Bug Detection Research Articles

Reading and Calculation Neural Systems and Their Weighted Adaptive Use for Programming Skills.

Software programming is a modern activity that poses strong challenges to the human brain. The neural mechanisms that support this novel cognitive faculty are still unknown. On the other hand, reading and calculation abilities represent slightly less recent human activities, in which neural correlates are relatively well understood. We hypothesize that calculus and reading brain networks provide joint underpinnings with distinctly weighted contributions which concern programming tasks, in particular concerning error identification. Based on a meta-analysis of the core regions involved in both reading and math and recent experimental evidence on the neural basis of programming tasks, we provide a theoretical account that integrates the role of these networks in program understanding. In this connectivity-based framework, error-monitoring processing regions in the frontal cortex influence the insula, which is a pivotal hub within the salience network, leading into efficient causal modulation of parietal networks involved in reading and mathematical operations. The core role of the anterior insula and anterior midcingulate cortex is illuminated by their relation to performance in error processing and novelty. The larger similarity that we observed between the networks underlying calculus and programming skills does not exclude a more limited but clear overlap with the reading network, albeit with differences in hemispheric lateralization when compared with prose reading. Future work should further elucidate whether other features of computer program understanding also use distinct weights of phylogenetically “older systems” for this recent human activity, based on the adjusting influence of fronto-insular networks. By unraveling the neural correlates of program understanding and bug detection, this work provides a framework to understand error monitoring in this novel complex faculty.

Deforestation effects on Attalea palms and their resident Rhodnius, vectors of Chagas disease, in eastern Amazonia.

Attalea palms provide primary habitat to Rhodnius spp., vectors of Trypanosoma cruzi. Flying from palms, these blood-sucking bugs often invade houses and can infect people directly or via food contamination. Chagas disease (CD) risk may therefore increase when Attalea palms thrive near houses. For example, Attalea dominate many deforested landscapes of eastern Amazonia, where acute-CD outbreaks are disturbingly frequent. Despite this possible link between deforestation and CD risk, the population-level responses of Amazonian Attalea and their resident Rhodnius to anthropogenic landscape disturbance remain largely uncharted. We studied adult Attalea palms in old-growth forest (OGF), young secondary forest (YSF), and cattle pasture (CP) in two localities of eastern Amazonia. We recorded 1856 Attalea along 10 transects (153.6 ha), and detected infestation by Rhodnius spp. in 18 of 280 systematically-sampled palms (33 bugs caught). Distance-sampling models suggest that, relative to OGF, adult Attalea density declined by 70–80% in CP and then recovered in YSF. Site-occupancy models estimate a strong positive effect of deforestation on palm-infestation odds (βCP-infestation = 4.82±1.14 SE), with a moderate decline in recovering YSF (βYSF-infestation = 2.66±1.10 SE). Similarly, N-mixture models suggest that, relative to OGF, mean vector density sharply increased in CP palms (βCP-density = 3.20±0.62 SE) and then tapered in YSF (βYSF-density = 1.61±0.76 SE). Together, these results indicate that disturbed landscapes may support between ~2.5 (YSF) and ~5.1 (CP) times more Attalea-dwelling Rhodnius spp. per unit area than OGF. We provide evidence that deforestation may favor palm-dwelling CD vectors in eastern Amazonia. Importantly, our landscape-disturbance effect estimates explicitly take account of (i) imperfect palm and bug detection and (ii) the uncertainties about infestation and vector density arising from sparse bug data. These results suggest that incorporating landscape-disturbance metrics into the spatial stratification of transmission risk could help enhance CD surveillance and prevention in Amazonia.

Context-Aware Personalized Crowdtesting Task Recommendation

Crowdsourced software testing (short for crowdtesting) is a special type of crowdsourcing. It requires that crowdworkers master appropriate skill-sets and commit significant effort for completing a task. Abundant uncertainty may arise during a crowdtesting process due to imperfect information between the task requester and crowdworkers. For example, a worker frequently chooses tasks in an ad hoc manner in crowdtesting context, and an inappropriate task selection may lead to the worker's failing to detect any bugs, and significant testing effort unpaid and wasted. Recent studies have explored methods for supporting task requesters to make informed decisions on task pricing, worker recommendation, and so on. Unfortunately, very few study offers decision making support from the crowdworkers’ perspectives. We motivate this study through a pilot study, revealing the large portion (74 percent) of unpaid crowdworkers’ effort due to the inappropriate task choice. Drawn from our previous work on context-aware crowdworker recommendations, we advocate a more effective alternative to manual task selection would be to provide contextualized and personalized task recommendation considering the diverse distribution of worker preference and expertise, with objectives to increase their winning chances and to potentially reduce the frequency of unpaid crowd work. This paper proposes a context-aware personalized task recommendation approach <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PTRec</i> , consisting of a testing context model and a learning-based task recommendation model to aid dynamic worker decision in selecting crowdtesting tasks. The testing context model is constructed in two perspectives, i.e., process context and resource context, to capture the in-process progress-oriented information and crowdworkers’ characteristics respectively. Built on top of this context model, the learning-based task recommendation model extracts 60 features automatically, and employs random forest learner to generate dynamic and personalized task recommendation which matches workers’ expertise and interest. The evaluation is conducted on 636 crowdtesting tasks involving 2,404 crowdworkers from one of the largest crowdtesting platforms, and results show our approach can achieve an average precision of 82 percent, average recall of 84 percent, and save an estimated average of 81 percent effort originally spent on exploring, significantly outperforming four commonly-used and state-of-the-art baselines. This indicates its potential in recommending proper tasks to workers so as to improve bug detection efficiency and increase their monetary earnings.

Performance counter based online pipeline bugs detection using machine learning techniques

The growing complexity of new features in multicore processors imposes significant pressure towards functional verification. Although a large amount of time and effort are spent on it, functional design bugs escape into the products and cause catastrophic effects. Hence, online design bug detection is needed to detect the functional bugs in the field. In this work, we propose a novel approach by leveraging Performance Monitoring Counters (PMC) and machine learning to detect and locate pipeline bugs in a processor. We establish the correlation between PMC events and pipeline bugs in order to extract the features to build and train machine learning models. We design and implement a synthetic bug injection framework to obtain datasets for our simulation. To evaluate the proposal, Multi2Sim simulator is used to simulate the x86 architecture model. An x86 fault model is developed to synthetically inject bugs in x86 pipeline stages. PMC event values are collected by executing the SPEC CPU2006 and MiBench benchmarks for both bug and no-bug scenarios in the x86 simulator. This training data obtained through simulation is used to build a Bug Detection Model (BDM) that detects a pipeline bug and a Bug Location Model (BLM) that locates the pipeline unit where the bug occurred. Simulation results show that both BDM and BLM provide an accuracy of 97.3% and 91.6% using Decision tree and Random forest, respectively. When compared against other state of art approaches, our solution can locate the pipeline unit where the bug occurred with a high accuracy and without using additional hardware.

DeepWukong

Static bug detection has shown its effectiveness in detecting well-defined memory errors, e.g., memory leaks, buffer overflows, and null dereference. However, modern software systems have a wide variety of vulnerabilities. These vulnerabilities are extremely complicated with sophisticated programming logic, and these bugs are often caused by different bad programming practices, challenging existing bug detection solutions. It is hard and labor-intensive to develop precise and efficient static analysis solutions for different types of vulnerabilities, particularly for those that may not have a clear specification as the traditional well-defined vulnerabilities. This article presents D eep W ukong , a new deep-learning-based embedding approach to static detection of software vulnerabilities for C/C++ programs. Our approach makes a new attempt by leveraging advanced recent graph neural networks to embed code fragments in a compact and low-dimensional representation, producing a new code representation that preserves high-level programming logic (in the form of control- and data-flows) together with the natural language information of a program. Our evaluation studies the top 10 most common C/C++ vulnerabilities during the past 3 years. We have conducted our experiments using 105,428 real-world programs by comparing our approach with four well-known traditional static vulnerability detectors and three state-of-the-art deep-learning-based approaches. The experimental results demonstrate the effectiveness of our research and have shed light on the promising direction of combining program analysis with deep learning techniques to address the general static code analysis challenges.

Diversifying Focused Testing for Unit Testing

Software changes constantly, because developers add new features or modifications. This directly affects the effectiveness of the test suite associated with that software, especially when these new modifications are in a specific area that no test case covers. This article tackles the problem of generating a high-quality test suite to cover repeatedly a given point in a program, with the ultimate goal of exposing faults possibly affecting the given program point. Both search-based software testing and constraint solving offer ready, but low-quality, solutions to this: Ideally, a maximally diverse covering test set is required, whereas search and constraint solving tend to generate test sets with biased distributions. Our approach, Diversified Focused Testing (DFT), uses a search strategy inspired by GödelTest. We artificially inject parameters into the code branching conditions and use a bi-objective search algorithm to find diverse inputs by perturbing the injected parameters, while keeping the path conditions still satisfiable. Our results demonstrate that our technique, DFT, is able to cover a desired point in the code at least 90% of the time. Moreover, adding diversity improves the bug detection and the mutation killing abilities of the test suites. We show that DFT achieves better results than focused testing, symbolic execution, and random testing by achieving from 3% to 70% improvement in mutation score and up to 100% improvement in fault detection across 105 software subjects.

Towards Efficient Large-Scale Interprocedural Program Static Analysis on Distributed Data-Parallel Computation

Static program analysis has been widely applied along the whole process of the program development for bug detection, code optimization, testing, etc. Although researchers have made significant work in static program analysis, it is still challenging to perform sophisticated interprocedural analysis on large-scale modern software. The underlying reason is that interprocedural analysis for large-scale modern software is highly computation- and memory-intensive, leading to poor efficiency and scalability. In this article, we introduce an efficient distributed and scalable solution for sophisticated static analysis. Specifically, we propose a data-parallel algorithm and a join-process-filter computation model for the CFL-reachability-based interprocedural analysis. Based on that, an efficient distributed static analysis engine called BigSpa is developed, which is composed of an offline batch static program analysis system and an online incremental static program analysis system. The BigSpa system has high generality and can support all kinds of static analysis tasks that can be expressed as CFL reachability problems. The performance of BigSpa is evaluated on real-world large-scale software datasets. Our experiments show that the offline batch system can exceed an order of magnitude compared with the most advanced analysis tools available on performance, and for incremental analysis with small batch updates on the same data sets, the online analysis system can achieve near real-time response, which is very fast and flexible.

Learning From Incomplete and Inaccurate Supervision

In plenty of real-life tasks, strongly supervised information is hard to obtain, and thus weakly supervised learning has drawn considerable attention recently. This paper investigates the problem of learning from incomplete and inaccurate supervision, where only a limited subset of training data is labeled but potentially with noise. This setting is challenging and of great importance but rarely studied in the literature. We notice that in many applications, the limited labeled data are with certain structures, which paves us a way to design effective methods. Specifically, we observe that labeled data are usually with one-sided noise such as the bug detection task, where the identified buggy codes are indeed with defects, while codes checked many times or newly fixed may still have other flaws. Furthermore, when there occurs two-sided noise in the labeled data, we exploit the class-prior information of unlabeled data, which is typically available in practical tasks. We propose novel approaches for the incomplete and inaccurate supervision learning tasks and effectively alleviate the negative influence of label noise with the help of a vast number of unlabeled data. Both theoretical analysis and extensive experiments justify and validate the effectiveness of the proposed approaches.

Name-based Approach to Identify Suspicious Return Statements

Identifier names account for 70 percent of source code in characters. Meaningful identifier names convey valuable natural language information of the corresponding software entities, and thus they can be exploited to analyse the program and comprehend the semantics of it. However, existing bug detection approaches often ignore such natural language information and semantics encoded in identifier names. To this end, we propose a name-based approach to identify suspicious return statements. The recent study suggests that source code elements are often lexically similar to their corresponding semantic related elements. Based on this assumption, we design a sequence of heuristic rules to determine whether the return statement of a given method matches the signature of it. Evaluations on 100 open-source Java projects suggest that the proposed approach detects 16 out of 60 real return bugs. The precision and recall of the proposed approach are 31% and 27%, respectively.

MooFuzz: Many-Objective Optimization Seed Schedule for Fuzzer

Coverage-based Greybox Fuzzing (CGF) is a practical and effective solution for finding bugs and vulnerabilities in software. A key challenge of CGF is how to select conducive seeds and allocate accurate energy. To address this problem, we propose a novel many-objective optimization solution, MooFuzz, which can identify different states of the seed pool and continuously gather different information about seeds to guide seed schedule and energy allocation. First, MooFuzz conducts risk marking in dangerous positions of the source code. Second, it can automatically update the collected information, including the path risk, the path frequency, and the mutation information. Next, MooFuzz classifies seed pool into three states and adopts different objectives to select seeds. Finally, we design an energy recovery mechanism to monitor energy usage in the fuzzing process and reduce energy consumption. We implement our fuzzing framework and evaluate it on seven real-world programs. The experimental results show that MooFuzz outperforms other state-of-the-art fuzzers, including AFL, AFLFast, FairFuzz, and PerfFuzz, in terms of path discovery and bug detection.

Rigorous code review by reverse engineering

Agile software development methods advocate the importance of producing working software without comprehensive documentation. While this approach seems to suit the evolutionary nature of realistic software development for many applications, even including safety-critical systems, it faces two major challenges. One is the lack of a comprehensible specification for code evolution and future maintenance, and the other is the potentially huge cost in code verification. To address this problem, we believe that supporting the efficient production of system specification by reversing the program constructed as the result of an agile development will be a useful solution. The reverse engineering of specifications from programs will not only help us produce the necessary specification for future program evolution, but more importantly can help us rigorously review the program to detect bugs for the enhancement of program quality. In this paper, we put forward a novel method for rigorously reviewing code by reversing it into a comprehensible, formal specification. We elaborate on the principle of translating code into a specification and discuss how the translation process helps detect bugs in programs. We demonstrate how the proposed method works in practice with examples. We also present an experiment to evaluate the performance of the method by comparing it with existing checklist-based inspection. How to utilize reverse engineering of formal specifications from programs as a means to review the program for bug detection is an almost unexplored topic in software engineering. In this paper, we have described a specific method called RCRRE to reverse engineering of SOFL formal specifications from code and discussed how the reverse engineering process can be taken as an effective means to review the program for bug detection. The principle of converting code to a SOFL specification is reflected by a set of translation patterns and a two-step approach to construct a SOFL specification is established. To evaluate the performance, we have carried out an experiment on the effectiveness of our RCRRE method by comparing it with the CBI approach. The result of the experiment indicates that using our RCRRE method can effectively help the reviewer scrutinize the code and therefore find more bugs than the CBI when the reviewer is rather familiar with the SOFL specification language and skills. In the meanwhile, it also shows that the effectiveness of our RCRRE method may be affected in the situation where the reviewer lacks sufficient understanding and experience of SOFL, and using our RCRRE method may in general take a little longer time than the CBI.

Multi-Objective based test case selection and prioritization for distributed cloud environment

Software testing is highly significant during the software development lifecycle for the earlier detection of errors and bugs. Test suite optimization is a selection of the smallest subset of the test cases. This enables quick recovery of the faults in the software product within a minimum time. Selection and prioritization of the test cases are the main approaches to solve the issues in the test case optimization. Various selection and prioritization techniques are developed in the recent days. However, the existing techniques require more cost and time consumption. Also, the increase in the number of objectives reduces the performance of the existing techniques. This paper proposes a multi-objective based test case selection and prioritization for distributed cloud environment. The Resemblance-Based Cluster Head (RBCH) algorithm is proposed to select the Cluster Head (CH) based on the overall similarity between the test cases. The Distance-Based Transposition (DBT) is proposed to prioritize the optimal test case clusters in the distributed environment. This proposed approach efficiently minimizes the time consumption for the testing process by reducing the number of iterations in the test case searching process. From the experimental result, it is observed that the proposed approach achieves higher fault detection rate, prioritization accuracy and lower execution time than the existing prioritization techniques.

Checking Smart Contracts With Structural Code Embedding

Smart contracts have been increasingly used together with blockchains to automate financial and business transactions. However, many bugs and vulnerabilities have been identified in many contracts which raises serious concerns about smart contract security, not to mention that the blockchain systems on which the smart contracts are built can be buggy. Thus, there is a significant need to better maintain smart contract code and ensure its high reliability. In this paper, we propose an automated approach to learn characteristics of smart contracts in Solidity, which is useful for clone detection, bug detection and contract validation on smart contracts. Our new approach is based on word embeddings and vector space comparison. We parse smart contract code into word streams with code structural information, convert code elements (e.g., statements, functions) into numerical vectors that are supposed to encode the code syntax and semantics, and compare the similarities among the vectors encoding code and known bugs, to identify potential issues. We have implemented the approach in a prototype, named S <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mart</small> E <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mbed</small> , <xref ref-type="fn" rid="fn1" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">¹</xref> <fn id="fn1" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><label>1.</label> The anonymous replication packages can be accessed at: <uri>https://drive.google.com/file/d/1kauLT3y2IiHPkUlVx4FSTda-dVAyL4za/view?usp=sharing</uri>. </fn> and evaluated it with more than 22,000 smart contracts collected from the Ethereum blockchain. Results show that our tool can effectively identify many repetitive instances of Solidity code, where the clone ratio is around 90 percent. Code clones such as type-III or even type-IV semantic clones can also be detected accurately. Our tool can identify more than 1000 clone related bugs based on our bug databases efficiently and accurately. Our tool can also help to efficiently validate any given smart contract against a known set of bugs, which can help to improve the users’ confidence in the reliability of the contract.

Modeling and analyzing evaluation cost of CUDA kernels

General-purpose programming on GPUs (GPGPU) is becoming increasingly in vogue as applications such as machine learning and scientific computing demand high throughput in vector-parallel applications. NVIDIA's CUDA toolkit seeks to make GPGPU programming accessible by allowing programmers to write GPU functions, called kernels, in a small extension of C/C++. However, due to CUDA's complex execution model, the performance characteristics of CUDA kernels are difficult to predict, especially for novice programmers. This paper introduces a novel quantitative program logic for CUDA kernels, which allows programmers to reason about both functional correctness and resource usage of CUDA kernels, paying particular attention to a set of common but CUDA-specific performance bottlenecks. The logic is proved sound with respect to a novel operational cost semantics for CUDA kernels. The semantics, logic and soundness proofs are formalized in Coq. An inference algorithm based on LP solving automatically synthesizes symbolic resource bounds by generating derivations in the logic. This algorithm is the basis of RaCuda, an end-to-end resource-analysis tool for kernels, which has been implemented using an existing resource-analysis tool for imperative programs. An experimental evaluation on a suite of CUDA benchmarks shows that the analysis is effective in aiding the detection of performance bugs in CUDA kernels.

Feature Selection Using Artificial Immune Network: An Approach for Software Defect Prediction

Software Defect Prediction (SDP) is a dynamic research field in the software industry. A quality software product results in customer satisfaction. However, the higher the number of user requirements, the more complex will be the software, with a correspondingly higher probability of failure. SDP is a challenging task requiring smart algorithms that can estimate the quality of a software component before it is handed over to the end-user. In this paper, we propose a hybrid approach to address this particular issue. Our approach combines the feature selection capability of the Optimized Artificial Immune Networks (Opt-aiNet) algorithm with benchmark machine-learning classifiers for the better detection of bugs in software modules. Our proposed methodology was tested and validated using 5 open-source National Aeronautics and Space Administration (NASA) data sets from the PROMISE repository: CM1, KC2, JM1, KC1 and PC1. Results were reported in terms of accuracy level and of an AUC with highest accuracy, namely, 94.82%. The results of our experiments indicate that the detection capability of benchmark classifiers can be improved by incorporating Opt-aiNet as a feature selection (FS) method.

An Empirical Study on Data Flow Bugs in Business Processes

An increasing number of service-based business processes are being developed with the booming of BPaaS (Business Process as a Service) in cloud computing. The profits and performance of enterprises strongly depend on the soundness of their processes being bereft of control flow and data flow bugs. Although some work has focused on the detection of control flow bugs, few studies have comprehensively and empirically investigated data flow bugs in business processes. To this end, we report an empirical study on data flow bugs in business (BPEL) processes. Our analysis of 178 real-world BPEL processes reveals that data flow bugs are surprisingly common: 94 BPEL processes involve data flow bugs, among which redundant output is predominant. The distribution and common scenarios of data flow bugs provide a reference for BPEL process designers. We also investigate the correlation between process complexity metrics and data flow bugs. Based on the statistics of the process complexity metrics and data flow bugs in our empirical study, we present a method to select appropriate metrics as features of BPEL processes and utilize state-of-the-art supervised learning algorithms to predict data flow bugs in an unseen BPEL process. The prediction accuracies of the different classification algorithms exceed 90 percent on average when using our selected metrics.

Multi-label software bug categorisation based on fuzzy similarity

The efficiency of the software depends on timely detection of bugs. For better quality and low-cost development bug fixing time should be minimised. Categorisation of software bugs helps to understand the root cause of software bugs and to improve triaging. As the software development approach is modular and multi-skilled, it is possible that one software bug can affect multiple modules, and multiple developers can fix newly reported bugs. Hence, a multi-label categorisation of software bugs is needed. Fuzzy similarity techniques can be helpful in understanding the belongingness of software bugs in multiple categories. In this paper a multi-label fuzzy similarity based categorisation technique is presented for effective categorisation of software bugs. Fuzzy similarity between a pair of bugs is computed and, based on a user defined threshold value, the bugs are categorised. Experiments are performed on software bug data sets, and the performance of the proposed classifier is evaluated.

Multi-label software bug categorisation based on fuzzy similarity

The efficiency of the software depends on timely detection of bugs. For better quality and low-cost development bug fixing time should be minimised. Categorisation of software bugs helps to understand the root cause of software bugs and to improve triaging. As the software development approach is modular and multi-skilled, it is possible that one software bug can affect multiple modules, and multiple developers can fix newly reported bugs. Hence, a multi-label categorisation of software bugs is needed. Fuzzy similarity techniques can be helpful in understanding the belongingness of software bugs in multiple categories. In this paper a multi-label fuzzy similarity based categorisation technique is presented for effective categorisation of software bugs. Fuzzy similarity between a pair of bugs is computed and, based on a user defined threshold value, the bugs are categorised. Experiments are performed on software bug data sets, and the performance of the proposed classifier is evaluated.

Directed Model Checking for Fast Abstract Reachability Analysis

We propose a novel technique (TOUR) to improve both bug detection ability and verification speed of ARMC by detecting a target path quickly. The key idea of TOUR is an error location directed search that utilizes the distance to an error location and function call context at runtime. TOUR applies four different distance metrics and a distance metric selection heuristic using static features of a target program. We have extensively evaluated TOUR on 3,042 real-world C programs in a software verification competition benchmark. The experiment results show that TOUR, due to its error location directed search, finds bugs in 20% more programs in 11% less model checking time than the state-of-the-art ARMC technique (i.e., block-abstraction memoization) for 354 buggy programs. Also, TOUR verifies 15% more programs within 15% less model checking time than the block-abstraction memoization for 652 complex clean programs.

Novel Detection of Nasty Bugs, Prevention Is Better than Cure.

Hospital-acquired infections (HAIs) are a growing concern around the world. They contribute to increasing mortality and morbidity rates and are an economic threat. All hospital patients have the potential to contract an HAI, but those with weakened or inferior immune systems are at highest risk. Most hospital patients will contract at least one HAI, but many will contract multiple ones. Bacteria are the most common cause of HAIs and contribute to 80–90% of all HAIs, with Staphylococcus aureus, Clostridium difficile, Escherichia coli, Acinetobacter baumannii, Pseudomonas aeruginosa and Klebsiella pneumoniae accounting for the majority. Each of these bacteria are highly resistant to antibiotics and can produce a protective film, known as a biofilm, to further prevent their eradication. It has been shown that by detecting and eradicating bacteria in the environment, infection rates can be reduced. The current methods for detecting bacteria are time consuming, non-specific, and prone to false negatives or false positives. Aptamer-based biosensors have demonstrated specific, time-efficient and simple detection, highlighting the likelihood that they could be used in a similar way to detect HAI-causing bacteria.