Source Code Analysis Research Articles

Deep Emulators for Differentiation, Forecasting, and Parametrization in Earth Science Simulators

AbstractTo understand and predict large, complex, and chaotic systems, Earth scientists build simulators from physical laws. Simulators generalize better to new scenarios, require fewer tunable parameters, and are more interpretable than nonphysical deep learning, but procedures for obtaining their derivatives with respect to their inputs are often unavailable. These missing derivatives limit the application of many important tools for forecasting, model tuning, sensitivity analysis, or subgrid‐scale parametrization. Here, we propose to overcome this limitation with deep emulator networks that learn to calculate the missing derivatives. By training directly on simulation data without analyzing source code or equations, this approach supports simulators in any programming language on any hardware without specialized routines for each case. To demonstrate the effectiveness of our approach, we train emulators on complete or partial system states of the chaotic Lorenz‐96 simulator and evaluate the accuracy of their dynamics and derivatives as a function of integration time and training data set size. We further demonstrate that emulator‐derived derivatives enable accurate 4D‐Var data assimilation and closed‐loop training of parametrizations. These results provide a basis for further combining the parsimony and generality of physical models with the power and flexibility of machine learning.

Evolution of the Unix System Architecture: An Exploratory Case Study

Unix has evolved for almost five decades, shaping modern operating systems, key software technologies, and development practices. Studying the evolution of this remarkable system from an architectural perspective can provide insights on how to manage the growth of large, complex, and long-lived software systems. Along main Unix releases leading to the FreeBSD lineage we examine core architectural design decisions, the number of features, and code complexity, based on the analysis of source code, reference documentation, and related publications. We report that the growth in size has been uniform, with some notable outliers, while cyclomatic complexity has been religiously safeguarded. A large number of Unix-defining design decisions were implemented right from the very early beginning, with most of them still playing a major role. Unix continues to evolve from an architectural perspective, but the rate of architectural innovation has slowed down over the system's lifetime. Architectural technical debt has accrued in the forms of functionality duplication and unused facilities, but in terms of cyclomatic complexity it is systematically being paid back through what appears to be a self-correcting process. Some unsung architectural forces that shaped Unix are the emphasis on conventions over rigid enforcement, the drive for portability, a sophisticated ecosystem of other operating systems and development organizations, and the emergence of a federated architecture, often through the adoption of third-party subsystems. These findings have led us to form an initial theory on the architecture evolution of large, complex operating system software.

Log-based software monitoring: a systematic mapping study

Modern software development and operations rely on monitoring to understand how systems behave in production. The data provided by application logs and runtime environment are essential to detect and diagnose undesired behavior and improve system reliability. However, despite the rich ecosystem around industry-ready log solutions, monitoring complex systems and getting insights from log data remains a challenge. Researchers and practitioners have been actively working to address several challenges related to logs, e.g., how to effectively provide better tooling support for logging decisions to developers, how to effectively process and store log data, and how to extract insights from log data. A holistic view of the research effort on logging practices and automated log analysis is key to provide directions and disseminate the state-of-the-art for technology transfer. In this paper, we study 108 papers (72 research track papers, 24 journals, and 12 industry track papers) from different communities (e.g., machine learning, software engineering, and systems) and structure the research field in light of the life-cycle of log data. Our analysis shows that (1) logging is challenging not only in open-source projects but also in industry, (2) machine learning is a promising approach to enable a contextual analysis of source code for log recommendation but further investigation is required to assess the usability of those tools in practice, (3) few studies approached efficient persistence of log data, and (4) there are open opportunities to analyze application logs and to evaluate state-of-the-art log analysis techniques in a DevOps context.

Towards Individualized Production with Flexible Shopfloor IT based on Distributed OPC UA Services

Nowadays, manufacturers face the problems to adjust their production according to the fast-changing global competition. Car manufacturers, for example, are in front of a new era of individual mobility. They need to switch from combustion engines to electric drives. In general, manufacturers have to develop production strategies to lower set up time and meet requirements faster. The classical production line is most effective if the product variety is low and the lot size is high but facing the rapid growing demand for individualized products and fast-changing requirements, manufacturers must discover new ways of manufacturing. One possibility is the flexible shopfloor. In this work, we will present our concept of a flexible shopfloor IT for controlling a robotic demonstrator. We use OPC UA over TSN as a platform for communication and CODESYS as Soft SPS for the control of sensors and actuators. In order to create valid data for ongoing discussions we use function point analysis and counting lines of sourcecode to measure software size. Our expectation is that the initial effort for implementing a flexible shopfloor IT is higher compared to the classic approach, but for all the following implementation it will take less time, because of the possibility of reuse already developed systems.

Keeping It Simple: Agile Analysis

Writing reliable software is hard. No matter how determined we all are to avoid it, we do make mistakes and at a fairly predictable rate. What makes a software system reliable is not determined just by the care we take in planning and structuring a design but also by the methods we use in catching those pesky bugs that come along for the ride. For safety-critical code, the use of strong static source code analyzers has become an essential part of the development process. The best analyzers are based on solid theory and maintained by large teams of highly skilled developers. The tools can patiently trace through complex execution paths to reveal a range of subtle bugs, although, of course, only the types of bugs the tools have been trained on. The tools can be slow and costly, though, and the warnings they generate are sometimes difficult for humans to evaluate accurately.

Software Source Code: Theoretical Analyzing and Practical Reviewing Model

The high-quality software product is one of the most important goals of software engineering in general, source coding or implementation phase is one of the main steps of the software development process; when this phase is going in a good way and according to the source code quality standards and rules, the final product will be a high-quality product. This research focuses on the issues that can affect source code quality, such as errors, faults, defects, and failures; a practical system model will be provided (proposed) to predict some possible types of errors and defects and suggests some guidance and recommendations on source code error detection and analysis.

A METHOD FOR PREDICTION EXECUTION TIME OF GPU PROGRAMS

The use of coprocessors such as GPU and FPGA is a leading trend in HPC. Therefore a lot of applications from a wide variety of domains were modified for GPUs and successfully used. In this paper, we propose an approach for prediction execution time of CUDA kernels, based on a static analysis of a program source code. The approach is based on building a CUDA core model and a graphics accelerator model. The developed method for estimating the execution time of CUDA kernels is applied to the implementation of matrix multiplication, the Fourier transform and the backpropagation method for training neural networks. As a result of verification, the approach showed good prediction accuracy, especially on low GPU loads.

Commit2Vec: Learning Distributed Representations of Code Changes

Deep learning methods have found successful applications in fields like image classification and natural language processing. They have recently been applied to source code analysis too, due to the enormous amount of freely available source code (e.g., from open-source software repositories). In this work, we elaborate upon a state-of-the-art approach for source code representation, which uses information about its syntactic structure, and we extend it to represent source code changes (i.e., commits). We use this representation to tackle an industrial-relevant task: the classification of security-relevant commits. We leverage on transfer learning, a machine learning technique which reuses, or transfers, information learned from previous tasks (commonly called pretext tasks) to tackle a new target task. We assess the impact of using two different pretext tasks, for which abundant labeled data is available, to tackle the classification of security-relevant commits. Our results indicate that representations that exploit the structural information in code syntax outperform token-based representations. Furthermore, we show that pre-training on a small dataset ( $$>10^4$$ samples), but for a pretext task that is closely related to the target task, results in better performance metrics than pre-training on a loosely related pretext task with a very large dataset ( $$>10^6$$ samples).

An autonomous performance testing framework using self-adaptive fuzzy reinforcement learning

Test automation brings the potential to reduce costs and human effort, but several aspects of software testing remain challenging to automate. One such example is automated performance testing to find performance breaking points. Current approaches to tackle automated generation of performance test cases mainly involve using source code or system model analysis or use-case-based techniques. However, source code and system models might not always be available at testing time. On the other hand, if the optimal performance testing policy for the intended objective in a testing process instead could be learned by the testing system, then test automation without advanced performance models could be possible. Furthermore, the learned policy could later be reused for similar software systems under test, thus leading to higher test efficiency. We propose SaFReL, a self-adaptive fuzzy reinforcement learning-based performance testing framework. SaFReL learns the optimal policy to generate performance test cases through an initial learning phase, then reuses it during a transfer learning phase, while keeping the learning running and updating the policy in the long term. Through multiple experiments in a simulated performance testing setup, we demonstrate that our approach generates the target performance test cases for different programs more efficiently than a typical testing process and performs adaptively without access to source code and performance models.

Virtualization Overhead of Multithreading in X86 State-of-the-Art & Remaining Challenges

Despite great advancements in hardware-assisted virtualization of the x86 architecture, certain workloads still suffer significant overhead. This article dissects said overhead in the context of multi-threading. We describe the state-of-the-art, pinpoint challenges, and suggest improvements, aiming to provide a valuable reference to developers and users of virtualization systems alike. We study the virtualization overhead of the PARSEC and SPLASH2X multithreaded benchmarks in a variety of scenarios using a state-of-the-art system. Through controlled experiments, source code analysis and literature review, we quantify the virtualization overhead multithreading still induces and link it to its root causes, after which we suggest possible mitigation strategies. Multithreading still induces high virtualization overhead, mainly caused by synchronization, spinning at user level and NUMA management. The overhead is diverse in nature and embodiment as it is a function of many system and workload properties. System-level solutions are feasible, but often imply difficult trade-offs. Systematic workload optimization is a promising alternative.

Neutron: an attention-based neural decompiler

Decompilation aims to analyze and transform low-level program language (PL) codes such as binary code or assembly code to obtain an equivalent high-level PL. Decompilation plays a vital role in the cyberspace security fields such as software vulnerability discovery and analysis, malicious code detection and analysis, and software engineering fields such as source code analysis, optimization, and cross-language cross-operating system migration. Unfortunately, the existing decompilers mainly rely on experts to write rules, which leads to bottlenecks such as low scalability, development difficulties, and long cycles. The generated high-level PL codes often violate the code writing specifications. Further, their readability is still relatively low. The problems mentioned above hinder the efficiency of advanced applications (e.g., vulnerability discovery) based on decompiled high-level PL codes.In this paper, we propose a decompilation approach based on the attention-based neural machine translation (NMT) mechanism, which converts low-level PL into high-level PL while acquiring legibility and keeping functionally similar. To compensate for the information asymmetry between the low-level and high-level PL, a translation method based on basic operations of low-level PL is designed. This method improves the generalization of the NMT model and captures the translation rules between PLs more accurately and efficiently. Besides, we implement a neural decompilation framework called Neutron. The evaluation of two practical applications shows that Neutron’s average program accuracy is 96.96%, which is better than the traditional NMT model.

Welcome to AI Matters 7(1)

Welcome to the first issue of this year's AI Matters Newsletter! We start with a report on upcoming SIGAI Events by Dilini Samarasinghe and Conference reports by Louise Dennis, our conference coordination officers. In our regular Education column, Duri Long, Jonathan Moon, and Brian Magerko introduce two "unplugged" activities (i.e., no technology needed) to learn about AI focussed on K-12 AI Education. We then bring you our regular Policy column, where Larry Medsker covers several topics on AI policy, including the role of Big Tech on AI Ethics and an interview with Dr. Eric Daimler who is the CEO of the MIT-spinout Conexus.com. Finally, we close with four article contributions. The first article discusses emerging applications of AI in analyzing source code and its implications to several industries. The second article discusses topics in the area of physical scene understanding that are necessary for machines to perceive, interact, and reason about the physical world. The third article presents novel practices and highlights from the Fourth Workshop on Mechanism Design for Social Good. The fourth article provides a report on the "Decoding AI" event that was conducted online by ViSER for high school students and adults sponsored by ACM SIGAI.

Idempotence-Based Preemptive GPU Kernel Scheduling for Embedded Systems

Mission-critical embedded systems simultaneously run multiple graphics-processing-unit (GPU) computing tasks with different criticality and timeliness requirements. Considerable research effort has been dedicated to supporting the preemptive priority scheduling of GPU kernels. However, hardware-supported preemption leads to lengthy scheduling delays and complicated designs, and most software approaches depend on the voluntary yielding of GPU resources from restructured kernels. We propose a preemptive GPU kernel scheduling scheme that harnesses the idempotence property of kernels. The proposed scheme distinguishes idempotent kernels through static source code analysis. If a kernel is not idempotent, then GPU kernels are transactionized at the operating system (OS) level. Both idempotent and transactionized kernels can be aborted at any point during their execution and rolled back to their initial state for reexecution. Therefore, low-priority kernel instances can be preempted for high-priority kernel instances and reexecuted after the GPU becomes available again. Our evaluation using the Rodinia benchmark suite showed that the proposed approach limits the preemption delay to 18 ms in the 99.9th percentile, with an average delay in execution time of less than 10 percent for high-priority tasks under a heavy load in most cases.

Засіб вимірювання метрик вихідного коду FORTRAN за допомогою синтаксичного аналізу

The rapid development of software quality measurement methods, the need in efficient and versatile reengineering automatization tools becomes increasingly bigger. This becomes even more apparent when the programming language and respective coding practices slowly develop alongside each other for a long period of time, while the legacy code base grows bigger and remains highly relevant. In this paper, a source code metrics measurement tool for Fortran program quality evaluation is developed. It is implemented as a code module for Photran integrated development environment and based on a set of syntax tree walking algorithms. The module utilizes the built-in Photran syntax analysis engine and the tree data structure which it builds from the source code. The developed tool is also compared to existing source code analysis instruments. The results show that the developed tool is most effective when used in combination with Photran’s built-in refactoring system, and that Photran’s application programming interface facilitates easy scaling of the existing infrastructure by introducing other code analysis methods.

On the generalizability of Neural Program Models with respect to semantic-preserving program transformations

With the prevalence of publicly available source code repositories to train deep neural network models, neural program models can do well in source code analysis tasks such as predicting method names in given programs that cannot be easily done by traditional program analysis techniques. Although such neural program models have been tested on various existing datasets, the extent to which they generalize to unforeseen source code is largely unknown. Since it is very challenging to test neural program models on all unforeseen programs, in this paper, we propose to evaluate the generalizability of neural program models with respect to semantic-preserving transformations: a generalizable neural program model should perform equally well on programs that are of the same semantics but of different lexical appearances and syntactical structures. We compare the results of various neural program models for the method name prediction task on programs before and after automated semantic-preserving transformations. We use three Java datasets of different sizes and three state-of-the-art neural network models for code, namely code2vec, code2seq, and GGNN, to build nine such neural program models for evaluation. Our results show that even with small semantically preserving changes to the programs, these neural program models often fail to generalize their performance. Our results also suggest that neural program models based on data and control dependencies in programs generalize better than neural program models based only on abstract syntax trees (ASTs). On the positive side, we observe that as the size of the training dataset grows and diversifies the generalizability of correct predictions produced by the neural program models can be improved too. Our results on the generalizability of neural program models provide insights to measure their limitations and provide a stepping stone for their improvement.

On the Removal of Feature Toggles

Feature Toggling is a technique to control the execution of features in a software project. For example, practitioners using feature toggles can experiment with new features in a production environment by exposing them to a subset of users. Some of these toggles require additional maintainability efforts and are expected to be removed, whereas others are meant to remain for a long time. However, to date, very little is known about the removal of feature toggles, which is why we focus on this topic in our paper. We conduct an empirical study that focuses on the removal of feature toggles. We use source code analysis techniques to analyze 12 Python open source projects and surveyed 61 software practitioners to provide deeper insights on the topic. Our study shows that 75% of the toggle components in the studied Python projects are removed within 49 weeks after introduction. However, eventually practitioners remove feature toggles to follow the life cycle of a feature when it becomes stable in production. We also find that not all long-term feature toggles are designed to live that long and not all feature toggles are removed from the source code, opening the possibilities to unwanted risks. Our study broadens the understanding of feature toggles by identifying reasons for their survival in practice and aims to help practitioners make better decisions regarding the way they manage and remove feature toggles.

СONSECUTIVE INTEGRATION OF AVAILABLE MICROARRAY DATA FOR ANALYSIS OF DIFFERENTIAL GENE EXPRESSION IN HUMAN PLACENTA

The purpose of the study was to provide the pipeline for processing of publicly available unprocessed data on gene expression via integration and differential gene expression analysis. Data collection from open gene expression databases, normalization and integration into a single expression matrix in accordance with metadata and determination of differentially expressed genes were fulfilled. To demonstrate all stages of data processing and integrative analysis, there were used the data from gene expression in the human placenta from the first and second trimesters of normal pregnancy. The source code for the integrative analysis was written in the R programming language and publicly available as a repository on GitHub. Four clusters of functionally enriched differentially expressed genes were identified for the human placenta in the interval between the first and second trimester of pregnancy. Immune processes, developmental processes, vasculogenesis and angiogenesis, signaling and the processes associated with zinc ions varied in the considered interval between the first and second trimester of placental development. The proposed sequence of actions for integrative analysis could be applied to any data obtained by microarray technology.

The Case for Documenting User Experience as Part Preservation Strategy for Internet-Based Art

Internet-based art is deeply embedded in the online behaviours, customs and traditions that are constantly emerging through user interaction and engagement. As such, user experience should be considered a fundamental aspect of the artwork in need of considered documentation. This paper provides a historical overview of Internet-based art, that presents the broader socio-cultural aspects of Internet-based art, as experienced by the user. This paper argues that Internet-based art requires the same conservation considerations as more accepted aspects of time-based media art documentation: source-code analysis, materials and equipment lists, variability and artists’ intent. By documenting user experience, it enables opportunities to navigate the culturally-embedded principles of Internet culture and contemporary technological standards that may be lost if preservation strategies utilise a more material/code specific preservation strategy. Highlighting experience as a necessary pillar of the identity of Internet-based art, in conjunction with other widely accepted aspects of time-based media art documentation approaches, allows for a richer picture and understanding of defining qualities of works, whilst providing further evidentiary activation into preservation approaches.

User Interface Matters: Analysing the Complexity of Mobile Applications from a Visual Perspective

Product-centric techniques to analyze mobile applications leverage traditional source code analysis, size, market success, complexity, and others. Many of these techniques converge in the strategy of evaluating metrics taken from the source code that delivers the functionality of the software product. However, when following the Model-View-Controller (MVC) architecture, mobile applications are typically constructed by a compound of at least two programming languages, one to deliver the functionality and the other to describe the visual aspects. The latter is commonly left out from source code analysis, even though critical parts of the application are present in the graphic User Interface (UI). In this paper, we identify an opportunity to strengthen the product-centric mobile app analysis by incorporating UI metrics. This approach aims to enhance the expressiveness of source code metrics and deliver a more comprehensive analysis of the complexity, maintainability, and effort estimation of a mobile app. To introduce the concept, we present a case study realized using a block-based programming language to create mobile apps, in which we describe and calculate functional and UI metrics, discover commonalities and differences, discuss traits, and open tracks for further research.

Static analysis of software source code based on the Fortify Static Code Analyzer solution

The article analyzes the problem of identifying source code vulnerabilities in the context of software development. An analysis of existing technologies for detecting vulnerabilities in the source code. Methods and means of protection of detection of source code vulnerabilities on the basis of the Fortify Static Code Analyzer solution are investigated. The purpose, main functions and architecture of the Fortify Static Code Analyzer solution are defined. Based on the research conducted in the work, a variant of the process of static analysis of the security of the source code in the context of the software life cycle was developed. Recommendations for the use of static source security analysis technology have been developed.