ABSTRACT As software applications get increasingly connected and complex, cybersecurity becomes more and more important to consider during development and evaluation. Software engineers need to be aware of various security threats and the countermeasures that can be taken to mitigate them. Currently, there is a lack of guidance for software engineers aiming to develop secure web applications. We conducted a design science research study, resulting in a set of guidelines to aid software engineers in developing secure web applications. The set of guidelines was constructed based on interview data with 10 industry practitioners. These guidelines were then evaluated using a survey with 28 respondents. Additionally, we conducted experiments in which we provided a large language model with our guidelines and vulnerability reports as input. The large language model should extend the given vulnerability reports by recommending which of our guidelines can help prevent the given vulnerability in the future. The extended reports were evaluated by two external researchers experienced in cyber security and one author. Our results indicate that developers consider using these proposed guidelines for the development and assessment of secure web applications in different stages of the software development lifecycle. Our results also show that it is possible to automatically enhance vulnerability reports to support developers meaningfully and that the guidelines recommended by the large language model are useful to prevent the respective vulnerabilities in the future.

ABSTRACT This study presents a comprehensive comparative analysis of the performance of different JavaScript engines in the context of React Native hybrid applications, with a particular focus on the differences between JavaScript Interface (JSI) and bridge architectures. The study conducted a series of performance tests on the most popular JavaScript engines, including Hermes, JavaScriptCore (JSC), and V8, using a set of standard benchmarks and use cases. As part of the research, a QuickJS engine communication layer was created, and necessary changes were proposed to the React Native framework and engine code. The testing methodology included measurements of application package size, interaction time, memory usage, UI rendering performance, and operation execution speed. Tests were conducted on identical components implemented in both React Native architectures, allowing a direct comparison of the impact of architecture on JavaScript engine performance. The results of the experiment indicate differences in engine performance depending on the scenario and describe the differences between their use in bridge and JSI architectures.

ABSTRACT Cybersecurity risks are increasing in frequency and complexity, but many organizations struggle to plan and implement adequate protections at all stages of the software development life cycle (SDLC). Security is frequently added at the end of development (afterthought), and making effective use of safeguard space is difficult for IT leaders. The purpose of this study is to produce an all‐encompassing framework to adopt and ensure security throughout each phase of the SDLC, from planning through maintenance. The aim is to minimize vulnerabilities and improve the resilience of software by making “security by design” a structure that not only adopts security elegantly as a living document but also is built to be part of the development process. This study adopted a mixed‐methods approach. The initial stage of inquiry involved a systematic literature review (SLR) to identify common cybersecurity issues associated with each SDLC phase. The SLR was followed by an empirical survey of 71 software professionals from a variety of organizations. The survey was designed to gather perceived threats, current practices, and challenges associated with software development for survey participants' organizations. The data collected were analyzed and reviewed statistically, through chi‐square tests and ANOVA, to profile the variance relative to the size of the organization, geographic region, and experience level of the practitioner. The results noted several high‐risk challenges across the SDLC: underfunded security controls, imprecise requirements, insecure architecture, software bugs (i.e., injection vulnerabilities), inadequate testing, misconfigured production environments, and unreliable maintenance. The proposed framework provides cybersecurity mitigation techniques for each stage of the SDLC, such as leveraging security‐oriented design patterns, secure coding policies (i.e., input validation and authentication protocols), robust testing (i.e., penetration testing and code review), and continuous monitoring after deployment. The implementation of these measures leads to a significant risk reduction in the overall organizational security posture. The framework is a formalized end‐to‐end approach to secure software development by embedding security throughout the cycle. Embedding security as a part of the process versus an afterthought at every stage of the cycle creates a risk reduction impact. This integrated approach also provides organizations with the opportunity to foresee and mitigate events earlier in the cycle, along with general compliance mandates (i.e., GDPR, HIPAA, and PCI‐DSS), to provide more resilient, trustworthy software systems.

ABSTRACTAn operating system is the essence of software, serving as the foundation for the operation of various application software. The security of the operating system is crucial for national informatization construction. Data indicate that many cybersecurity incidents result from exploiting security vulnerabilities in the operating system. Linux is currently the most widely used open‐source operating system, with thousands of Common Vulnerabilities and Exposures (CVEs) related to Linux systems reported each year. Therefore, research and prevention of vulnerabilities in the Linux system are particularly important. To gain a better understanding of the characteristics of Linux system vulnerabilities, this paper leverages knowledge in the field of software security to analyze nearly 10,000 historical vulnerability data in two core systems of Linux: Linux Kernel and Debian Linux. The study explores the evolutionary patterns of vulnerability characteristics. Specific research contents include the following: (1) data collection and cleaning of vulnerability data in Linux Kernel and Debian Linux systems; (2) cross‐statistical analysis of structured data features in vulnerability reports; (3) unstructured data characteristics mining in vulnerability reports based on domain knowledge; (4) analysis of the evolution of vulnerability characteristics. This paper provides empirical lessons and guidance for Linux system vulnerabilities to assist practitioners and researchers in better preventing and detecting vulnerabilities in Linux and Linux‐based systems.

ABSTRACTCode generation for users' intent has become increasingly prevalent with the large language models (LLMs). To automatically evaluate the effectiveness of these models, multiple execution‐based benchmarks are proposed, including specially crafted tasks, accompanied by some test cases and a ground truth solution. LLMs are regarded as well‐performed in code generation tasks if they can pass the test cases corresponding to most tasks in these benchmarks. However, it is unknown whether the test cases have sufficient test adequacy and whether the test adequacy can affect the evaluation. In this paper, we conducted an empirical study to evaluate the test adequacy of the execution‐based benchmarks and to explore their effects during evaluation for LLMs. Based on the evaluation of the widely used benchmarks, HumanEval, MBPP, and two enhanced benchmarks HumanEval+ and MBPP+, we obtained the following results: (1) All the evaluated benchmarks have high statement coverage (above 99.16%), low branch coverage (74.39%) and low mutation score (87.69%). Especially for the tasks with higher cyclomatic complexities in the HumanEval and MBPP, the mutation score of test cases is lower. (2) No significant correlation exists between test adequacy (statement coverage, branch coverage and mutation score) of benchmarks and evaluating results on LLMs at the individual task level. (3) There is a significant positive correlation between mutation score‐based evaluation and another execution‐based evaluation metric () on LLMs at the individual task level. (4) The existing test case augmentation techniques have limited improvement in the coverage of test cases in the benchmark, while significantly improving the mutation score by approximately 34.60% and also can bring a more rigorous evaluation to LLMs on code generation. (5) The LLM‐based test case generation technique (EvalPlus) performs better than the traditional search‐based technique (Pynguin) in improving the benchmarks' test quality and evaluation ability of code generation.

The "Journal of Software: Evolution and Process" is an archival journal that publishes high quality, state of the art research and practice papers dealing with the conception, development, testing, management, quality, maintenance, and evolution of software, systems, and services, as well as the continuous improvement of processes and capabilities surrounding them.The journal continues the tradition of "The Journal of Software Maintenance and Evolution: Research and Practice" and "Software Process: Improvements and Practice".We will therefore continue to cover the traditional topics related to software maintenance and evolution as well as software process improvement and practice.At the same time, the concept behind the journal has evolved into a unified vision that recognizes the fundamental changes and transformations that are occurring in the fields of software and systems engineering and the need for us to adapt by broadening the topics that we address and the research methods that are used coupled with the perspectives that are utilised.Fundamental changes are occurring in the variety, scale and scope of software, systems and services that are being developed from new web and mobile computing to battle theatre technologies and everything in between. Areas of interest include but are not limited to:How software, systems and enabled services are conceived, justified, created, managed, maintained and evolved over time How new underlying technologies (which are constantly changing) can be elegantly integrated and dealt with as systems evolve over time How new platforms and architectures are developed, tested, modified, and evolved to create the variety of applications needed now, and in the future How new processes and tools can be utilised in all phases of the development lifecycle (from system concept to test) in order to conceive, justify, create, modify and evolve these new technologies, platforms, systems and services How high-level representations of existing software, systems and services can be reverse engineered and used to support maintenance and evolution How people issues regarding cross disciplinary or geographically dispersed virtual teams can be addressed How the skill sets needed to participate and manage these projects will be developed How globally dispersed projects should be managed How new models of collaboration and participation will be deployed and managed.What models will be used to estimate costs and predict performance of projects and process changes, The technical, schedule, budgetary and other risks associated with developing and evolving new systems and how they will be managed How to improve organisational capability and maturity How maturity assessments and evaluations can contribute to organisations How to continuously improve processes associated with software, systems and services The new business models that are needed for the software, systems, and services What the performance impact of process changes will be How process change efforts impacting systems and services will be managed and organised How justification, sourcing and technical development decisions will be made as software and systems evolve from products to services, or more likely a combination of both, along with tiered levels of service based on a "pay as you go" and "value in use" business models How the impacts of agile development and management of new software, systems and services will impact systems, services and organisationsThe journal publishes research papers, empirical studies and state-of-the-art surveys.Occasionally, we publish special issues on topics of particular interest; proposals for such issues are welcome.