## 4 Results and Discussion
### Rq1  
The first evaluation addressed the effectiveness of detecting sensitive services. The results of GPT-4 and GPT-3.5 are shown in Table 6 for the sensitive element detection step. From the results, it is clear that although GPT-3.5 marked significantly more data as sensitive in the source codes tested, it did so incorrectly in many more cases compared to GPT-4. Incorrect detections count cases where the detection was incorrect. For instance, a function or the service itself might be mistakenly marked as sensitive data instead of a variable or object. Duplicate detection counts instances where the same sensitive data were marked multiple times within the same file. Insufficient detection counts situations where the sensitive data were correctly identified, but the justification for its sensitivity was either incomplete or incorrect. Next, the services that served as the source or target for the sensitive data and objects were identified. The results can be seen in Table 7, and although GPT-4 was clearly more efficient here, it made a significant number of errors in consistently detecting sensitive services. In the table, undetected sensitive services is the number of services that, although using sensitive data, were not detected; incorrect sensitivity levels is the number of services that were not assigned a correct sensitivity level even once; and missing information is the number of services that were detected for which some key information, such as the exact name of the service, was not detected but its presence was; while the insufficient detection count is the number of services that were successfully detected but not as many times as they occurred in the components of the application. Here, detected services and undetected services refer to those services interacting with sensitive data that have been correctly or incorrectly detected by the model. Incorrect sensitivity levels denote cases where a service has a data member with an incorrect sensitivity level (this does not include cases where a service may have multiple data members with different sensitivity levels mixed together, as this level of lack of isolation was not anticipated in our original naive assumption). The insufficient detection count is similar; it counts cases where a service has been previously marked as having sensitive data, but for some reason, \begin{table}
\begin{tabular}{c c c} \hline \hline  & **GPT-4** & **GPT-3.5** \\ \hline Number of sensitive & 363 & 375 \\ data elements & 7 & 128 \\ Incorrect detection & 25 & 23 \\ Insufficient detection & 0 & 29 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Results of sensitive data detection by the two GPT models. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **GPT-4** & **GPT-3.5** \\ \hline Detected Sensitive Services & 37 & 28 \\ Undetected Sensitive Services & 17 & 26 \\ Incorrect Sensitivity Levels & 2 & 17 \\ Insufficient Detection Count & 23 & 24 \\ Missing Information & 3 & 5 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Results of sensitive service identification by the two GPT models. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Step**} & **Average Runtime** & **Average Runtime** \\  & **with GPT-4** & **with GPT-3.5** \\ \hline Sensitivity Element Detection & 216.846 s & 194.266 s \\ JSON Mapping of Project Files & 217.334 s & 163.882 s \\ Protection Level Discovery & 247.904 s & 140.559 s \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Average response times for the various prompts from the GPT-4 and GPT-3.5 APIs. when a new occurrence occurs, it no longer does. Finally, insufficient information indicates detections where some critical information, such as the data member or service name, has not been detected or has been detected incorrectly. A prevalent error observed during our analysis was the violation of the SOLID principle [47], as defined by [PERSON].