Effects of Automated Static Analysis Tools: A Multidimensional View on Quality Evolution

Aims: Software quality assurance is a formal process for evaluating and documenting the quality of the work products during each stage of the software development lifecycle.The practice of applying software metrics to operational factors and to maintain factors is a complex task.Successful software quality assurance is highly dependent on software metrics.It needs linkage the software quality model and software metrics through quality factors in order to offer measure method for software quality assurance.The contributions of this paper build an appropriate method of Software quality metrics application in quality life cycle with software quality assurance.Design: The purpose approach defines some software metrics in the factors and discussed several software quality assurance model and some quality factors measure method.Methodology: This paper solves customer value evaluation problem are: Build a framework of combination of software quality criteria.Describes software metrics.Build Software quality metrics application in quality life cycle with software quality assurance.Results: From the appropriate method of Software quality metrics application in quality life cycle with software quality assurance, each activity in the software life cycle, there is one or more QA quality measure metrics focus on ensuring the quality of the process and the resulting product.Future research is need to extend and improve the methodology to extend metrics that have been validated on one project, using our criteria, valid measures of quality on future software project.

Software use is ubiquitous. The quality and the evolution of quality over long periods of time is therefore of notable importance. Software engineering research investigates software quality in multiple areas. One of these areas are predictive models, in which measurements of past changes to the source code or file contents are used to assess the quality of changes, files or even product releases. However, these predictive models have yet to transition from research to practice on a larger scale. In contrast, Automated Static Analysis Tools (ASATs) are used in practice and are also part of several software quality models. ASATs are able to warn developers about parts of the source code that violate best practices or match common defect patterns. One downside of ASATs are false positives, i.e., warnings about parts of the code which are not problematic. Developers have to manually assess the warnings and annotate the code or the ASAT configuration to mitigate this. Within this thesis, we investigate the evolution of software quality with a focus on a general purpose ASAT for Java. Our main objective is to determine if the use of an ASAT can improve software quality, as measured by defects, significantly enough to mitigate additional effort by the developers to use the ASAT. We combine multiple software engineering research techniques and data validation studies to improve the signal-to-noise ratio to increase the validity and stability of our results. We focus on a general purpose ASAT for the Java programming language due to the maturity of the language and the large number of projects available for this language. Both the language and the general purpose ASAT have been available for a long time, which allows us to include longer periods of time for our analyses. We study how the ASAT is applied, how the generated warnings evolve over long time periods, and how it affects the quality of the source code in terms of defects. In addition, we include the perspective of the developers regarding software quality improvement by measuring changes when developers intend to improve the quality of the source code. Our studies yield surprising insights. While our results show that ASATs have a positive impact on software quality, the magnitude of the impact is much smaller than expected. Moreover, we can show that corrective changes are the main driver of complexity in software projects. They introduce more complexity than feature additions or any other type of maintenance. In addition, we find that software quality estimation models benefit more from size and complexity metrics than static analysis warnings of an ASAT. Our study of developer intents to increase software quality mirrors this result.

Static analyzers have become increasingly popular both as developer tools and as subjects of empirical studies. Whereas static analysis tools exist for disparate programming languages, the bulk of the empirical research has focused on the popular Java programming language. In this paper, we investigate to what extent some known results about using static analyzers for Java change when considering C#-another popular object-oriented language. To this end, we combine two replications of previous Java studies. First, we study which static analysis tools are most widely used among C# developers, and which warnings are more commonly reported by these tools on open-source C# projects. Second, we develop and empirically evaluate EagleRepair: a technique to automatically fix code in response to static analysis warnings; this is a replication of our previous work for Java [20]. Our replication indicates, among other things, that 1) static code analysis is fairly popular among C# developers too; 2) Re-Sharper is the most widely used static analyzer for C#; 3) several static analysis rules are commonly violated in both Java and C# projects; 4) automatically generating fixes to static code analysis warnings with good precision is feasible in C#. The EagleRepair tool developed for this research is available as open source.

Although many improvements for software development are proposed by software engineers, the embedded system community faces a hard task in applying these improvements to software development, due to the strong dependence between software and hardware in embedded systems, which raises a trade-off between software quality, measured by traditional metrics, and optimization for a specific platform. Traditional software quality concerns reuse, abstraction, coupling, and coherence. Such concepts are usually in conflict with performance, memory footprint, and other physical metrics used for design evaluation in embedded systems. The purpose of this work is to evaluate the relationship between quality metrics for software products and physical metrics for embedded systems, in order to guide an embedded designer in selecting the best alternative design during design space exploration already at the model level. After the experiments, we could analyze the correlation between these metrics and highlight the behavior for quality and physical metrics, which help us to better understand the trade-off between reuse and optimization.

Numerous virtual environments with automatic program evaluation have emerged to assist the teaching-learning process, allowing timely feedback. In a review of these environments, we find few studies that focus on an approach centered on refactoring: where students are strongly encouraged to refactor, improving the submitted code to also meet quality criteria. In a traditional environment, the student submits the answer and if it is dynamically correct, he goes to the next question. In this work, we propose a complementary approach based on software engineering metrics, which allow a finer evaluation of the code where the programmer, after having his dynamically correct answer, is invited and encouraged to refactor his solution towards an optimal code that also meets the software quality metrics. The work is based on source code in the Python language and shows which software quality metrics can be used with the purpose of encouraging students to refactor their code in programming fundamentals disciplines.

Software quality indicates how effective and efficient a software is. Various standards need to be used to evaluate software quality. One of the most important internationally accepted standards for measuring software quality is the ISO/IEC 25010 software quality standard. With this standard, the quality of a software product is evaluated with eight different metrics. These are functional suitability, performance, compatibility, usability, reliability, security, maintainability and portability metrics. In this study, we tried to determine the relationship between user feedback and the metrics of the ISO/IEC 25010 software quality standard. Machine learning (ML) and natural language processing (NLP) techniques were used to classify user comments. After the data preprocessing phase, vectors of user comments were extracted with the Tf-Idf method for NLP. As a machine learning method, classification was made using five different models: Extra Trees Classifier (ETC), Gaussian Process Classifier (GPC), MLP Classifier (MLPC), Bernoulli Naive Bayes Classifier (BNBC) and Support Vector Classifier (SVC). Our goal is to show how quality metrics can be classified into multiple classes using user notifications. The data set used has an unbalanced structure, containing 1681 user comments classified by software experts. Synthetic Minority Oversampling Technique (SMOTE) was used to address the imbalance in the dataset. The results were compared by applying the same classification models to unbalanced and balanced data sets. According to the results obtained, the best classification model is the Extra Trees Classifier model, which provides the highest accuracy rate of 87% according to the SMOTE applied data set. The results show that ML and NLP methods can be used effectively in the classification process of software quality metrics.

Source code refactorings and transformations are extensively used by embedded system developers to improve the quality of applications, often supported by various open source and proprietary tools. They either aim at improving the design time quality such as the maintainability and reusability of software artifacts, or the runtime quality such as performance and energy efficiency. However, an inherent trade-off between design- and run-time qualities is often present posing challenges to embedded software development. This work is a first step towards the investigation of the impact of transformations for improving the performance and the energy efficiency on software quality metrics and the impact of refactorings for increasing the design time quality on the execution time, the memory and the energy consumption. Based on a set of embedded applications from widely used benchmark suites and typical transformations and refactorings, we identify interrelations and trade-offs between the aforementioned metrics.

Virtual Reality (VR) Software is becoming more mainstream in recent years. It has provided an opportunity for VR practitioners to explore new domains and deliver cutting edge products. The success of the VR products depends primarily on the product contextual relevance and qualities exhibited. However, it is unclear how VR practitioners curb software quality challenges and improve the essence of the VR product over every release. In this paper, we present a Systematic Mapping Study of the software quality metrics adopted by VR practitioners for assessing the quality of their VR products. The study showed that practitioners used unique metrics to measure the quality of their VR products in addition to adopting some of existing enterprise software metrics. Further, we consolidate these metrics into different themes that future practitioners may use for developing VR products.

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

Empirical Analysis of Quality Models in Practice in Small IT Companies in SEE Region

Machine Learning (ML) projects incur novel challenges in their development and productionisation over traditional software applications, though established principles and best practices in ensuring the project's software quality still apply. While using static analysis to catch code smells has been shown to improve software quality attributes, it is only a small piece of the software quality puzzle, especially in the case of ML projects given their additional challenges and lower degree of Software Engineering (SE) experience in the data scientists that develop them. We introduce the novel concept of project smells which consider deficits in project management as a more holistic perspective on software quality in ML projects. An open-source static analysis tool mllint was also implemented to help detect and mitigate these. Our research evaluates this novel concept of project smells in the industrial context of ING, a global bank and large software- and data-intensive organisation. We also investigate the perceived importance of these project smells for proof-of-concept versus production-ready ML projects, as well as the perceived obstructions and benefits to using static analysis tools such as mllint. Our findings indicate a need for context-aware static analysis tools, that fit the needs of the project at its current stage of development, while requiring minimal configuration effort from the user.

: The Rome Air Development Center has developed the Software Quality Framework as a means to specify software quality goals and measure software quality. Much of the work to date has focused on metrics applicable to software code. This report describes an effort undertaken to measure the quality of software products earlier in the software development life cycle, during the design phase, and to automate the capture of metric data from design media. Metrics of software quality, primarily those related to the criterion simplicity (or conversely, complexity), were reviewed. This review includes those metrics previously developed in the Software Quality Framework. Two metrics, Halstead's Software Science and McCabe's Cyclomatic Complexity were chosen for their amenability to measurement during design and their potential for automation. Two design media were used: Design Aids for Real-Time Systems, an experimental automated design tool developed at the Charles Stark Draper Laboratory; and Ada as a program design language.

The growing scale of large language models (LLMs) not only demands extensive computational resources but also raises environmental concerns due to their increasing carbon footprint. Model quantization emerges as an effective approach that can reduce the resource demands of LLMs by decreasing parameter precision without substantially affecting performance (e.g., 16 bit <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\rightarrow 4$</tex> bit). While recent studies have established quantization as a promising approach for optimizing large code models (LCMs)-a specialized subset of LLMs tailored for automated software engineering-their findings offer only limited insights into its practical implications. Specifically, current investigations only focus on the functional correctness of the code generated by quantized models, neglecting the gap that remains in understanding how quantization impacts critical aspects of quality attributes of the code, such as reliability, maintainability, and security. To bridge this gap, our study investigates the effects of quantization on the qualitative aspects of automatically generated code. We apply Activation-aware Weight Quantization (AWQ) to two widely used code models-CodeLlama and DeepSeekCoder-to generate Java and Python code. Leveraging state-of-the-art static analysis tools, we evaluate software quality metrics and static features, including cyclomatic complexity, cognitive complexity, and lines of code (LoC). Our findings reveal that quantization not only establishes itself as a robust technique capable of withstanding functional challenges-producing code that passes test cases at rates comparable to non-quantized models-but also preserves key qualitative attributes and static features often sought after by developers, such as maintainability and structural complexity.

In the context of software engineering, product software quality measures how well a software artifact is designed and coded. Software products must satisfy nonfunctional properties (eg, reliability, usability, understandability, and maintainability), in order to make maintenance and evolution sustainable in the long period. Software evolution is an issue of interest for the malware writers, too, for 2 reasons. First, to evade detection with the minimum effort, malware writers use to produce “variants,” which are obtained by applying little changes to existing malware. Morevoer, recent studies demonstrated that malware is increasingly improving evasion strategies and infection mechanisms and is using more and more complex payloads. This suggests that malware writers are devoting relevant efforts and skills for producing high‐quality software. For this reason, we wonder whether malware writers are devoting effort to improve the structural quality of their code, too, as it happens in the development of goodware. To investigate this question, we (1) characterize a dataset containing about 20 000 Android applications, divided into goodware and malware ones, relying on the Android API version they require, and (2) compute software quality metrics, divided into 4 categories (ie, dimensional, complexity, object‐oriented, and Android‐oriented metrics) for apps belonging to each population. We then identify evolution trends of these metrics in malware and goodware. The results of our study demonstrate that goodware and malicious applications exhibit similar evolution trends for some of the quality indicators, suggesting that malware writers care about the overall quality of their code. Code quality could be considered an indirect measure of how many and how fast variants of existing malware will be released in the wild.

: Software metrics (or measurements) which predict software quality have been refined and enhanced. Metrics were classified as anomaly-detecting metrics which identify deficiencies in documentation or source code, predictive metrics which measure the logic of the design and implementation, and acceptance metrics which are applied to the end product to assess compliance with requirements. A Software Quality Measurement Manual was produced which contained procedures and guidelines for assisting software system developers in setting quality goals, applying metrics and making quality assessments.