Code Analysis Research Articles

A Semiotic Analysis of Diary of a Wimpy Kid Movie Posters

This research is a descriptive qualitative research on semiotic field. The subiect of this research is a poster series of Diary of a Wimpy Kid, a movie adaptation of the same title semi-animated children book by Jeff Kinney. The data consists of a teaser poster and a theatrical poster of the movie film derived from Cinemags Movie Magazine and 20th Century Fox. This research aims to analyze semiotic signs from both posters by identifying icon, index, symbol, code, language, and myth following Saussure's, Peirce's, Danesi's, and Barthe's theories on Semotics. The result of the analysis presented 8 semiotic signs (4 on each poster) with the detailed analysis of signs, icon, index, symbol, code, and myth on each signs.

СТЕГАНОГРАФИЧЕСКОЕ ВСТРАИВАНИЕ ИНФОРМАЦИИ В SVG-ИЗОБРАЖЕНИЯ НА ВЕБ-СТРАНИЦЕ

This study suggests a steganographic algorithm for embedding data in SVG images integrated into html code. The algorithm uses a composite key that includes an embed key, an encryption key, and a replacement table. The basic principle of embedding is to add style classes to an SVG image. These classes do not affect the picture in the browser. The message is encoded as the names of the classes to be added. Class names are formed based on a symmetric encryption algorithm and a replacement table. One class name contains 9 bits of information. A style set is generated for each added class. The new styles do not affect the appearance of the picture. Style settings are defined either based on default values or based on existing classes. Embed labels are added to tags with embedded data. The labels are calculated based on the hash functions from the string from the embedding key and the block number. Embedded data is randomly distributed over the code of an html page with SVG images. This arrangement makes it difficult to analyze the page when hacking the system. Embedded information is detected by sequential analysis of page code and search for embed marks. The sender of the message must have a permission to edit the web page. The recipient retrieves the message in page code view. An analysis of possible attacks on the proposed system has been carried out. Hacking of the system is possible only by direct overhauling. The system is resilient with the correct choice of hash function and encryption algorithm. The proposed steganographic embedding method is effective for html pages containing a fairly large number of SVG images.

The Spanish-Moorish Mudekhar code in the Crimean cultural landscape

The subject of the study is the Spanish-Moorish Mudekhar code in the cultural landscape of the Crimea. The object of the study is the Spanish-Moorish stylistics in the decor of the architecture of the Crimea. The following methods are used in the work: culturological (ontological and semiotic) analysis in determining stylistic elements, the method of analysis of previous studies, the method of synthesis in identifying stylistic features of the Crimean architecture of the Modern period. The article reveals the following aspects of the topic: the features of the Spanish-Moorish Mudejar style and its application in the architecture of the Crimea of the Art Nouveau period, as well as the reasons for the popularization of this code in the cultural landscape of the Crimea are identified. The main conclusions of the study are: 1. The multiethnic Crimean cultural landscape is represented by the cultures of ethnic groups that inhabited the Crimea from ancient times to the present day. The main factor in the identification and self-identification of ethnic groups is religious affiliation, reflected in folk traditions. Folk art is the most characteristic example of the manifestation of ethnic identity. 2. The spread of the Spanish-Moorish Mudekhar style in Crimean architecture is not accidental, since the synthesis of eastern and Western features is organic for Crimea, which has been lying on the way "from the Varangians to the Greeks" since ancient times, at the intersection of trade routes from Europe to Asia. The Moorish style has become part of both the geographical and cultural landscape of the Crimea, organically entering the architecture of summer palaces and mansions. 3. A special contribution of the authors to the development of the topic is the identification and justification of the Mudekhar code as one of the most popular in the Crimean Art Nouveau style. The scientific novelty of the research consists in the identification and stylistic analysis of the Mudekhar code in the Crimean cultural landscape.

Static Analysis of JNI Programs via Binary Decompilation

JNI programs are widely used thanks to the combined benefits of C and Java programs. However, because understanding the interaction behaviors between two different programming languages is challenging, JNI program development is difficult to get right and vulnerable to security attacks. Thus, researchers have proposed static analysis of JNI program source code to detect bugs and security vulnerabilities in JNI programs. Unfortunately, such source code analysis is not applicable to compiled JNI programs that are not open-sourced or open-source JNI programs containing third-party binary libraries. While JN-SAF, the state-of-the-art analyzer for compiled JNI programs, can analyze binary code, it has several limitations due to its symbolic execution and summary-based bottom-up analysis. In this paper, we propose a novel approach to statically analyze compiled JNI programs without their source code using binary decompilation. Unlike JN-SAF that analyzes binaries directly, our approach decompiles binaries and analyzes JNI programs with the decompiled binaries using an existing JNI program analyzer for source code. To decompile binaries to compilable C source code with precise JNI-interoperation-related types, we improve an existing decompilation tool by leveraging the characteristics of JNI programs. Our evaluation shows that the approach is precise as almost the same as the state-of-the-art JNI program analyzer for source code, and more precise than JN-SAF.

Fire Resistance Analysis of Two-Way Reinforced Concrete Slabs

This paper presents a fire resistance analysis of two-way reinforced concrete (RC) slabs. The study analyzes the effect of specific parameters—concrete cover thickness, span, and support conditions—on the fire resistance of the slabs. To that end, the slabs were exposed to Standard Fire ISO 834, and the 3D nonlinear numerical analyses were conducted in SAFIR2016. The results of the numerical analyses were evaluated against experimental results reported in the literature. The agreement between the two sets of results was satisfactory throughout the fire test. Nonetheless, to verify the obtained numerical results, all testing-related parameters must comply with the numerical simulation results. This comparison demonstrated the usefulness of numerical simulations in predicting the behavior of structures in fire conditions. In addition to the nonlinear numerical analysis, the fire resistance was calculated using the simplified method and tabulated data described in Eurocode 2 (Part 1.2) to assess the accuracy and reliability of fire safety regulations in the design of two-way slabs and identify significant differences between the design code and numerical analysis. The comparison showed that SAFIR2016 provides more accurate results by considering additional factors, such as tensile membrane forces, which increase the fire resistance of two-way slabs. According to the load-bearing criteria, the two-way slabs have high fire resistance, considerably higher than prescribed in the fire safety regulations, which ignore the positive effect of tensile membrane forces. According to the numerical analysis, the upper reinforcement in the compression areas of the slab's span was considered, which increased the fire resistance of the slabs. In contrast, according to the design codes, the contribution of this reinforcement is neglected. It was indicated that the increased concrete cover improves the fire resistance of the slabs. The vertical displacements increase by increasing the slab span, but according to the load-bearing criteria, all the slabs show fire resistance of over ten hours. In terms of bearing capacity, slabs with various support conditions show fire resistance of longer than ten hours. In terms of deflections, the supporting conditions of the slabs have a significant influence on their behavior. This study provides valuable insights into the fire resistance of two-way RC slabs and highlights the importance of considering specific parameters in the analysis. Doi: 10.28991/CEJ-2023-09-05-05 Full Text: PDF

Thermal-hydraulic measurements and TRACE system code analysis performed on the natural circulation cooled BME Training Reactor

This paper presents a validation exercise for a natural circulation cooled, light-water moderated and cooled pool-type reactor system. Measurements were performed in the 100 kW Training Reactor of the Budapest University of Technology and Economics, which facility can be easily instrumented for neutronic and thermal-hydraulic experiments. During the performed transients, the reactor was cooled solely by natural circulation and the coolant temperature was measured by thermocouples in several axial and radial positions. The corresponding numerical simulations were carried out with the U.S. NRC system code TRACE. The 3D/1D calculation model was prepared with the SNAP graphical interface, then transient simulations were carried out for each performed experiment. The measurement and simulation results showed good agreement for the analyzed transients, which suggests that TRACE might be an appropriate simulation tool for small-size, natural circulation cooled pool-type reactor calculations.

Jeu de mots paronomasia: a StackOverflow-driven bug discovery approach

Locating bug code snippets (short for BugCode) has been a complex problem throughout the history of software security, mainly because the constraints that define BugCode are obscure and hard to summarize. Previously, security analysts attempted to define such constraints manually (e.g., limiting buffer size to detect overflow), but were limited to the types of BugCode. Recent researchers address this problem by extracting constraints from program documentation, which shows the potential for API misuse. But for bugs beyond the scope of API misuse, such an approach becomes less effective since the corresponding constraints are not defined in documents, not to mention the programs without documentation In this paper, inspired by the fact that expert programmers often correct the BugCode on open forums such as StackOverflow, we design an approach to automatically extract knowledge from StackOverflow and leverage it to detect BugCode. As we all know, the contexts in StackOverflow come from ordinary developers. Their writing tends to be loosely organized and in various styles, which are more challenging to analyze than program documentation. To address the challenges, we design a custom tokenization approach to segment sentences and employ sentiment analysis to find the Controversial Sentences (CSs) that typically contain the constraints we need for code analysis. Then we use constituency parsing to extract knowledge from CSs, which helps locate BugCode. We evaluated our system on 41,144 comments from the questions tagged with Java and Android. The results show that our approach achieves 95.5% precision in discovering CSs. We have discovered 276 pieces of BugCode proved to be true through manual validation including an assigned CVE. 89.3% of the discovered bugs remained in the current version of answers, which are unknown to users.

Efficient and linear static approach for finding the memory leak in C

Code analysis has discovered that memory leaks are common in the C programming language. In the literature, there exist various approaches for statically analyzing and detecting memory leaks. The complexity and diversity of memory leaks make it difficult to find an approach that is both effective and simple. In embedded systems, costly resources like memory become limited as the system’s size diminishes. As a result, memory must be handled effectively and efficiently too. To obtain precise analysis, we propose a novel approach that works in a phase-wise manner. Instead of examining all possible paths for finding memory leaks, we use a program slicing to check for a potential memory leak. We introduce a source-sink flow graph (SSFG) based on source-sink properties of memory allocation-deallocation within the C code. To achieve simplicity in analysis, we also reduce the complexity of analysis in linear time. In addition, we utilize a constraint solver to improve the effectiveness of our approach. To evaluate the approach, we perform manual scanning on various test cases: link list applications, Juliet test cases, and common vulnerabilities and exposures found in 2021. The results show the efficiency of the proposed approach by preparing the SSFG with linear complexity.

Multiple context-free path querying by matrix multiplication

Many graph analysis problems can be formulated as formal language-constrained path querying problems where the formal languages are used as constraints for navigational path queries. Recently, the context-free language (CFL) reachability formulation has become very popular and can be used in many areas, for example, querying graph databases, Resource Description Framework (RDF) analysis. However, the generative capacity of context-free grammars (CFGs) is too weak to generate some complex queries, for example, from natural languages, and the various extensions of CFGs have been proposed. Multiple context-free grammar (MCFG) is one of such extensions of CFGs. Despite the fact that, to the best of our knowledge, there is no algorithm for MCFL-reachability, this problem is known to be decidable. This paper is devoted to developing the first such algorithm for the MCFL-reachability problem. The essence of the proposed algorithm is to use a set of Boolean matrices and operations on them to find paths in a graph that satisfy the given constraints. The main operation here is Boolean matrix multiplication. As a result, the algorithm returns a set of matrices containing all information needed to solve the MCFL-reachability problem. The presented algorithm is implemented in Python using GraphBLAS API. An analysis of real RDF data and synthetic graphs for some MCFLs is performed. The study showed that using a sparse format for matrix storage and parallel computing for graphs with tens of thousands of edges the analysis time can be 10–20 minutes. The result of the analysis provides tens of millions of reachable vertex pairs. The proposed algorithm can be applied in problems of static code analysis, bioinformatics, network analysis, as well as in graph databases when a path query cannot be expressed using context-free grammars. The provided algorithm is linear algebra-based, hence, it allows one to use high-performance libraries and utilize modern parallel hardware.

On the Effectiveness of Transfer Learning for Code Search

The Transformer architecture and transfer learning have marked a quantum leap in natural language processing, improving the state of the art across a range of text-based tasks. This paper examines how these advancements can be applied to and improve code search. To this end, we pre-train a BERT-based model on combinations of natural language and source code data and fine-tune it on pairs of StackOverflow question titles and code answers. Our results show that the pre-trained models consistently outperform the models that were not pre-trained. In cases where the model was pre-trained on natural language “and” source code data, it also outperforms an information retrieval baseline based on Lucene. Also, we demonstrated that the combined use of an information retrieval-based approach followed by a Transformer leads to the best results overall, especially when searching into a large search pool. Transfer learning is particularly effective when much pre-training data is available and fine-tuning data is limited. We demonstrate that natural language processing models based on the Transformer architecture can be directly applied to source code analysis tasks, such as code search. With the development of Transformer models designed more specifically for dealing with source code data, we believe the results of source code analysis tasks can be further improved.

Automatic Performance-Optimal Offloading of Network Functions on Programmable Switches

In network function virtualization (NFV), network functions (NFs) are chained as a service function chain (SFC) to enhance NF management with low cost and high flexibility. Recent NFV solutions indicate that the packet processing performance of SFCs can be significantly improved by offloading NFs to programmable switches. However, such offloading requires a deep understanding of heterogeneous NF properties (e.g., resource consumption) to achieve the maximum SFC performance. Unfortunately, none of existing solutions provide automatic analysis of NF properties. Thus, network administrators have to manually examine the source codes of NFs and profile various NF properties, which is time-consuming and laborious. In this paper, we propose LightNF, a system that simplifies NF offloading in programmable networks. LightNF automatically dissects comprehensive NF properties by means of code analysis and performance profiling while eliminating manual efforts. It then leverages its analysis results of NF properties in its SFC placement so as to make the performance-optimal offloading decisions. We have implemented LightNF on Tofino-based hardware programmable switches. We perform extensive experiments to evaluate LightNF with a real-world testbed and large-scale simulation. Our experiments show that LightNF outperforms state-of-the-art solutions with an orders-of-magnitude reduction in per-packet processing latency and 9.5 improvement in SFC throughput.

Methods and means of static and dynamic code analysis

The purpose of the article is to explore the methods and tools used to analyze software code in order to identify errors and potential problems. Static and dynamic code analysis are key processes in software development, as they allow you to detect errors in the early stages of development, reduce the risk of problems later and ensure high quality of the software product. The article discusses various methods and means of static and dynamic code analysis. For each method and tool, examples of their use and advantages and disadvantages are described.
 The article will be useful for software developers who want to improve the quality of their products and reduce the risk of problems. It will provide readers with an in-depth understanding of code analysis techniques and tools and help them choose the most appropriate tool for their needs.

Lessons (Not) Learned: Chicago Death Inequities during the 1918 Influenza and COVID-19 Pandemics

During historical and contemporary crises in the U.S., Blacks and other marginalized groups experience an increased risk for adverse health, social, and economic outcomes. These outcomes are driven by structural factors, such as poverty, racial residential segregation, and racial discrimination. These factors affect communities' exposure to risk and ability to recover from disasters, such as pandemics. This study examines whether areas where descendants of enslaved Africans and other Blacks lived in Chicago were vulnerable to excess death during the 1918 influenza pandemic and whether these disparities persisted in the same areas during the COVID-19 pandemic. To examine disparities, demographic data and influenza and pneumonia deaths were digitized from historic weekly paper maps from the week ending on 5 October 1918 to the week ending on 16 November 1918. Census tracts were labeled predominantly Black or white if the population threshold for the group in a census tract was 40% or higher for only one group. Historic neighborhood boundaries were used to aggregate census tract data. The 1918 spatial distribution of influenza and pneumonia mortality rates and cases in Chicago was then compared to the spatial distribution of COVID-19 mortality rates and cases using publicly available datasets. The results show that during the 1918 pandemic, mortality rates in white, immigrant and Black neighborhoods near industrial areas were highest. Pneumonia mortality rates in both Black and immigrant white neighborhoods near industrial areas were approximately double the rates of neighborhoods with predominantly US-born whites. Pneumonia mortality in Black and immigrant white neighborhoods, far away from industrial areas, was also higher (40% more) than in US-born white neighborhoods. Around 100 years later, COVID-19 mortality was high in areas with high concentrations of Blacks based on zip code analysis, even though the proportion of the Black population with COVID was similar or lower than other racial and immigrant groups. These findings highlight the continued cost of racial disparities in American society in the form of avoidable high rates of Black death during pandemics.

Computer code analysis of irradiation performance of an annular mixed oxide fuel element

ABSTRACT Computer code analyses were conducted for irradiation behaviors of a fuel element with annular mixed oxide fuel pellets attaining a pellet peak burnup of 60 GWd/t in a fast reactor. Post-irradiation examinations of annular and solid fuel elements revealed that the diameter strain of the cladding of the annular fuel element was smaller than that of the solid fuel element and that the cesium concentration increased locally near the interface between the fuel pellet column and the lower blanket pellet in the annular fuel element, while cesium concentration was rather uniform over the fuel pellet column in the solid fuel element. The code analysis clarified the mechanism of these experimental results. The smaller cladding diameter strain of the annular fuel element was due to a delay in the onset of fuel pellet-cladding mechanical interaction, which increased the outer surface temperature of the fuel pellet, thereby enhancing the axial migration of cesium toward the fuel–blanket interface.

Predicting Software Cohesion Metrics with Machine Learning Techniques

The cohesion value is one of the important factors used to evaluate software maintainability. However, measuring the cohesion value is a relatively difficult issue when tracing the source code manually. Although there are many static code analysis tools, not every tool measures every metric. The user should apply different tools for different metrics. In this study, besides the use of these tools, we predicted the cohesion values (LCOM2, TCC, LCC, and LSCC) with machine learning techniques (KNN, REPTree, multi-layer perceptron, linear regression (LR), support vector machine, and random forest (RF)) to solve them alternatively. We created two datasets utilizing two different open-source software projects. According to the obtained results, for the LCOM2 and TCC metrics, the KNN algorithm provided the best results, and for LCC and LSCC metrics, the REPTree algorithm was the best. However, out of all the metrics, RF, REPTree, and KNN had close performances with each other, and therefore any of the RF, REPTree, and KNN techniques can be used for software cohesion metric prediction.

Evaluating a Method to Select Software Developers from Source Code Analysis

Evaluating a Method to Select Software Developers from Source Code Analysis

Resilient Autonomous Mission Management for Decentralized Multispacecraft Missions

Autonomy will play a crucial role in achieving complex mission goals and reducing the burden for ground operations for upcoming ambitious aerospace missions. Standalone spacecraft can leverage autonomy concepts to optimize data collection and ensure robust operation. Autonomy can additionally provide a feasible method of ensuring coordination for spacecraft clusters through onboard peer-to-peer scheduling. The core of this framework, the schedule manager (SM), manages tasks by associating constraints with each task including time windows, task priority, conflict categories, and resource requirements, which assures that tasks will only run when capable. This increased control over individual tasks also improves the modularity of the overall mission plan and provides a built-in fail-safe in the event of unexpected task failure through the loading of predefined contingency schedules. Various other capabilities were added to the SM, including the SM data server to simplify commanding, distributed coordination, and integration with NASA Goddard Space Flight Center’s core Flight System (cFS) platform. Software validation was achieved with cFS unit tests, functional tests, and code analysis tools. Demonstrations were tested with a cluster of development boards in the loop as representative flight hardware.

Rbox: A web API for software integration with the R programming language

AbstractThis paper presents an inventive software interface for the integration of some extensively used information systems with the R programming environment. The contribution of this paper is two‐fold. First, a more comprehensive and specialized data analysis tool is provided. Second, a notable software code analysis model has been proposed to perform statistical tests and execute machine learning algorithms using the capabilities of the R programming language. The recommended application programming interface is successfully tested and evaluated based on a real‐life data set. The obtained results verify the high computing performance of the model in terms of the execution proceedings and achieved objectives.

Visual based GNC system from prototype to flight software

Juventas is a 6U CubeSat which is part of HERA planetary defense mission and takes advantage of an innovative visual based guidance, navigation and control (GNC) system to perform autonomous navigation in the proximity of the Didymain system. The GNC system is designed to ensure safe navigation in the harsh and unpredictable environment of deep space and finally to take more risks by landing on the surface of Dimorphos. To achieve a qualitative software (SW) product, a dedicated procedure of SW lifecycle is developed by starting with GNC and image processing design, which concludes with the final embedded system that will perform the visual navigation task. A Design, Development, Verification and Validation (DDVV) approach is developed to achieve the flight software: model in the loop (MIL), auto-coding, software in the loop (SIL), processor in the loop (PIL) and finally hardware in the loop (HIL). The DDVV is developed by having as guideline the ECSS standards for SW. The flight software reaches maturity by performing dynamic/static code analysis and code coverage. To ensure an optimal process, a waterfall life-cycle is considered, where dedicated MIL, SIL, PIL and HIL test benches are developed to fully support the activity and to reduce to minimum the development costs.[7]

Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases

Enterprise environment often screens large-scale (millions of lines of code) codebases with static analysis tools to find bugs and vulnerabilities. Parfait is a static code analysis tool used in Oracle to find security vulnerabilities in industrial codebases. Recently, many studies show that there are complicated cryptographic vulnerabilities caused by misusing cryptographic APIs in Java TM 1 In this paper, we describe how we realize a precise and scalable detection of these complicated cryptographic vulnerabilities based on Parfait framework. The key challenge in the detection of cryptographic vulnerabilities is the high false alarm rate caused by pseudo-influences. Pseudo-influences happen if security-irrelevant constants are used in constructing security-critical values. Static analysis is usually unable to distinguish them from hard-coded constants that expose sensitive information. We tackle this problem by specializing the backward dataflow analysis used in Parfait with refinement insights, an idea from the tool CryptoGuard [ 20 ]. We evaluate our analyzer on a comprehensive Java cryptographic vulnerability benchmark and eleven large real-world applications. The results show that the Parfait-based cryptographic vulnerability detector can find real-world cryptographic vulnerabilities in large-scale codebases with high true-positive rates and low runtime cost.