Domenico Cotroneo Professor · Software Reliability & Security
Domenico Cotroneo

Dependable & Secure Software Systems

Professor of Computer Science and Graduate Program Director, MS in Computer Science
College of Computing and Informatics, University of North Carolina at Charlotte

My goal is to build software systems that stay secure, reliable and trustworthy, including when parts of them are written or operated by AI. I study how software fails, how it degrades over time, and how it can be attacked, and I turn these findings into methods that can be used on real systems.

Software Security for Critical Infrastructures Software Fault Injection & Failure Analysis Software Aging and Rejuvenation AI for Software Dependability Trustworthy AI Code Generation Resiliency of Cloud & HPC Systems
Google Scholar DBLP Email

Short Bio

Before joining UNC Charlotte in 2025, I was a Full Professor at the University of Naples Federico II, where I also chaired the Bachelor and Master programs in Computer Engineering. I am an IEEE Senior Member and a member of IFIP WG 10.4 on Dependable Computing and Fault Tolerance. I chaired the IEEE Technical Community on Dependable Computing and Fault Tolerance and the DSN Steering Committee, and I currently serve on the Steering Committees of DSN and ISSRE.

I am an Associate Editor of IEEE Transactions on Reliability. Over more than two decades I have supervised 19 PhD students and co-authored 200+ papers. My ISSRE 2010 paper on software aging in Linux was named one of the Most Influential Papers of ISSRE (1990 to 2019).

Interested in research?
I am always happy to hear from motivated students, undergraduate or graduate, who want to work on dependability, security, and AI-driven software engineering.

News

Research Interests

Software Security for Critical Infrastructures

I work on the security of software running in critical environments: industrial control systems, OT networks, and cyber-physical infrastructures, including settings where AI is part of the defense. One idea I helped shape is "Do No Harm" security: a defensive action must be formally verified before it can touch a real-time process. I have also shown that hardware-enforced isolation via Virtual Machine Introspection keeps these mechanisms intact even when the kernel is compromised.

OT / ICS security "Do No Harm" security Adversary emulation VMI

Software Fault Injection & Failure Analysis

I study how to test the dependability of a system against realistic software defects. My work on fault representativeness proposed a method that is statistically sound and simple enough to be used in industry, and led to the SAFE fault injection tool. I also work on log analysis, looking for the patterns and root causes of failures in production systems, and more recently on using LLMs to generate realistic faults.

Fault injection Failure analysis Fuzzing

Software Aging and Rejuvenation

I look at how resources slowly degrade in long-running software. My paper "Software aging analysis of the Linux operating system" was among the first to measure aging in an operating system, showing that it is driven not only by heavy use but also by background activity. I have since studied aging in Android, cloud platforms, and AI serving systems.

Software aging Rejuvenation Performance degradation

AI for Software Dependability

I use machine learning to make dependability assessment and monitoring more data-driven: anomaly detection and failure prediction in large distributed systems, and vulnerability detection with static analysis and learned models. The aim is to find error patterns that rule-based approaches tend to miss, and to check when these tools can actually be trusted.

Vulnerability detection Failure prediction

Trustworthy AI Code Generation

I study the reliability and security of code produced by Large Language Models. We measure how often generated code carries vulnerabilities or quality issues, how training data quality and poisoning affect what models produce, and how to detect and repair insecure code, so that AI-assisted development can meet real industrial standards.

Code quality Data poisoning Secure code generation

Resiliency of Cloud & HPC Systems

I work on resiliency in very large distributed environments: diagnosing complex failure patterns in Cloud, NFV, and HPC systems, understanding how errors propagate across nodes, and validating resiliency strategies through data-driven analysis and stress testing.

Cloud reliability Overload control Dependability benchmarks

Current Projects

U.S. Department of Energy · 2026

Genesis Mission: Transforming Science and Energy with AI

A UNC Charlotte project in collaboration with Oak Ridge National Laboratory on securing agentic AI in scientific computing environments. I am Key Personnel and co-lead Task 3, the security layer, with Meera Sridhar: threat modeling and adversarial testing of AI-generated code.

PI: S. Schuckers Award DE-SC0026724
CCI Faculty Research Grant · 2026

Redlyne: A Real-Time Security Engine for AI-Generated Code

A tool that inspects code produced by AI assistants as it is generated, flags likely vulnerabilities, and supports empirical studies on how different LLMs compare in security.

Role: PI
Before UNC Charlotte

European, national and industrial projects

I led research units in several EU projects (CECRIS, DESTRIERO, SECTOR, OSMOSIS, CRITICAL STEP) and industrial projects with Huawei, Leonardo/Finmeccanica, and others on cloud reliability, NFV overload control, Android robustness, and fault injection. I also co-founded three spin-off companies in cloud platforms, software safety assessment, and cybersecurity.

Publications

I have co-authored more than 200 publications on software reliability engineering and dependable and secure computing. A selection is listed below; the full list is on Google Scholar and DBLP.

200+ Publications
67 Journal papers
19 PhD students
DSN · ISSRE Steering committees
Google Scholar → DBLP →

2026

  1. SereBench: Adversarial Robustness Benchmarking for Security and Reliability Event Classification in Networked Railway Cyber-Physical Systems A. Rizzardi, R. Della Corte, J. F. Cevallos-Moreno, S. De Vivo, S. Sicari, D. Cotroneo, A. Coen-Porisini Computer Networks, vol. 290, 2026
  2. Reading Between the Lines: Context-Aware AI-Based Generation of Software Exploits C. Improta, P. Liguori, R. Natella, B. Cukic, D. Cotroneo Empirical Software Engineering, vol. 31, 2026
  3. SereWay: Toward SEcurity and REliability Benchmarking for the RailWAY IIoT A. Rizzardi, R. Della Corte, J. F. Cevallos-Moreno, S. De Vivo, S. Sicari, D. Cotroneo, A. Coen-Porisini Journal of Network and Systems Management, vol. 34, 2026
  4. Machine Learning for Software Aging Detection: A Systematic Mapping Study R. J. Moura, M. G. Nascimento, F. Machida, D. Cotroneo, E. Andrade Journal of Systems and Software, vol. 234, 2026

2025

  1. Aging-Related Bug Prediction Based on Multi-View Graph Feature Learning and Graph-Transformer C. Zhang, J. Xiang, R. Hao, K. Jia, J. Tian, R. Natella, R. Pietrantuono, D. Cotroneo IEEE Transactions on Software Engineering, 2025
  2. COSMOS: A Fault Injection Framework to Assess Hardware-Assisted Hypervisors M. Cinque, D. Cotroneo, G. De Rosa, L. De Simone, G. Farina IEEE Transactions on Dependable and Secure Computing, 2025
  3. Quality In, Quality Out: Investigating Training Data's Role in AI Code Generation C. Improta, R. Tufano, P. Liguori, D. Cotroneo, G. Bavota IEEE/ACM International Conference on Program Comprehension (ICPC), 2025

Selected earlier work

  1. How Bad Can a Bug Get? An Empirical Analysis of Software Failures in the OpenStack Cloud Computing Platform D. Cotroneo, L. De Simone, P. Liguori, R. Natella, N. Bidokhti ESEC/FSE 2019 Reusable badge
  2. Assessing Dependability with Software Fault Injection: A Survey R. Natella, D. Cotroneo, H. S. Madeira ACM Computing Surveys, vol. 48(3), 2016
  3. On Fault Representativeness of Software Fault Injection R. Natella, D. Cotroneo, J. A. Duraes, H. S. Madeira IEEE Transactions on Software Engineering, vol. 39(1), 2013
  4. Software Aging Analysis of the Linux Operating System D. Cotroneo, R. Natella, R. Pietrantuono, S. Russo IEEE International Symposium on Software Reliability Engineering (ISSRE), 2010 Most Influential Paper, ISSRE 1990 to 2019

Students

Current PhD Students

  • Roberto Vallefuoco (UNC Charlotte): security of agentic AI systems
  • Initha Annamalai Sharavanan (UNC Charlotte): automated vulnerability repair
  • Roberta De Luca (Univ. of Naples): vulnerability detection in AI-generated code
  • Giuseppe De Rosa (IMT Lucca): neural software fault injection
  • Francesco Altiero (Univ. of Naples): software security in OT scenarios
  • Francesco Crescenzo Grasso (Univ. of Naples)

Selected Past PhD Students

  • Marcello Cinque: Professor, University of Naples
  • Catello Di Martino: General Manager, Nokia Bell Labs
  • Roberto Natella: Professor, GSSI
  • Antonio Ken Iannillo: Associate Professor, University of Luxembourg
  • Luigi De Simone: Associate Professor, University of Naples
  • Pietro Liguori: Assistant Professor, University of Naples
  • Vittorio Orbinato: Assistant Professor, University of Naples

Former students also hold leadership roles at Hitachi Rail, Magneti Marelli and other companies.

Undergraduate & Master's Researchers

  • Deva Pradeep Kumar Nallipogu (OUR Scholar, B.S.): benchmarking vulnerability detectors on AI-generated code
  • Emmanuel Onamade (B.S.): comparing the security of code generated by different LLMs with Redlyne
  • Ben Dodson (Honors thesis, B.S.): resiliency of agentic AI systems through fault injection
  • Devin Sehgal (Research assistant, B.S.): AI-based security pipelines on HPC, DOE Genesis Mission
  • Oliver Powell (B.S.): quality of AI-generated code in open-source software
  • Arham Hussain Inamdar (M.S.): abliterated language models for CodeQL-based vulnerability detection

Want to join? I welcome motivated undergraduate, master's and PhD students interested in dependability, security, and AI-driven software engineering. Email me a short note on your background and what you would like to work on.

Teaching

Current Courses (UNC Charlotte)

  • Introduction to Data Mining (ITCS 3162): data exploration, preprocessing, clustering, classification, and model evaluation.
  • Software Design and Implementation (ITCS 6112): design patterns and architectures, testing, secure coding, and the use of LLMs in software development.
  • Penetration Testing and Secure Programming (ITIS 4221/5221), Spring 2027: vulnerability discovery, penetration testing methodology, exploitation of common weaknesses, and secure coding.

Past Courses (University of Naples Federico II)

  • Operating Systems (2004 to 2021)
  • Large-Scale Computing Infrastructures
  • Software Security for Industrial Systems
  • Security and Dependability of Computer Systems
  • Computer Architecture

For Students

Do difficult things. It's the only way to grow. Anyone can do what's easy. The difficult things are the ones that challenge you, that reveal who you truly are. Don't be afraid: jump in, make mistakes, get back up. Beauty in life is hidden inside the difficult things.

Roberto Benigni

Service & Recognition

Community

  • Steering Committee, IEEE/IFIP DSN (Chair 2023 to 2025) and IEEE ISSRE
  • Chair, IEEE Technical Community on Dependable Computing and Fault Tolerance (2024 to 2025)
  • Program Co-Chair, ISSRE 2026; Financial Chair, DSN 2026
  • General Co-Chair, DSN 2025; General Chair, ISSRE 2014

Editorial

  • Associate Editor, IEEE Transactions on Reliability (since 2026)
  • Associate Editor, Journal of Reliable Intelligent Environments, Springer
  • Guest Editor, IEEE TDSC special issue on Data-Driven Dependability & Security

Awards

  • Best Reviewer Award, SRDS 2026
  • Most Influential Paper, ISSRE 1990 to 2019
  • Best Research Paper Award, ISSRE 2017
  • Best Conference Paper Award, IEEE NetSoft 2015
  • Best Paper Award, DEPEND 2012

Contact

Email
d.cotroneo AT charlotte dot edu
Office
Woodward Hall 205D
Phone: (704) 687-1912
Department of Computer Science
College of Computing and Informatics
University of North Carolina at Charlotte
Profiles
Google Scholar
DBLP