers should be more aware of the energy consumed by these systems during their lifetime, and think about the long-term consequences in the sustainability of our plan…
Prompting Large Language Models to Tackle the Full Software Development Lifecycle: A Case Study
Shanghai AI Laboratory（上海人工智能实验室）；Nanjing University（南京大学）；BUPT（北京邮电大学）；Dartmouth College（达特茅斯学院）；Princeton University（普林斯顿大学）；The University of Hong Kong（香港大学）；Tsinghua University（清华大学）；Alibaba Group（阿里巴巴集团）；ByteDance（字节跳动）
Making Software FAIR: A machine-assisted workflow for the research software lifecycle
The Open University（开放大学）；CORE；Knowledge Media institute（知识媒体研究所）；Inria（法国国家信息与自动化研究所）；Science Miner；Brno University of Technology（布尔诺理工大学）；Polish Academy of Sciences（波兰科学院）；European Bioinformatics institute（欧洲生物信息研究所）
Recently, assurance cases have received much attentions in the field of software-based computer systems and IT services. However, software very often changes and there are no strong regulations for software. These facts are main two challenges to be addressed in software assurance cases. We propose a development method of assurance cases by means of continuous revision at every stage of the system lifecycle, including in-operation and service recovery in failure cases. The quality of dependability arguments are improved by multiple stakeholders who check with each other. This paper reported ou…
Virtual observatories allow the means by which an astronomer is able to discover, access, and process data seamlessly, regardless of its physical location. However, steep learning curves are often required to become proficient in the software employed to access, analyse and visualise this trove of data. It would be desirable, for both research and educational purposes, to have applications which allow users to visualise data at the click of a button. Therefore, we have developed a standalone application (written in Python) for plotting photometric Colour Magnitude Diagrams (CMDs) - one of the …
Commit is an important operation of revision control for open-source software (OSS). Recent research has been pursued to explore the statistical laws of such an operation, but few of those papers conduct empirical investigations on commit interval (i.e., the waiting time between two consecutive commits). In this paper, we investigated software developer's collective and individual commit behavior in terms of the distribution of commit intervals, and found that 1) the data sets of project-level commit interval within both the lifecycle and each release of the projects analyzed roughly follow po…
There is currently a large amount of robotics software using the component-oriented programming paradigm. However, the rapid growth in number and complexity of components may compromise the scalability and the whole lifecycle of robotics software systems. Model-Driven Engineering can be used to mitigate these problems. This paper describes how using Domain-Specific Languages to generate and describe critical parts of robotic systems helps developers to perform component managerial tasks such as component creation, modification, monitoring and deployment. Four different DSLs are proposed in thi…
In recent years, the World Economic Forum has identified software security as the most significant technological risk to the world's population, as software-intensive systems process critical data and provide critical services. This raises the question of the extent to which German companies are addressing software security in developing and operating their software products. This paper reports on the results of an extensive study among developers, product owners, and managers to answer this question. Our results show that ensuring security is a multi-faceted challenge for companies, involving…
Secure software engineering is a fundamental activity in modern software development. However, while the field of security research has been advancing quite fast, in practice, there is still a vast knowledge gap between the security experts and the software development teams. After all, we cannot expect developers and other software practitioners to be security experts. Understanding how software development teams incorporate security in their processes and the challenges they face is a step towards reducing this gap. In this paper, we study how financial services companies ensure the security…
Security holds an important role in a software. Most people are not aware of the significance of security in software system and tend to assume that they will be fine without security in their software systems. However, the lack of security features causes to expose all the vulnerabilities possible to the public. This provides opportunities for the attackers to perform dangerous activities to the vulnerable insecure systems. This is the reason why many organizations are reported for being victims of system security attacks. In order to achieve the security requirement, developers must take tim…
Crowdsourcing is becoming an accepted method of software development for different phases in the production lifecycle. Ideally, mass parallel production through Crowdsourcing could be an option for rapid acquisition in software engineering by leveraging infinite worker resource on the internet. It is important to understand the patterns and strategies of decomposing and uploading parallel tasks to maintain a stable worker supply as well as a satisfactory task completion rate. This research report is an empirical analysis of the available tasks' lifecycle patterns in crowdsourcing. Following th…
The Reproducible Research Platform establishes a unified open science environment bridging data and software lifecycles across disciplines, from proposal to publication
To avoid software vulnerabilities, organizations are shifting security to earlier stages of the software development, such as at code review time. In this paper, we aim to understand the developers' perspective on assessing software security during code review, the challenges they encounter, and the support that companies and projects provide. To this end, we conduct a two-step investigation: we interview 10 professional developers and survey 182 practitioners about software security assessment during code review. The outcome is an overview of how developers perceive software security during c…
Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. But despite these efforts, there continues to be an increase in the number of vulnerabilities that can be exploited by malicious hackers. There is thus an urgent need to understand why developers still introduce security vulnerabilities into their applications and to understand what can be done to mot…
Runtime enforcement can be effectively used to improve the reliability of software applications. However, it often requires the definition of ad hoc policies and enforcement strategies, which might be expensive to identify and implement. This paper discusses how to exploit lifecycle events to obtain useful enforcement strategies that can be easily reused across applications, thus reducing the cost of adoption of the runtime enforcement technology. The paper finally sketches how this idea can be used to define libraries that can automatically overcome problems related to applications misusing t…
The software development process has evolved with respect to the problems in developing large and complex applications. There is a paradigm shift towards collaborative development, which necessitates the need to evaluate this approach. A number of tools are used for collaborative software development (CSD) including social media and web 2.0 features. Collaborative development facilities are provided by IDEs and project hosting websites. In this paper, we present a survey of collaboratively developed projects and discuss challenges and issues in CSD. We analyze various issues of communication, …
