Marcelo D'Amorim
Bio
My research interests are in Software Engineering and Programming Languages, with a focus on improving software reliability through program analysis and systematic testing. Software bugs are expensive and inevitable as software is mostly written by humans or automatically synthesized via ML. My research focuses at developing practical methods to prevent, detect, and fix bugs in code. As part of my research, I develop tools to automate software testing and debugging activities.
Education
Ph.D. University of Illinois Urbana-Champaign 2007
M.S. Universidade Federal de Pernambuco 2001
B.A. Universidade Federal de Pernambuco 1996
Area(s) of Expertise
Artificial Intelligence and Intelligent Agents
Software Engineering and Programming Languages
Publications
- Configuration Defects in Kubernetes , IEEE Transactions on Software Engineering (2026)
- XMutant: XAI-based fuzzing for deep learning systems , Empirical Software Engineering (2026)
- Agentic LMs: Hunting Down Test Smells , IEEE Software (2025)
- BugsInDLLs : A Database of Reproducible Bugs in Deep Learning Libraries to Enable Systematic Evaluation of Testing Techniques , (2025)
- Challenges to Using Large Language Models in Code Generation and Repair , IEEE Security & Privacy (2025)
- Faster Explicit-Trace Monitoring-Oriented Programming for Runtime Verification of Software Tests , Proceedings of the ACM on Programming Languages (2025)
- Test Oracle Automation in the Era of LLMs , ACM Transactions on Software Engineering and Methodology (2025)
- A Case Study of LLM for Automated Vulnerability Repair: Assessing Impact of Reasoning and Patch Validation Feedback , PROCEEDINGS OF THE 1ST ACM INTERNATIONAL CONFERENCE ON AI-POWERED SOFTWARE, AIWARE 2024 (2024)
- ChatAssert: LLM-Based Test Oracle Generation With External Tools Assistance , IEEE Transactions on Software Engineering (2024)
- Feedback-Directed Partial Execution , PROCEEDINGS OF THE 33RD ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON SOFTWARE TESTING AND ANALYSIS, ISSTA 2024 (2024)
Grants
Configuration scripts are used to manage system configurations and provision infrastructure at scale. Configuration scripts are susceptible of including security weaknesses such as hard-coded passwords, which can facilitate large-scale data breaches, as well as provisioned systems being compromised. We propose an automated technique to identify security weaknesses so that configuration scripts do not cause large-scale security attacks and data breaches. We will build upon our recent research and construct eSLIC, which will overcome previous limitations of our initial prototype and facilitate wide-spread security static analysis of infrastructure. We will make eSLIC available for OSS and practitioners in industry.