23rd of April at 16h00, Roberta De Luca (UNINA) will give a presentation entitled“Enhancing Trustworthiness of AI Code Generators” Location: G4.1
Abstract AI-powered code generation tools are rapidly transforming software development, but they can also introduce critical security vulnerabilities. In this talk, I will present DeVAIC, a framework for detecting and patching vulnerabilities in AI-generated code. I will discuss our findings on the flaws introduced by Large Language Models (LLMs), and share insights into how automated techniques can enhance the reliability and security of generated code. The goal is to make AI-assisted programming more trustworthy and secure.
Bio Roberta De Luca is a PhD student in Information Technologies and Electrical Engineering (ITEE) and a member of the Dependable and Secure Software Engineering and Real-Time Systems (DESSERT) group at the University of Naples Federico II. Her research focuses on enhancing the trustworthiness, robustness, and security of AI-generated code, investigating techniques to mitigate vulnerabilities introduced by automated code generation tools.She has experience in static analysis, vulnerability detection, and secure software development. As part of her PhD work, she explores methods to improve the reliability of code generators by integrating security-aware mechanisms, reducing the likelihood of introducing exploitable flaws in AI-assisted programming environments
26th of March at 16h00, Sadaf Azimi and Iury Araujo will give two short presentations, to promote discussion on two relevant ongoing or disruptive topics. Afterwards, there will be a social gathering where everyone can talk freely on whatever subjects they like. Location: G4.1Online: https://videoconf-colibri.zoom.us/j/97404078835?pwd=7iIG7YqLwXgZU5g7QHZKFbuAMyInqb.1
Bio Sadaf Azimi is an IT professional with Over 11 years of experience as an IT Lecturer and as an analyst and developer of medium-scale projects in the area of IT Systems, such as marketing software and warehouse management. She graduated with a bachelor’s degree in Computer Engineering (Software) from the Islamic Azad University of Tuyserkan in February 2008 in Iran. Later, she got her two-year master‘s degree in Knowledge Management from Malaysia Multimedia University in June 2012 in Malaysia.She continued her academic journey in 2022, enrolling in the doctoral program in Informatics Engineering at the University of Coimbra. Her research for her Ph.D. focuses on addressing the security in smart contracts by conducting a thorough analysis of the known security vulnerabilities, identifying design patterns that can mitigate these risks, proposing new security design patterns to fill gaps, and using software metrics as an indicator of software quality to help developers implement more secure smart contracts. Furthermore, her research aims to evaluate and benchmark the effectiveness of existing static vulnerability detection tools. She seeks to contribute to the field of blockchain and smart contract security, ultimately enhancing the security and reliability of smart contracts in real-world applications.
Abstract Smart contracts have accelerated the adoption of blockchain technology across various domains by enabling coded agreements between transaction participants. However, increased software defects and vulnerabilities in smart contracts, driven by developer inexperience with languages like Solidity and a lack of effective detection tools, pose significant risks. Given the high value of assets managed on blockchain, these vulnerabilities can lead to severe consequences.Researchers and practitioners have proposed numerous smart contract design patterns to mitigate certain faults or vulnerabilities. Despite these efforts, it remains unclear which types of defects these patterns target and how effectively they address the wide range of existing smart contract security vulnerabilities. In this paper, we review the state of the art in smart contract design patterns, categorizing them and analyzing their effectiveness in mitigating known security vulnerabilities. Our findings reveal that only five patterns directly aim to prevent security vulnerabilities, collectively addressing just 6 out of 94 security issues identified by OpenSCV, highlighting the need for further research on smart contract security design patterns.
Iury Araujo – “Enhancing Intrusion Detection in Containerized Services: Assessing Machine Learning Models and an Advanced Representation for System Call Data”
Bio Iury holds a BSc degree in Computer Science and a MSc in Informatics from the Federal University of Paraíba, Brazil. He is pursuing a PhD in Informatics Engineering at the University of Coimbra, Portugal, focusing on intrusion detection in containerized services based on machine learning.
Abstract Security is a fundamental requirement for modern digital systems, particularly in environments such as cloud computing, IoT, and microservices. Intrusion Detection Systems play a crucial role in identifying and mitigating threats, yet securing containerized services remains a significant challenge due to their architecture and shared resource dependencies. This presentation will explore a machine learning-based approach to enhance intrusion detection in containerized environments. We introduce a novel graph-based representation of system calls to preserve contextual relationships, improving detection performance while maintaining low false alarm rates. Additionally, a sliding window-based post-processing phase further refines detection.
12th of March at 16h00, Carlos Baquero (FEUP) will give a presentation entitled“CRDTs: State-based approaches and efficient remote state synchronisation” Location: G4.1
Abstract In primary-secondary replication, updating an outdated secondary replica when the primary changes is inefficient due to sizeable state and bandwidth constraints. The RSync algorithm, introduced in the nineties for file systems, solves this problem by partitioning file data, using hash functions to compare files, and transferring only the necessary data. However, RSync requires users to know which file has the most recent state and which needs updating. Like a file copy command, it has a source and a target, making synchronisation fail if either (i) here is no knowledge of which file was updated; or (ii) both files are updated.We will present ConflictSync, a solution that leverages the properties of Conflict-free Replicated Data Files (CRDTs). While RSync can handle arbitrary file data, it interprets files as byte sequences. To reconcile divergent states, we need more information on the data interpreted as a CRDT. Our solution works on any state-based CRDT and uses join decompositions, cryptographic hash functions, and Bloom filters.
Bio Carlos Baquero is a Professor in the Department of Informatics Engineering at FEUP. Research interests cover data management in eventual consistent settings, distributed data aggregation and causality tracking. In the last years, he has collaborated with co-authors in the development of data summary mechanisms such as Scalable Bloom Filters, causality tracking for dynamic settings with Interval Tree Clocks and Dotted Version Vectors and in predictable eventual consistency with Conflict-Free Replicated Data Types. My work has been applied in several systems, including the Riak distributed database, Redis CRDBs, Akka distributed data, and Microsoft Azure Cosmos DB.
26th of February at 16h00, Lino Santos (head of National Cybersecurity Center – NCSC/CNCS) will give a presentation entitled“Cybersecurity in Portugal: Challenges and Opportunities” Location: G4.1
Bio Lino Santos has a master’s degree in Law and Security from the Faculty of Law of Universidade Nova de Lisboa and a Computer Science degree from Universidade do Minho. He is head of the Portuguese National Cybersecurity Center (CNCS) and an appointed member to the board of directors of the European Agency for Cybersecurity (ENISA).He previously was Director for security and users’ services at the National Foundation for Scientific Computing. He was appointed member for the CNCS installation commission. He has also a certification in Managing Computer Security Incident Response Teams, from Carnegie Mellon University, and from the Program on Cyber Security Studies, George C. Marshall Center.
12th of February at 16h00, Sara Santos (Critical Software) will give a presentation entitled“Behaviour-Driven Development and the Role of Communication” Location: G4.1
Abstract Behaviour-Driven Development is a software development methodology that extends Test-Driven Development by emphasizing collaboration among developers, testers, and business stakeholders. The core principle of BDD is defining system behaviour in a human-readable format using structured natural language, enabling a shared understanding of requirements. Communication is the key factor in BDD, as it fosters clear alignment between technical implementation and business expectations. By encouraging early discussions and continuous feedback, BDD ensures that software is developed with a focus on user needs, reducing misunderstandings and costly rework. This approach strengthens cross-functional collaboration, enhances requirement clarity, and improves overall software quality.
Bio Sara Santos started with a degree in psychology, and decided to transition into software development. Currently, I am a Solutions Architect with 7 years of experience in software engineering, and have been working in Critical Software, mainly in projects focused on the energy sector. As a Solutions Architect, I am often involved in discussions with stakeholders where BDD plays a crucial role in aligning technical solutions with business requirements.
8th of January at 16h00, Rafael Pereira (Critical Software) and Francisco Giro (Critical Software) will give a presentation entitled“Retrieval Augmented Generation for Private Data” Location: G4.1
Abstract Critical Software provides third-line support for major projects, requiring access to data from sources like Confluence, JIRA, and documentation. Locating relevant information is difficult, especially as team members change over time. To address this, we developed a virtual assistant with a Large Language Model (LLM) using Retrieval Augmented Generation (RAG). The assistant integrates diverse data sources, ensures data confidentiality, and adapts to different projects. It combines VectorRAG and GraphRAG for accurate and contextual responses. Our work also includes Open-Source Software contributions to LangChain, enhancing tools for building LLM-powered applications.
Bio Rafael Pereira is a passionate software engineer with a Master’s degree in Computer Science from Polytechnic University of Leiria. His research focuses on emotion detection through computer vision, with several published scientific papers exploring innovative approaches such as deep learning and pose estimation for real-time emotion analysis. At Critical Software, he is actively involved in different initiatives aimed at promoting the adoption and integration of AI within the company. Francisco Giro is a Software Engineer with a Master’s degree in Computer Science from Instituto Superior Técnico (IST), Lisbon. With nearly two years of experience at Critical Software, he specializes in Java development and collaborated on an AI initiative within the company, applying innovative approaches to research and development.
18th of December at 16h00, Jessica Maciel and Horácio França will give two short presentations, to promote discussion on two relevant ongoing or disruptive topics. Afterwards, there will be a social gathering where everyone can talk freely on whatever subjects they like. Location: G4.1
Jessica Maciel – “Developing Attack Detection Models for Microservice Applications”
Bio Jessica holds a BSc degree in Computer Science and a MSc in Informatics from the Federal University of Paraíba, Brazil. She is currently pursuing a PhD in Informatics Engineering at the University of Coimbra, Portugal, with a focus on runtime security for microservice applications. Abstract Microservice architectures provide scalability and flexibility, but their distributed nature and complex service structures introduce new security challenges, especially in detecting cyberattacks. In this talk, we will present our work on developing attack detection models for microservice applications, including a framework designed to generate realistic attack data and develop detection models with illustrations in the context of DDoS attacks.
Horácio França – “Using Generative Pre-trained Transformers to Identify Security Bugs among Bug Reports”
Bio Horácio is currently a PhD student at the University of Coimbra. He has a bachelor’s degree in Computer Science and a master’s degree in Systems and Computer Engineering from the Federal University of Rio de Janeiro. His research interests include Artificial Intelligence, Cyber Security and the intersection of those subjects. Abstract Bug trackers are useful tools for developers to identify issues in their software, however, depending on how many reports are being submitted it may become hard to prioritize what to tackle first. Security issues being reported in this manner need to be identified rapidly for two reasons: Firstly, they need to be addressed in the software as quickly as possible, and secondly because a public issue report about a security bug could inform malicious actors of the existence of an exploitable vulnerability. With the increased use of GPTs across industry and academia, this problem seemed like a good application of this technology. In this presentation, we expound on the results obtained from testing 4 different GPT models on 7 different security bug report datasets.
27th of November at 16h00, Nuno Lourenço (bAI) will give a presentation entitled“Smart, Sustainable, and Evolved AI” Location: G4.1Online: https://meet.google.com/rqf-xofk-dck
Abstract In this talk, we will present and discuss how nature-inspired approaches, namely evolutionary algorithms (EAs) can address sustainability and robustness challenges in AI, namely in Deep Artificial Neural Networks (ANNs).
Bio Nuno Lourenço is an Associate Professor at the Department of Informatics Engineering of the University of Coimbra, where he obtained his PhD in Information Science and Technology in 2016. He is the current coordinator of the bio-Inspired Artificial Intelligence (bAI) group and is a member of the Centre for Informatics and Systems of the University of Coimbra (CISUC) since 2009. His main research interests are in the areas of Bio-Inspired Algorithms, Optimisation and Machine Learning. He is the co-creator of Structured Grammatical Evolution, Probabilistic Grammatical Evolution, and DENSER, a novel approach to automatically design Deep Artificial Neural Networks using Evolutionary Computation. He served as chair in the main conferences of the Evolutionary Computation field, namely EuroGP 2020 and 2021 as program chair, and PPSN 2018 and EuroGP 2019 as publication chair. He is a member of the Programme Committee of GECCO, PPSN, and EuroGP; a member of the Steering Committee of EuroGP; and an executive board member of SPECIES.
Abstract Model-Driven Engineering is a software development technique that advocates the use of models (e.g., UML models) as primary artifacts in the development process. Following this phylosophy, developers “program” using models, and source code is automatically generated from such abstract representations of the intended product. This approach is based on ad-hoc languages that are able to describe concepts of the involved domain, that is, domain-specific languages (DSLs). While MDE originated for software development, it has expanded beyond its initial software-centered focus, and it is applied to formalize and automate worflows in different domains. This talk gives an overview of the application of MDE concepts for verification of systems, and sketches possible collaboration opportunities between the University of Coimbra and NTNU.
Bio Leonardo Montecchi is Associate Professor with the Norwegian University of Science and Technology (NTNU) in Trondheim, Norway. From 2017 to 2021, he was Assistant Professor with the University of Campinas (Unicamp), Brazil. He received his PhD from the University of Firenze, Italy, in 2014, with the Resilient Computing Lab (RCL). His expertise revolves around the modeling of complex systems, including formal models, probabilistic models, and model-driven engineering. His research interests include modeling as a support to the verification and validation of safety-critical and mission-critical systems. He is regularly serving as reviewer for journals and conferences in the areas of dependability and software engineering. Leonardo has been Vice-Coordinator of the Brazilian Committee on Fault Tolerance, and Program Co-Chair of the 9th Latin-American Symposium on Dependable Computing (LADC 2019). He is Conference Chair for the 2025 edition ACM SIGSOFT FSE (Foundations of Sofware Engineering), which will be held in Trondheim on 23-27 June 2025.
13th of November at 16h00, Tiago Rolo and Rodrigo Nogueira will give two short presentations, to promote discussion on two relevant ongoing or disruptive topics. Afterwards, there will be a social gathering where everyone can talk freely on whatever subjects they like. Location: G4.1
Tiago Rolo – “Efficient Write Operations in Event Sourcing with Replication” Bio Tiago Rolo obtained his Bachelor’s degree in Informatics at the University of the Azores, followed by a Master’s in Informatics Engineering from the University of Coimbra. Now enrolled in the PhD in Informatics Engineering, his research centers on data replication within the context of Event Sourcing. Abstract Event Sourcing (ES) is an architectural pattern in which applications maintain an audit log of all state changes, stored as an immutable sequence of events. Although replicating the event log can improve dependability, existing ES technologies do not exploit replication for efficient write operations.The challenge lies in enabling write operations on replicas without disrupting the sequential ordering of the log or incurring significant communication overhead between geographically distributed replicas. We addressed these concerns by designing a replication method that partitions application resources across two replicas, ensuring that most operations require only local ordering, reserving inter-replica communication for scenarios where resources are limited.We implemented our approach using the Axon Framework and evaluated its performance against MongoDB Replica Sets, where writes go through the primary replica, achieving a significant improvement in the speed of local write operations.
Rodrigo Nogueira – “Statistical Process Control for Supporting OS-level Failure Prediction” Bio Currently pursuing a Master’s degree in Data Engineering and Science after completing a Bachelor’s degree in the same field from 2020 to 2023 (both in the University of Coimbra). Besides that, I’ve been involved in research at CISUC – SSE since I was still in my Bachelor’s, focusing on the intersection of artificial intelligence with dependability and software engineering. Abstract In today’s society, software is relied upon to perform many critical tasks, where failures can result in substantial losses or even the loss of lives. Online Failure Prediction (OFP) aims to predict upcoming failures, enabling preemptive measures to be taken and mitigating potential hazards, by continuously analyzing the system’s current state, based on the assumption that symptoms, such as system misbehavior, precede failures. However, accurately characterizing a complex system’s (mis)behavior remains a challenge. A key question arises: How can we ensure that failure predictors are capturing genuine symptoms rather than simply identifying correlations in the data? This study explores the use of Statistical Process Control (SPC) as a potential tool for characterizing the stability and instability of the Linux and Windows Operating Systems. Through this approach, we aim to determine whether SPC methods can reliably indicate underlying issues that may signal potential failure. We analyze and compare various SPC techniques to evaluate their effectiveness in detecting software failures, focusing particularly on their robustness in identifying true signs of instability while minimizing false positives. Results indicate that these techniques are generally effective, successfully detecting the majority of failures with a minimal occurrence of false positives.
