Software Engineering Institute

Security failures in cloud infrastructure result in significant economic losses that extend far beyond immediate breach costs. This paper presents a comprehensive analysis of the economic impact of security failures across cloud service providers, examining direct costs (incident response, system recovery, regulatory fines) and indirect costs (customer churn, reputational damage, market valuation impact). Through analysis of 127 publicly disclosed security incidents affecting cloud infrastructure providers between 2019-2024, we quantify the total economic impact at $47.3B, with individual incidents ranging from $2.1M to $4.2B. We develop a predictive model correlating security architecture decisions with economic risk, demonstrating that proactive security investments of $1M-5M can prevent potential losses of $50M-500M. Our findings show that the mean time to detect (MTTD) security incidents has the strongest correlation with total economic impact (r=0.82, p <0.001). While this correlation is strong, we emphasize that correlation does not establish causation; the relationship may be influenced by confounding factors and reverse causality. We present evidence that organizations implementing comprehensive security frameworks achieve 73% lower total cost of incidents and 89% faster recovery times. This work provides quantitative evidence for prioritizing security investments in cloud infrastructure and establishes benchmarks for measuring the economic effectiveness of security programs.

To keep users safe online, current protections frequently employ blocklists of known malware and phishing websites. However, such defenses suffer from an inherent gap between malicious content creation and its detection, leaving a window where users are left vulnerable. To address this limitation, earlier research has shown that one could use individual user web browsing behavior to identify imminent exposure to malicious content. While existing methods frequently rely on temporal proximity (e.g., aggregating browsing patterns over the recent past), they do not leverage temporal ordering in user browsing, which results in suboptimal performance and is, in practice, inadequate given the low base rates of malware incidence. We introduce network and browser-level features (e.g., page rank, tab browsing time) and a temporal model that captures user behavior through a time-series representation. This not only improves classification performance by a significant margin (between 93% and 145% F1-score improvements) over previous models, but also maintains strong robustness across completely disparate sets of users. More importantly, our method shows strong resilience to concept drift, as performance holds steady over multiple years of testing. We discuss how this method is capable of anticipating future exposure. We also assess the relative importance of each feature to the performance, as well as their impact on false positive rates—whose minimization is critical to foster adoption. Finally, we discuss use cases for such behavior-based models.

Spreadsheet programming is challenging. Programmers use spreadsheet programming knowledge (e.g., formulas) and problem-solving skills to combine actions into complex tasks. Advancements in large language models have introduced language agents that observe, plan, and perform tasks, showing promise for spreadsheet creation. We present TableTalk, a spreadsheet programming agent embodying three design principles—scaffolding, flexibility, and incrementality—derived from studies with seven spreadsheet programmers and 85 Excel templates. TableTalk guides programmers through structured plans based on professional workflows, generating three potential next steps to adapt plans to programmer needs. It uses pre-defined tools to generate spreadsheet components and incrementally build spreadsheets. In a study with 20 programmers, TableTalk produced higher-quality spreadsheets 2.3 times more likely to be preferred than the baseline. It reduced cognitive load and thinking time by 12.6%. From this, we derive design guidelines for agentic spreadsheet programming tools and discuss implications on spreadsheet programming, end-user programming, AI-assisted programming, and human-agent collaboration.

Build reproducibility of container images is essential to ensure that deployed systems will work as expected and have not been tampered with. However, bit-by-bit reproducibility of container images is almost never achievable due to external factors, and it is also very slow and labor intensive to determine the causes and severity of reproducibility failures. In this paper, we present a taxonomy of reproducibility issues for container images, as well as a tool, Vessel Diff, to help automatically categorize the type and severity of reproducibility failures in container images. We analyzed a set of open source repositories where container images are built to find common patterns and configure our tool to properly categorize failures. Our analysis shows that approximately 87% of their reproducibility failures were automatically classified by the tool according to our taxonomy. However, the vast majority of these failures were caused by trivial issues and not non-trivial issues, which could cause noticeable changes in execution of container applications and are more difficult to detect. These results highlight the need for additional research and tooling to detect, classify, and fix reproducibility issues, especially those that can lead to major failures.

BackgroundDespite its substantial burden, hypertensive heart disease (HHD) remains underrecognized. We aimed to investigate the global burden of HHD projected up to 2050.MethodsWe utilized data from the Global Burden of Disease Study (GBD) 2021 to estimate the global HHD burden. The burden was assessed using prevalence, death, and disability-adjusted life years (DALYs), stratified by region, age, sex, and Socio-demographic Index (SDI), with all estimates accompanied by 95% uncertainty intervals (UIs). We ranked age-standardized DALY rates attributable to six risk factors. Forecasting analysis was conducted using the GBD 2021 forecast framework, supplemented by Das Gupta decomposition analysis.ResultsFrom 1990 to 2021, the global age-standardized prevalence rate increased from 125.44 per 100,000 population (95% UI, 98.97–157.96) to 148.32 (117.32–186.28). In contrast, age-standardized mortality and DALY rates declined to 16.31 per 100,000 population (95% UI, 13.76–18.01) and 301.58 (255.06–332.06), respectively. HHD burden increased with age and was more pronounced in women, particularly among older populations. High systolic blood pressure ranked first among six identified risk factors. Forecasting up to 2050 projected increases in age-standardized mortality (19.11 [95% UI, 13.24–27.45]) and DALY rates (367.80 [255.27–524.52]), despite declining trends over the past three decades. Population growth was the main driver of the projected increase, as shown by Das Gupta decomposition.ConclusionsThe rising burden of HHD calls for a shift away from traditional, fragmented approaches focused solely on blood pressure control. Integrated clinical and policy responses are urgently needed to address the complex and multifactorial nature of the disease.

Tonsilloliths can be seen on panoramic radiographs (PRs) as deposits located on the middle portion of the ramus of the mandible. Although tonsilloliths are clinically harmless, the high risk of misdiagnosis leads to unnecessary advanced examinations and interventions, thus jeopardizing patient safety and increasing unnecessary resource use in the healthcare system. Therefore, this study aims to meet an important clinical need by providing accurate and rapid diagnostic support. The dataset consisted of a total of 275 PRs, with 125 PRs lacking tonsillolith and 150 PRs having tonsillolith. ResNet and EfficientNet CNN models were assessed during the model selection process. An evaluation was conducted to analyze the learning capacity, intricacy, and compatibility of each model with the problem at hand. The effectiveness of the models was evaluated using accuracy, recall, precision, and F1 score measures following the training phase. Both the ResNet18 and EfficientNetB0 models were able to differentiate between tonsillolith-present and tonsillolith-absent conditions with an average accuracy of 89%. ResNet101 demonstrated underperformance when contrasted with other models. EfficientNetB1 exhibits satisfactory accuracy in both categories. The EfficientNetB0 model exhibits a 93% precision, 87% recall, 90% F1 score, and 89% accuracy. This study indicates that implementing AI-powered deep learning techniques would significantly improve the clinical diagnosis of tonsilloliths.

Currently, medical vision language models are widely used in medical vision question answering tasks. However, existing models are confronted with two issues: for input, the model only relies on text instructions and lacks direct understanding of visual clues in the image; for output, the model only gives text answers and lacks connection with key areas in the image. To address these issues, we propose a unified medical vision language model MIMO, with visual referring Multimodal Input and pixel grounding Multimodal Output. MIMO can not only combine visual clues and textual instructions to understand complex medical images and semantics, but can also ground medical terminologies in textual output within the image. To overcome the scarcity of relevant data in the medical field, we propose MIMOSeg, a comprehensive medical multimodal dataset including 895K samples. MIMOSeg is constructed from four different perspectives, covering basic instruction following and complex question answering with multimodal input and multimodal output. We conduct experiments on several downstream medical multimodal tasks. Extensive experimental results verify that MIMO can uniquely combine visual referring and pixel grounding capabilities, which are not available in previous models. Our project can be found in https://github.com/pkusixspace/MIMO.

Non-functional requirements (NFRs), such as usability, safety, security, and the like, describe how well the software system should do what it’s intended to do functionally, and, as such, should be addressed well. However, addressing NFRs well is not easy. In this talk, I will explore using Generative AI for facilitating representation and reasoning with NFRs, at a time when interest in utilizing Machine Leaning/Generative AI seems to be spreading like a wildfire in many industries and research areas. Unsurprisingly, software engineering more broadly, and requirements engineering more specifically, seems no exception to this. After discussing a problem-driven, ontology-based approach to question (prompt) engineering, I will briefly describe some critical challenges going forward at the end.

Neural network models have emerged over the last decade as the standard for perception in many robotic systems. While powerful, these models are opaque and practitioners often rely on empirical evaluation using standard metrics and held-out test sets to understand their performance. However, such model-level testing ignores how the outputs of perception models will be used in downstream components within a robotic system. In this work, we create a new family of object detection metrics that can accurately evaluate performance when detectors are used for object tracking in a robotic system. We show that mean Average Precision (mAP), arguably the most common metric for evaluating object detectors, does not strongly correlate with tracking performance. We propose an alternative family of metrics, the Match’n Metric, that makes few, simple assumptions about downstream tracking algorithms and does not require the implementation of a tracker to compute. We show empirically that across a number of object detection models and tracking algorithms that Match’n Metric more accurately correlates with tracking performance than mAP. Equipped with this metric, practitioners can better evaluate object detectors for their ability to be used in robotic systems that require object tracking.

MongoDB is increasingly adopted for artificial intelligence (AI), machine learning (ML), and Internet of Things (IoT) applications due to its flexible, document-oriented architecture and scalability. However, the challenge of efficiently managing vast, heterogeneous, and unstructured data generated by modern IoT and AI/ML systems remains underexplored. This paper examines how MongoDB addresses these challenges and evaluates its effectiveness compared to traditional relational databases. Our approach involves analyzing MongoDB’s schema-less design, native support for diverse data types, and horizontal scaling via sharding, with a focus on real-time analytics, integration with AI frameworks, and IoT-specific features such as time-series collections and change streams. Performance metrics, including data ingestion rates, query latency, and scalability—are assessed through case studies and benchmarking against MySQL. Results indicate that MongoDB outperforms relational databases in flexibility, ease of handling unstructured data, and scalability, particularly in scenarios involving large-scale sensor data and dynamic AI/ML workflows. For example, in IoT deployments, MongoDB supports real-time analytics and efficient storage of billions of records, enabling rapid insights and predictive maintenance. In conclusion, MongoDB’s architecture and evolving feature set make it a robust platform for organizations leveraging AI, ML, and IoT. Its ability to manage complex, high-velocity data streams enhances operational efficiency and supports advanced analytics, positioning it as a preferred solution for next-generation data-driven applications