Machine Learning in Software Engineering: Tools and Limits

What is machine learning in software engineering?

Machine learning in software engineering is the use of models that learn from code, logs, and user data to write, test, debug, and maintain software. Teams apply classifiers, neural nets, and reinforcement learners so products can predict failures, suggest code, and adapt features instead of waiting for a person to inspect every case by hand.

That definition sounds tidy. The work is not. Software teams sit on huge piles of data: repositories, crash reports, click streams, build logs. Most of that data is messy. Some of it is labeled. A lot of it is not. Deepa Iyer, writing from the International Institute of Information Technology in Bangalore, treats that mix as the reason machine learning moved from a research side quest into ordinary engineering. Her December 2021 review in the International Research Journal of Innovations in Engineering and Technology is a map of algorithms, libraries, and the problems that keep showing up after the demo.

You can read the same research article as a catalog of tools. Scikit-learn for classic models. TensorFlow for deep networks. Stable-Baselines3 for reinforcement learning. Graph Neural Networks for data that looks like a web of nodes, not a spreadsheet. The more useful reading is the one that asks a harder question: which of these tools will still be maintainable in year two, when the labels drift and someone has to explain a bad prediction.

"A library can train a model in twenty lines. Shipping the model still means cleaning data, picking a metric, and naming who owns a wrong answer."

This piece walks through Iyer’s review in plain language. You will see what machine learning is doing inside software work, why graph models keep appearing, how the three libraries differ, and why data quality, interpretability, and scale still decide whether a project ships. If you write code, run a product, or just want a clearer picture of the tooling, this is a practical tour rather than a hype reel.

Why are engineering teams putting models in the build?

Teams put models in the build because software now produces more traces than people can inspect. Code, tickets, and logs hold patterns that a trained model can rank faster than a review meeting. The payoff is earlier bug detection, fewer surprise outages, and features that adapt to a user instead of shipping the same default to everyone.

Iyer groups the impact into four jobs. First, automated code generation and optimization. Models trained on existing repositories suggest completions, write boilerplate, and point at slow paths. Second, predictive maintenance. Historical failure data can flag a component before it takes the system down. Third, debugging that ranks bugs by likely impact instead of treating every ticket as equal. Fourth, user experience: personalization that changes what a product shows based on behavior, not a one-size-fits-all screen.

None of those jobs is magic. They are pattern matching with a feedback loop. A model that suggests a function still needs a reviewer. A model that predicts failure still needs a runbook. The review is honest about the shift in posture. Software engineering used to be mostly reactive: wait for the bug, then fix it. Machine learning pushes the work earlier. That only helps if the training data matches the world the product will meet after launch.

The same methods show up outside software, which is part of why they travel so easily. Finance uses them for forecasts. Healthcare uses them for diagnosis support. Iyer’s point is not that software should copy those fields blindly. It is that the hunger is the same: large datasets, weak hand-written rules, and a need to act before a person can finish the spreadsheet.

How do the basic algorithms actually split the work?

The basic algorithms split the work by the shape of the answer you need. Classification assigns a label. Regression predicts a number. Clustering groups similar items with no labels. Association rules find items that appear together. Feature engineering builds better inputs so those models have something useful to chew on.

If you have ever filed a ticket as “spam or not,” you already know classification. Decision trees, support vector machines, and k-nearest neighbors are the names Iyer lists. They still do a lot of daily work: routing a crash, tagging a review, spotting a known defect class. Regression is the cousin that outputs a continuous value, useful for forecasts and risk scores. Linear and polynomial regression remain the starting point for a reason. They are inspectable. You can argue with the coefficients.

Clustering is the unsupervised lane. k-means and hierarchical clustering group similar modules, users, or incidents when nobody labeled the set in advance. Association rules, with Apriori and Eclat as the usual examples, look for co-occurrence. Market-basket analysis is the textbook case. In software, the same idea can surface APIs that fail together or features that users always touch as a pair.

Reinforcement learning is the odd one out, and Iyer gives it space on purpose. Q-learning, Deep Q-Networks, and policy gradient methods learn by trial and error. That is a poor fit for a static classifier. It is a good fit for control problems, games, and any setting where the right action depends on a changing environment. Neural networks, especially convolutional nets for images and recurrent nets for sequences, sit in the middle. They are still “just” function approximators. They happen to be good at signals that do not look like tidy tables.

Feature engineering is the unglamorous multiplier. Normalization, binning, and polynomial features sound like homework. They often move accuracy more than swapping the model. Iyer treats that as part of the method, not a footnote. If your logs are on different scales, or your timestamps are garbage, no library will save you.

How do Graph Neural Networks handle software-shaped data?

Graph Neural Networks handle software-shaped data by treating entities as nodes and relations as edges. Call graphs, package dependencies, social graphs, and city traffic all look like that. Instead of flattening the structure into a table, a GNN passes messages along the edges so each node can learn from its neighbors.

Iyer’s taxonomy is useful because “GNN” is not one architecture. Recurrent GNNs apply recurrent-net ideas so information can walk the graph over several steps. That helps when the graph itself changes over time. Convolutional GNNs, including Graph Convolutional Networks, borrow the convolution trick from image models and apply it to neighborhoods of nodes. Graph autoencoders learn a compact embedding of a node, which is handy for link prediction and clustering. Spatial-temporal GNNs add time, which is why they show up in traffic forecasts and motion analysis.

The applications in the review are not all software products, and that is fine. Community detection in social networks, molecular property prediction in chemistry, and recommendation systems all stress-test the same idea: the interesting signal lives in the connections. Software has plenty of those connections. A module that looks innocent in isolation can be high risk because of what it talks to. A service that is healthy on its own can still sit on a brittle path.

Assessment is the part teams skip. Node classification, link prediction, and graph classification each need their own score. Accuracy, precision, recall, and F1 are the metrics Iyer names. They are not interchangeable. If you are hunting rare defects, accuracy can look great while you miss the cases that matter. A graph model that cannot beat a simpler baseline on a hold-out set is a research toy, not a production tool.

Which library should you pick: Scikit-learn, TensorFlow, or Stable-Baselines3?

Pick the library that matches the job, not the one with the loudest demos. Scikit-learn fits classic models on medium tables. TensorFlow fits deep networks and large-scale training. Stable-Baselines3 fits reinforcement learning with a consistent interface. Mixing them is common. Pretending one stack does every job is how projects stall.

Scikit-learn is the workhorse. Iyer highlights the range: classification, regression, clustering, dimensionality reduction, model selection, preprocessing. The API is consistent enough that fit and predict feel the same across algorithms. Documentation and community examples are dense. Pedregosa and colleagues showed that its SVM and k-nearest neighbor implementations compete well on datasets such as Madelon and digits. That is the point of the library. Fast experiments. Predictable interfaces. Enough tests that a model behaves the same next month.

TensorFlow, from Google, is a different animal. Computation is a dataflow graph: operations are nodes, tensors flow on edges. That design supports distributed training across CPUs, GPUs, and TPUs, plus some fault tolerance when hardware flakes. The ecosystem includes TensorFlow Extended for production pipelines and TensorFlow Lite for phones and IoT devices. Abadi and colleagues reported strong image-classification results on CIFAR-10 and ImageNet. Later work in the review points at language tasks such as the Penn Treebank, Wikipedia-scale text, and GLUE. If your model is a convolutional net or a transformer, this is usually the lane.

Stable-Baselines3 sits on PyTorch and aims at reliable reinforcement learning. A2C, PPO, DDPG, SAC, and TD3 ship with benchmarks against standard environments. Raffin and colleagues (2021) compared SAC, PPO, and DDPG on Pendulum-v0 and HalfCheetah-v2 and found the library matched or beat earlier implementations, with more stable repeats. Iyer also notes the testing culture: about 95 percent of the code covered by automated tests. That matters more than a leaderboard screenshot. Reinforcement learning is famous for “it worked on my seed.” Reproducible baselines are the product.

Iyer includes short code sketches: linear regression in Scikit-learn, a small convolutional net in Keras on TensorFlow, and a Soft Actor-Critic agent in Stable-Baselines3 on Pendulum-v0. The sketches are teaching devices, not production recipes. The lesson is the same in all three. The library reduces ceremony. It does not choose your metric, your split, or your failure mode.

How do the benchmarks compare on accuracy and training time?

The review compares families, not a single winner. A linear model trains fastest and scores lower. Forests and neural nets score higher and take longer. Read the chart as a tradeoff. Extra accuracy is worthless if the job needs an inspectable score tonight, not a long GPU run tomorrow.

Read that chart as a tradeoff, not a league table. A neural net that gains a few points of accuracy and doubles training time may be the wrong call for a nightly batch that has to finish before standup. A linear model that you can explain to a product owner may be the right call even if a forest scores higher. Iyer’s evaluation section keeps repeating that idea through three lenses: accuracy, reliability, and task fit.

For Scikit-learn, accuracy is often reported on UCI-style sets. Logistic regression and SVMs do well on binary tasks such as breast cancer and diabetes classification. Reliability comes from unit tests and a stable API. For TensorFlow, the headline numbers sit on ImageNet, language understanding suites such as GLUE, and large text collections. Reliability is framed as testing, documentation, and continuous integration so model versions do not silently drift. For Stable-Baselines3, “accuracy” is cumulative reward and convergence on control tasks, plus those automated tests covering most of the codebase.

Task comparisons in the review follow the same split. Image classification favors TensorFlow and convolutional nets, including ResNet-style work on ImageNet. Language modeling favors the same stack when the dataset is large. Reinforcement learning favors Stable-Baselines3, with SAC doing well in continuous action spaces. If you take one practical rule from the numbers, take this: measure the thing you care about on data that looks like production. A CIFAR-10 win does not prove your log classifier.

Why does data quality still decide whether the model ships?

Data quality still decides whether the model ships because a learner copies the dataset, including the holes. Missing values, noise, and inconsistent labels cut accuracy faster than a weak architecture. If logs are incomplete or tickets are tagged at random, the model will look confident and still be wrong in the places that hurt users.

Iyer lists preprocessing and augmentation as the first line of defense. That is unglamorous work: filling gaps, fixing types, balancing rare classes, generating extra examples when the rare class is the one you care about. Teams that skip it often blame the algorithm. The review is clearer. The algorithm is downstream of the table.

Interpretability is the second stall. As models get deeper, “why did it say that?” gets harder. In healthcare and cybersecurity, that is not a style preference. It is a trust requirement. Iyer calls for models and visualization tools that can explain a prediction. Without that, a high score on a test set is not enough. A clinician, a security analyst, or a staff engineer has to be able to challenge the output.

Scale is the third. A notebook that trains on a laptop can choke on production volume or a real-time budget. Distributed training, which TensorFlow is built to support, is one answer. More efficient algorithms are another. Hybrid and ensemble methods are the review’s fourth research direction: mix classic models with deep nets or reinforcement learners, or combine several predictors so a single brittle model is not the whole system.

If you run a team, those four items are a checklist you can put on a wall. Clean the data. Explain the decision. Budget for scale. Mix methods when one family is a poor fit. None of that requires a new paper. All of it is easier to ignore than a new architecture announcement.

Where does this work go next in the real world?

The review’s next-stop list is cybersecurity, healthcare, smart cities, and the Internet of Things. Those domains already generate the kind of data machine learning likes: high volume, repeating patterns, costly misses. They also raise the stakes. A wrong traffic prediction wastes time. A missed medical pattern or a missed intrusion wastes more than that.

In cybersecurity, the pitch is anomaly detection and predictive modeling. Unusual traffic or unusual process behavior can be a signal if the baseline is honest. In smart cities, spatial-temporal GNNs can forecast traffic and suggest routes, with energy use and public services as related targets. In healthcare, the examples are disease prediction, personalized plans, and medical image analysis, drawing on work that uses language and vision models on clinical data. In IoT, sensor streams feed predictive maintenance so a failing motor or a failing gateway is caught before downtime piles up.

Notice the pattern. Each application still needs the boring layer from the last section. City sensors go offline. Hospital labels are incomplete. IoT firmware versions drift. Anomaly detectors fire on holidays. The review ends by asking researchers, practitioners, and policymakers to keep the ethics and the scale in view. That is not a slogan if you have ever had to pull a model after it treated one group of users worse than another.

You can treat Iyer’s 2021 snapshot as dated in the details and still current in the structure. Libraries have moved. Large language models now sit next to the tools she named. The split between classic ML, deep nets, and reinforcement learning has not vanished. Neither has the need to pick a stack you can hire for, monitor, and retire.

What should you take from Iyer’s review into a project?

Take a working order, not a shopping list. Name the job first, pick the library that already does it, then spend the calendar on data and the failure path. Iyer’s algorithms are familiar on purpose. The contribution is the map of how they sit inside ordinary software work.

The same research article is still worth keeping nearby if you hire, plan a platform, or argue about whether “we should do ML” is a strategy. It is not a strategy. It is a family of methods with libraries, failure modes, and a few domains where the payoff is already visible. Iyer’s closing research agenda is modest in a useful way: better data, clearer models, hybrid methods, and applications that can survive contact with hospitals, cities, devices, and attackers. That is a better north star than a new acronym.

If you remember one sentence, remember this. Machine learning can make software engineering more proactive. It cannot make sloppy data, unexplained scores, or an unowned failure path into a good product. The tools are ready enough. The operating system around them is still the hard part.

FAQ

These answers restate the paper in ordinary language so you can use them without rereading the whole review. Each one is meant to stand alone if it shows up in a search snippet. If you only have two minutes, start with the library choice and the data-quality failure mode.

Related articles

If you want a wider view of machine learning outside one engineering stack, the pieces below sit next to this review. One looks across physics and medicine. Two stay inside software engineering and cover modeling techniques and defect work. Read them as neighbors, not as required homework.

• Machine learning uses beyond the lab, from physics to medicine
• AI-based modeling techniques for software engineering teams
• How AI is applied to defects, testing, and software-defined networks