Software Development Practices Research Articles

Malicious source code detection using a translation model

Modern software development often relies on open-source code sharing. Open-source code reuse, however, allows hackers to access wide developer communities, thereby potentially affecting many products. An increasing number of such "supply chain attacks" have occurred in recent years, taking advantage of open-source software development practices. Here, we introduce the Malicious Source code Detection using a Translation model (MSDT) algorithm. MSDT is a novel deep-learning-based analysis method that detects real-world code injections into source code packages. We have tested MSDT by embedding examples from a dataset of over 600,000 different functions and then applying a clustering algorithm to the resulting embedding vectors to identify malicious functions by detecting outliers. We evaluated MSDT's performance with extensive experiments and demonstrated that MSDT could detect malicious code injections with precision@k values of up to 0.909.

The Composable Data Management System Manifesto

The requirement for specialization in data management systems has evolved faster than our software development practices. After decades of organic growth, this situation has created a siloed landscape composed of hundreds of products developed and maintained as monoliths, with limited reuse between systems. This fragmentation has resulted in developers often reinventing the wheel, increased maintenance costs, and slowed down innovation. It has also affected the end users, who are often required to learn the idiosyncrasies of dozens of incompatible SQL and non-SQL API dialects, and settle for systems with incomplete functionality and inconsistent semantics. In this vision paper, considering the recent popularity of open source projects aimed at standardizing different aspects of the data stack, we advocate for a paradigm shift in how data management systems are designed. We believe that by decomposing these into a modular stack of reusable components, development can be streamlined while creating a more consistent experience for users. Towards that goal, we describe the state-of-the-art, principal open source technologies, and highlight open questions and areas where additional research is needed. We hope this work will foster collaboration, motivate further research, and promote a more composable future for data management.

Contributions of enterprise architecture to software engineering: A systematic literature review

AbstractEnterprise architecture is a growing trend that aims to help deal with the complexity of socio‐technical systems such as human organizations, as well as their information technology and systems areas. Nevertheless, the contribution of enterprise architecture to the field of software engineering remains unclear. The purpose of this systematic literature review is to see how enterprise architecture is used in software development and maintenance practice. To this end, we first carried out a search in the SCOPUS database and then organized the papers according to the Software Engineering Body of Knowledge to determine what areas of software engineering are covered by each research study. To understand how enterprise architecture is used, we established a classification based on ISO 42010 and TOGAF. From the systematic literature review, we noticed that the early stages of development are the most impacted by the enterprise architecture. On the other hand, we observed that enterprise architecture is of assistance in the areas of engineering management, engineering processes, and engineering models and methods; these tasks are carried out by teams or managers using different, often agile, development methods or standards. In turn, we found that the most common categories are architecture descriptions; these are often used to facilitate communication and information‐sharing between different stakeholders, in addition to frameworks, which will help to establish common practices in the organization related to the joint use of enterprise architecture and software development.

What do software startups need from UX work?

Empirical research on software development practices in startups is growing. However, little has been investigated about how User eXperience (UX) work has been carried out in software startups. The primary objective of this paper is to investigate what software startups need from UX work. To achieve this goal, we conducted open-ended interviews and retrospective meetings with 16 software professionals from two software startups in Brazil. We analysed the data qualitatively using different coding approaches: initial coding, focused coding, and theoretical coding. We found 14 UX work-related needs which emerged from the daily practices used for software development in the two startups studied. Based on our findings, we propose an initial theoretical framework that highlights two theoretical themes and four groups underlying the needs identified. Our study reveals several relationships between UX work-related needs which are helpful to understand in order to identify what startups need from UX work in practice and to focus startup teams' efforts on the most urgent needs. As future work, we plan to explore ways in which these needs may be addressed so that UX work may be put into practice in software startups.

UL 4600: What to Include in an Autonomous Vehicle Safety Case

UL 4600 provides an umbrella for coordinating software development practices and computer-based system safety standards to make sure nothing is left out when assuring safety.

SLR: From Saltzer and Schroeder to 2021…47 Years of Research on the Development and Validation of Security API Recommendations

Producing secure software is challenging. The poor usability of security Application Programming Interfaces (APIs) makes this even harder. Many recommendations have been proposed to support developers by improving the usability of cryptography libraries—rooted in wider best practice guidance in software engineering and API design. In this SLR, we systematize knowledge regarding these recommendations. We identify and analyze 65 papers, offering 883 recommendations. Through thematic analysis, we identify seven core ways to improve usability of APIs. Most of the recommendations focus on helping API developers to construct and structure their code and make it more usable and easier for programmers to understand . There is less focus, however, on documentation , writing requirements , code quality assessment , and the impact of organizational software development practices . By tracing and analyzing paper ancestry, we map how this knowledge becomes validated and translated over time. We find that very few API usability recommendations are empirically validated, and that recommendations specific to usable security APIs lag even further behind.

A Formal Approach for Consistency Management in UML Models

Consistency is a significant indicator to measure the correctness of a software system in its lifecycle. It is inevitable to introduce inconsistencies between different software artifacts in the software development process. In practice, developers perform consistency checking to detect inconsistencies, and apply their corresponding repairs to restore consistencies. Even if all inconsistencies can be repaired, how to preserve consistencies in the subsequent evolution should be considered. Consistency management (consistency checking and consistency preservation) is a challenging task, especially in the multi-view model-driven software development process. Although there are some efforts to discuss consistency management, most of them lack the support of formal methods. Our work aims to provide a framework for formal consistency management, which may be used in the practical software development process. A formal model, called a Structure model, is first presented for specifying the overall model-based structure of the software system. Next, the definition of consistency is given based on consistency rules. We then investigate consistency preservation under the following two situations. One is that if the initial system is inconsistent, then the consistency can be restored through repairs. The other is that if the initial system is consistent, then the consistency can be maintained through update propagation. To demonstrate the effectiveness of our approach, we finally present a case study with a prototype tool.

Agile software development and software practitioners’ productivity amidst the COVID-19 pandemic: a narrative review

PurposeAs the novel coronavirus 2019 (COVID-19) impacts the world, software practitioners are collaboratively working remotely from home. The pandemic has disrupted software practitioners’ productivity forcing changes to agile methodology adopted by software practitioners in software organizations. Therefore, this study aims to provide implication on the issues and recommendations for improving software practitioners’ productivity and also examine the impact of the COVID-19 pandemic on agile software development.Design/methodology/approachThis paper adopts a narrative literature review to provide early assessment based on secondary data from the literature and available document reports from studies published from 2019 to 2022 to explore software practitioners’ productivity and agile software development during the working from home directive amidst the COVID-19 pandemic. A total of 60 sources which met the inclusion criteria were used to provide preliminary evidence grounded on secondary data from the literature. Descriptive analysis was used to provide qualitative findings from the literature.FindingsFindings from this study present the significance of working from home directive on agile software development and software practitioners’ productivity. More importantly, findings from the secondary data shed light on software practitioners’ productivity adopting agile software development amidst the COVID-19 pandemic. Additionally, the findings present virtual collaborative platforms used by software practitioners, technical and social barriers of agile software development during the pandemic and recommendations for remote agile software development.Originality/valueThis study explores the significance of working from home directive on software practitioners’ productivity during COVID-19 pandemic and further investigates how are software practitioners’ productivity adopting agile software development practices amidst the COVID-19 pandemic. Besides, this study discusses the challenges software practitioners currently face and offers some strategies to bridge the gaps in agile software development to help software practitioners, system developers, software managers and software organizations adapt to the changes caused by the pandemic.

Towards the Integration of Security Practices in Agile Software Development: A Systematic Mapping Review

Software development must be based on more than just the experience and capabilities of your programmers and your team. The importance of obtaining a quality product lies in the risks that can be exploited by software vulnerabilities, which can jeopardize organizational assets, consumer confidence, operations, and a broad spectrum of applications. Several methods, techniques, and models have been suggested and developed to address software security. However, only a few have solid evidence for creating secure software applications. The main objective of this paper is to survey the literature for methods or models suitable for considering the integration of security in all or some of the phases of the software development life cycle and which ones are most considered or neglected. This study represents the beginning of research to generate a methodology that integrates security practices in agile software development, allowing inexperienced developers to create more secure applications.

Digital Initiatives in Academic Libraries: Challenges and Opportunities

Digital initiatives have become increasingly common in academic libraries, but inconsistent definitions, standards, and expectations limit and, in some cases, negatively impact the effectiveness of practitioners. This article explores the discourse surrounding professional titles and responsibilities in digital initiatives within North American academic libraries between 1990 and 2020. A review of job advertisements, position descriptions, and professional activities reveals ambiguously defined responsibilities, inadequate technical education, and limited opportunities for training. Current trends suggest digital initiatives will expand from traditional digitization and digital library projects toward more diverse and flexible digital project management. This change will require familiarity with software development, systems administration, and library practices. The implication for library science education is the need for course programming that reflects these trends.

Smart Automation for Enhancing Cyber-Security

In an intelligent automation ecosystem, namely in the context of Robotic Process Automation, there is a need to review the development and operation processes and practices, to combine competences from these two areas with the common good necessary for any organization or security team. It is with security that quality, efficiency, and profitability become possible. The elaboration of guidelines and best practices for the application of a DevSecOps culture is currently essential for Agile software development at any organization. In the digitalization era, teams increasingly need a collaborative method to involve several competencies and capabilities, from analysis to implementation and the evolution of a software product. Information security needs to be an integral part throughout the entire product’s lifecycle, as without it, fundamental aspects of confidentiality, integrity, and availability put information and software security at serious risk in the course of business operations. Without losing focus on customer needs, it is necessary to model software development practices, following more agile methodologies. In this way, teams can model the software throughout its lifecycle, focusing on facilitating the delivery of value to the customer and having greater certainty that requirements, plans, and results are 100% aligned with customer needs. This paper presents an analysis and proposal for the continuous improvement of an intelligent automation platform at a large-scale multinational organization. In parallel, aspects that generate resistance to the implementation of a DevSecOps methodology within the scope of RPA code development is considered.

Framework and tooling proposals for Agile certification of safety-critical embedded software in avionic systems

This article focuses on quality improvement in the development of DO-178C/ED-12C safety-critical software, optimizing development costs through the implementation of a “continuous certification” integral process. We discuss the major problems associated with traditional, V-cycle software development practices, and highlight the many advantages of adopting a “continuous certification” process based on a more Agile approach. The article proposes a framework for deploying this process, explaining the development of the framework and demonstrating its compliance with the requirements of certification standards. We also propose a tooling based on open-source, off-the-shelf solutions to implement the framework and illustrate its efficiency and effectiveness on an industrial case study.

Understanding Software‐centered Evolutive Ecosystems through Activity Theory

AbstractThis paper proposes an interdisciplinary approach aimed to bring into practice some novel Software Engineering theoretical paradigms. The premise of these news paradigms is based on the idea of “ecologies” as realities that take place in the environment of a Software product. These “ecologies” are understood as tight but flexible interactions between the human, social, and technical components involved, where Software is just another component. However, the theoretical paradigms discussed do not offer a viable way to make sense of these ecologies into the practice of Software design and development. Thus, as a more operationalized approach, this paper proposes a framework based on Networks of Activities, a concept derived from Activity Theory, as a resource to help in the design, development, and evolution of these new emergent complex socio‐technical ecologies. This framework has been conceived as a tool for the design, capture, and, especially, to analyze the evolution of these ecologies. The concepts and notations used by the proposed approach are illustrated through a proof of concept that shows the essential ideas and their use in real scenarios. In this way, the concepts discussed contribute to the improvement of related fields like Requirements Engineering, Human‐Computer Interaction, or Software Architecture, among others.

The ESCAPE Open-source Software and Service Repository

Purpose: The purpose of the ESCAPE Open-source Software and Service Repository (OSSR) is to provide a central location for the dissemination and use of trusted open-source software in the fields of astronomy, astroparticle physics, and particle physics. The repository allows users to easily access and download tools and services developed within the community, and to contribute their own tools and services. Methods: The ESCAPE project has set up a curated repository of software that provides tools and an environment to make it easy for users to find and download the software and services that they need. The repository is regularly updated and is maintained by a curation board, ensuring that the software and services are reliable and up-to-date. The curation and onboarding process makes the OSSR a trustworthy source of software that can be used for scientific analysis. The software included in the repository must include documentation and instructions and follow a set of modern best practices in software development. Training is provided to students and researchers to help them provide high-quality scientific software following modern software development practices. Outcome: The OSSR currently contains a wide range of software and services, including those for data management, data analysis, and machine learning. These tools and services are used by researchers and other users around the world. The OSSR has proven to be an effective means for disseminating and providing open-source software and services developed by the ESCAPE project partners and welcomes contributions from the entire community.

Software Development Practice as Baradian Entanglement

Software development practice is a messy, complicated, and constantly shifting human endeavor. Barad’s concept of “entanglement” helps to theorize complex sociotechnical systems. We are testing the application of this theory to understand and explain software development practices, as our work appears to be the only ethnographic research using Barad in any technology industry. Our continual aim is to understand large-scale, collaborative software development more deeply in practice and to discover appropriate theories that describe our observations and insights. Both authors are experienced software engineers and researchers. Through an ongoing longitudinal ethnographic study at a large Australian software development company, we explore, support, and improve the lived experience and practice of the software developers that work there. Ethnographic insights and an appreciation of the mutual constitution of situated phenomena have expanded over several years into an elaboration of entanglement as a more insightful explanation of software development practice. This research is having a significant impact on the participant developers and organization, including changes in measurement practices, mentoring, knowledge management, and innovation.

Exploring granular test coverage and its evolution with matrix visualizations

Current software-development tools that are used in practice make understanding the test execution of software difficult, for both granular tasks ( e.g., answering questions such as, “which test cases execute this method?”) and global tasks ( e.g., answering questions such as, “what is the proportion of unit tests to system tests?”). Current tools typically support local, file-based views of a project’s test suite and its execution data, and rarely offer a global overview. Even more rarely, do they provide access to historical information of this nature. Such global overviews can provide a larger context for a method’s execution by test cases; help identify other similar, or related methods; and even reveal similarity between individual tests. This work approaches such challenges with a novel, interactive, matrix-based visual interface that provides a global overview of a software project’s test suite, specifically in the context of the methods available in the project’s codebase. Through a series of interactive functions to sort, filter, query, and explore a test-matrix visualization, we evaluate how developers can effectively answer questions about their project’s test suite, and the code executed by such tests. We built a dynamic test-suite analysis and software-visualization tool that implements our designed interface to address the challenges of understanding the testing of software systems. With this implementation, we conducted a user study of 20 software developers to assess their ability to understand and report test execution information and measured accuracy and time. Additionally, we present a series of case studies to demonstrate a number of insights that our tool reveals. Our evaluations, performed on 26 real-world software systems, show that the interactive visualization assisted developers to answer questions about software tests and the code they execute. Further, the visualization consistently outperforms traditional development tools, both in accuracy and time taken to complete software-engineering tasks. Global-overview test matrices offer novel perspectives on test-suite composition, which can guide software development and testing practices.

Improving active participation during enterprise operations modeling with an extended story-card-method and participative modeling software

The COVID-19 pandemic emphasized the need for process automation, using agile software development practices. However, when agile methods are used in scaled contexts, many software development efforts fail, mainly due to lacking requirements engineering practices. When business-oriented software needs to be developed within a scaled context, the story-card method (SCM), developed as part of a previous study, assists in structuring emerging software requirements within a taxonomy that represents enterprise operation. The SCM helps agile team members to develop a common understanding about enterprise operation when they construct the enterprise operation taxonomy. Digital participatory enterprise modeling (PEM) may increase collaboration and understanding among team members, especially when team members are geographically dispersed, when they co-model their understanding of enterprise operations. Using design science research to further evolve the existing SCM, we identified two concerns regarding the existing SCM: (1) The modeling software did not encourage active participation during modeling, and (2) Low quality of the resulting cooperation structure diagram (CSD) that is used to derive an enterprise operation taxonomy, i.e., the need to further extend the existing SCM. As main contribution of this article, we addressed previous deficiencies of the SCM, developing an extended SCM (eSCM), based on principles and guidelines that would encourage online participation during PEM, also providing a comprehensive case to demonstrate the eSCM. As a second contribution, we used survey-feedback from research participants, as well as activity tracking to evaluate whether the modeling tool encouraged active PEM. Our third contribution is to evaluate the quality of the resulting CSDs with suggestions for future improvement.

A Complex Adaptive Systems Perspective of Software Reuse in the Digital Age: An Agenda for IS Research

Most software on which we rely to help us organize our professional and personal lives is based on the reuse of other pieces of software that are created and maintained by groups of software developers that work independently from one another. Oftentimes, these groups simply publish their software in the form of self-contained packages available on dedicated repositories, facilitating the widespread diffusion of their work. Whereas the production and publication of software packages fosters unprecedented levels of digital innovation, there are also drawbacks associated with software reuse (e.g., as was publicly discussed in 2021 with the discovery of the Log4Shell vulnerability). Building on previous research, our work explores the implications associated with the unprecedented scale and uncoordinated nature of packaged software reuse. We use complex adaptive systems as a generative lens to help us conceptualize the phenomenon and identify promising avenues for research and practice on this topic. Our work, therefore, draws attention to the importance of the packaged software reuse phenomenon as well as the need for research to help increase our understanding of its nature and implications considering its prevalence in software development practice and the overall importance of software in our everyday lives.

Enhancing IoT Project Success through Agile Best Practices

Worldwide spending on Internet of Things (IoT) applications is forecasted to surpass $1 trillion by 2022. To stay competitive in this growing technological industry segment, lowering costs while increasing productivity and shortening time-to-market will become increasingly important. Adopting Agile Software Development practices for IoT projects may provide this competitive advantage, as it enables organizations to respond to change, while being dynamic and innovative. Applying a mixed-methods approach, agile IoT practitioners around the world and from diverse industries were surveyed and interviewed. Our study recommends that Agile Software Development team makeup, practices, and methods should be tailored to the specific industry, culture, people, and IT application of an organization. People play an important role in the success of agile projects; therefore, our research focuses on identifying the critical attributes of agile teams to maximize success. Our study identified the five critical agile practices: Collective Code Ownership, Continuous Integration, Single Team, Dedicated Customer, and Sprint Planning and found that both technical and soft skills are essential for successful IoT development.

What more can Software Development Learn from Agile Manufacturing? Some Pointers on the 20th Anniversary of the Agile Manifesto

The concept of agility originated in manufacturing and was later adopted by the software development discipline. In this article we argue that in the process some important aspects of the agility theory have been either ignored or misinterpreted. A historical review of the evolving paradigms and practices in software development and manufacturing on the 20th anniversary of the Agile Manifesto (2001) suggests that if the ideas and principles underlying agility are faithfully implemented it would lead to significant improvement in the software development process.