Code Analysis Research Articles

Automated Code Review Tool

As software development undergoes continual evolution, the assurance of code quality remains paramount in the development lifecycle. This research paper introduces an innovative Automated Code Review Tool engineered to augment and streamline the code review process. The tool capitalizes on advanced static code analysis, machine learning algorithms, and industry best practices to automate the detection of code quality issues, security vulnerabilities, and compliance with coding standards. The Automated Code Review Tool addresses the inherent challenges of manual code reviews, including human error, time constraints, and inconsistencies. Through automation, developers can expedite the identification and resolution of potential issues, thereby enhancing overall code quality and software reliability. Key features of the tool encompass intelligent pattern recognition, real-time feedback, and customizable rule sets, enabling development teams to tailor the tool to their project-specific requirements. Leveraging machine learning algorithms facilitates the tool's continuous learning from past reviews, thereby adapting to evolving coding practices and emerging security threats. This paper presents the architectural framework and design principles underpinning the Automated Code Review Tool, emphasizing its capacity to foster collaboration among development teams, reduce time-to-market, and ultimately contribute to the development of more robust and secure software. A comprehensive evaluation of the tool's efficacy across diverse development environments is conducted, offering insights into the practical implications of embracing automated solutions in real-world contexts. Keywords: Automated Code Review Tool, Code quality, Static code analysis, Machine learning algorithms, Coding standards, Manual code reviews, Human error, Time constraints, etc.

Boneh-Shaw fingerprint code and Tardos code analysis and optimization in minority collusion attack

Fingerprint codes are required to protect digital rights. These codes were embedded in digital media before distribution. Each of these digital media codes is unique. These codes identify pirated digital media copies. This method is used to identify the creator of an illegal copy. But such principles tend to be collectively attacked. In the Collusion Attack, criminal users conspired to integrate the attacks into these codes.Criminal users devise and switch digital fingerprint media with different codes to print the same content. The code is modified to accuse the innocent user. Thus, this attack is a threat to the protection of digital rights.The minority collusion assault being conducted against the Boneh-Shaw and Tardos codes to assess how serious this threat is can be used to demonstrate the significance of the research. Understanding these ideas is essential for improving the protection of digital rights in the face of changing security issues in the digital sphere. This study launches a minority collusion attack against both the Tardos code and the Boneh-Shaw fingerprint code to analyze the impact. The development of more resilient, adaptable codes to prevent changing collusion strategy is part of the prospective focus for Boneh-Shaw Fingerprint Code and Tardos Code Analysis and Optimization in Minority Collusion Attacks.

Code search engines for the next generation

Given the abundance of software in open source repositories, code search engines are increasingly turning to “big data” technologies such as natural language processing and machine learning, to deliver more useful search results. However, like the syntax-based approaches traditionally used to analyze and compare code in the first generation of code search engines, big data technologies are essentially static analysis processes. When dynamic properties of software, such as run-time behavior (i.e., semantics) and performance, are among the search criteria, the exclusive use of static algorithms has a significant negative impact on the precision and recall of the search results as well as other key usability factors such as ranking quality. Therefore, to address these weaknesses and provide a more reliable and usable service, the next generation of code search engines needs to complement static code analysis techniques with equally large-scale, dynamic analysis techniques based on its execution and observation. In this paper we describe a new software platform specifically developed to achieve this by simplifying and largely automating the dynamic analysis (i.e., observation) of code at a large scale. We show how this platform can combine dynamically observed properties of code modules with static properties to improve the quality and usability of code search results.

The Code Analysis of ‘Post-Apocalyptic Era’ Movies: Take Mad Max: Fury Road as an Example

In the 88th Academy Awards, directed by George Miller, a "wasteland" theme film "Mad Max 4: Fury Road" is the world's most recognized female theme film. 50% of film history is one of the films in the explosive stage. After it won the Oscar six awards, it has become a "wasteland" theme film's new benchmark. Through semiotics and the Bible, this paper deconstructs the image codes in movies. Based on the symbolic interactionism theory, this paper analyses the character behaviour, identity construction and prop application in the Christian symbol system and combs and deconstructs it, trying to explore the symbolic metaphors in movies and reflect on the artistic value and ideological connotation contained in movies.

Analysis Testing Black Box and White Box on Application To-Do List Based Web

The rapid development of information technology has led to the creation of numerous web-based applications designed to assist human activities and work. One such application is the To-Do List, which helps users manage their tasks and increase productivity. This study aims to analyze the quality of web-based To-Do List applications through black box and white box testing. The research focuses on the login and main pages of the application, where various scenarios are tested to ensure that the system functions as intended. The testing process includes designing test scenarios, creating test cases, executing the test cases, and collecting and processing test result data. The study also includes an analysis of the program's source code using flowcharts and flowgraphs to identify the number of independent logic execution paths and design test cases for white box testing. The results of the testing will help identify errors and weaknesses in the application, ensuring that the final product is of high quality.

Individuals in Securitization: Explaining US Presidents’ Choice to (De)Securitize North Korea

Abstract Securitization and desecuritization demonstrate how threat (de)constructions can lead to conflictual or cooperative foreign policies. However, due to its focus on collectivities, securitization theory cannot tell us why leaders choose either securitization or desecuritization. Understanding this choice is crucial because (de)securitization processes can prescribe possible foreign policy options and thus affect the likelihood of conflict and cooperation. To account for leaders’ choices, I draw on political psychology and demonstrate the utility of my approach through an explanation of two US presidents’ preferences for (de)securitizing North Korea. Using leadership trait and operational code analysis, I show that psychological variables shaped Bill Clinton’s and George W. Bush’s preferences because they affected their threat perception and inclination toward conflictual or cooperative actions. These preferences had substantial consequences: While Clinton’s desecuritization attempt led to improvements in US–North Korean relations, Bush’s effort to resecuritize North Korea effectively reversed this progress.

From static code analysis to visual models of microservice architecture

From static code analysis to visual models of microservice architecture

A study on the integrity and behavior of nuclear fuel in temporary storage

Due to the saturation of spent fuel pools of nuclear power plant in Korea, spent fuel will be stored in dry casks for a considerable period. Since spent fuel must withstand continuous decay heat, radiation, and high internal pressure of the fuel rod in the cask, behavior of spent nuclear fuel is needed to be reviewed.It is very important to evaluate the behavior of nuclear fuel with realistic modeling. In this study, the behavior of spent nuclear fuel after being burned in a reactor for three cycles and subsequently cooled in a spent fuel pool was analyzed by FALCON-1.5.0 which is a computational code for mechanical and thermal analysis of nuclear fuel. For code analysis, three burnup levels of 42,000 MWD/MTU, 50,000 MWD/MTU, and 58,000 MWD/MTU were considered. The hoop stress, strain, and other parameters were analyzed for each burnup level. Furthermore, the cooling periods in the spent fuel pool are set to 5, 10, 15, and 30 years, allowing for an evaluation of nuclear fuel behavior consistent with the burnup levels. Additionally, nuclear fuel behavior with normal and high thickness of oxidation is reviewed as well.The behavior of various nuclear fuels during the temporary storage period is studied with FALCON and the factors affecting the integrity of nuclear fuel are analyzed for up to 50 years of the temporary storage. This evaluation will contribute to demonstrating the safe storage of nuclear fuel in dry storage.

The Idea of an Integration Interface for Model-based Software Development's Processor-in-the-Loop (PiL) Simulation

Model-based design (MBD) has become a cornerstone in the development of embedded software, particularly in the automotive industry. Processor-in-the- Loop (PiL) simulation bridges the gap between virtual simulation environments and real hardware, enabling early verification and validation of control algorithms running on target processors. The design and implementation of toolchain is required for target specific code generation, compilation, and execution. Developing a toolchain specifically for the target architecture is crucial to preventing errors and ensuring smooth production. The configuration and designing of toolchain are one time effort of all Simulink model which want to be test on board. This research investigates the importance of PiL for embedded systems in the automobile area. It describes the construction of a toolchain that integrates PiL simulation with Simulink, a popular MBD tool. The paper discusses the unique integration of TRACE32, a debugger and code analysis tool, with Simulink for testing programmes on Infineon devices. TPT makes use of graphical test models that are easy to understand and have the capacity to automate complex closed loop tests in real time. It was Daimler Software Technology Research that initially developed TPT. Nowadays, vendors and automakers employ it in their development projects for production vehicles.

Methods for analyzing the impact of software changes on objective functions and safety functions

Objectives. This paper examines the various approaches to analyzing the impact of software changes, and suggests a new method using function control flows. Impact analysis of software change can require the investment of a lot of time and competence on the part of the expert conducting it. There is no detailed description of methodology for analyzing the impact of changes and it is not established at a legislative level. The proposed method has three aims: reducing the level of requirements for an expert when conducting software research; localizing code areas to establish defects in information protection functions; and reducing the time spent on analyzing the impact of changes.Methods. The study analyzes the common methods for analyzing software changes with a description of their positive and negative sides. The possibility of analyzing changes in the control flow of software functions is considered as an alternative to line-by-line comparison of the full volume of source codes. Represented as tree-shaped graphs, the control flows of different versions of the same software are subject to a merging procedure. The final result is analyzed by an expert from the research organization.Results. The research results of the software change analysis methods are presented with a description of their disadvantages. A description is given of the method for change analysis using function control. This complements existing methods, while eliminating their disadvantages. The study also analyzes the possibility of using this method beyond the tasks defined in the introduction.Conclusions. The use of methods to localize the most vulnerable code sections is considered one of the most promising areas for analyzing change impact. In addition to searching for vulnerable code sections, it is important to evaluate the effectiveness of the control flow comparison method in the analysis of source code when transferred to another code base.

DEVELOPMENT OF SYSTEM SOFTWARE BASED ON THE CHATGPT CHAT-BOT

The article discusses the main aspects of system software development, namely writing program code for a simple device driver using the ChatGPT chat bot. The introduction outlines the main difficulties (hardware, software, complexity of debugging and testing, and security issues) that developers may encounter during driver development, as well as ways to possibly solve them: for example, by increasing the level of their theoretical knowledge or using modern tools, such as neural networks. The main part of the article reviews existing research in the field of system software development and testing. Existing software development tools are reviewed: such as development environments, tools for debugging, profiling, testing and static analysis of program code, as well as solutions in the field of version control and collaboration. A comparative table is provided showing the pros and cons of developing device drivers for Windows and Linux operating systems. The stages of the process of generating driver program code for a computer mouse using the ChatGPT chat bot are described. Conventionally, the article identifies five main stages: preparing training data, training, creating a query, generating and repeating stages in case of an unsatisfactory result. Examples of generated program code for a computer mouse driver for Windows and Linux operating systems are provided. In conclusion, conclusions are given regarding further prospects for using the ChatGPT chatbot in system software development tasks.

An Automated Performance Enhancement Approach for Mobile Applications

In the rapidly evolving landscape of mobile applications, the demand for high-quality, performance-driven software is paramount. However, the swift pace of development often leads to the introduction of code smells—bad programming practices that compromise both code quality and application performance. These code smells, if left unaddressed, can result in increased memory consumption, energy consumption, and CPU utilization, ultimately leading to a suboptimal user experience. This paper presents an automated approach for the detection and refactoring of code smells in Android applications, with a focus on improving performance. The proposed approach involves the development of a plugin integrated with Android Studio, which employs static code analysis to identify code smells. The plugin encompasses a customizable rule-based framework that allows for the detection of various code smells unique to Android development. To validate the approach, a comprehensive experiment is conducted. The experiment assesses the effectiveness of the proposed method in detecting code smells and explores the impact of refactoring on application performance. The results showcase that the proposed plugin successfully detects code smells in various open-source Android applications. Moreover, the integration of refactoring recommendations significantly improves the performance of the applications, as demonstrated through memory, energy, and CPU consumption metrics. Comparison with existing tools reveals that the proposed approach offers superior performance in terms of both code smell detection and refactoring. Additionally, the approach bridges the gap left by some existing tools by identifying previously undetected code smells, such as "string concatenation." The presented method not only enhances code quality but also contributes to the overall performance optimization of Android applications. As mobile applications continue to play an increasingly central role in modern life, the importance of maintaining high-quality code that performs optimally cannot be understated. This work provides a valuable contribution towards achieving these goals, offering developers a powerful tool for ensuring that their applications not only meet but exceed user expectations in terms of quality and performance.

Dead or alive: Discovering server HTTP endpoints in both reachable and dead client-side code

Discovering server HTTP endpoints – essentially, enumerating the server’s attack surface – is an important step of every black-box web security scanner. One of the main methods of doing that is inferring server endpoints from the client side, determining what HTTP requests can be sent from client to server. This is trivial for requests triggered by HTML markup elements, such as links and forms, but is much harder for requests sent by JavaScript. Existing approaches to determining requests sent from JavaScript are based on a technique known as dynamic crawling - automated interaction with user interface elements using a headless browser. Dynamic crawling fails when the code that sends a request is impossible or very difficult to trigger with interface interaction. We propose a different approach for finding HTTP requests sent by JS code, which uses static code analysis. While analyzing JavaScript statically is known to be hard and applying existing analyzers to real-world web pages usually does not work, we propose a new lightweight analysis algorithm that can work on pages of real websites and can discover server endpoints that dynamic crawlers cannot. Evaluation results show that augmenting a black-box scanner with the proposed static analysis may significantly improve server-side endpoint coverage.

Actionable code smell identification with fusion learning of metrics and semantics

Code smell detection is one of the essential tasks in the field of software engineering. Identifying whether a code snippet has a code smell is subjective and varies by programming language, developer, and development method. Moreover, developers tend to focus on code smells that have a real impact on development and ignore insignificant ones. However, existing static code analysis tools and code smell detection approaches exhibit a high false positive rate in detecting code smells, which makes insignificant smells drown out those smells that developers value. Therefore, accurately reporting those actionable code smells that developers tend to spend energy on refactoring can prevent developers from getting lost in the sea of smells and improve refactoring efficiency. In this paper, we aim to detect actionable code smells that developers tend to refactor. Specifically, we first collect actionable and non-actionable code smells from projects with numerous historical versions to construct our datasets. Then, we propose a dual-stream model for fusion learning of code metrics and code semantics to detect actionable code smells. On the one hand, code metrics quantify the code's structure and even some rules or patterns, providing fundamental information for detecting code smells. On the other hand, code semantics encompass information about developers' refactoring tendencies, which prove valuable in detecting actionable code smells. Extensive experiments show that our approach can detect actionable code smells more accurately compared to existing approaches.

Evaluation of Large Language Models on Code Obfuscation (Student Abstract)

Obfuscation intends to decrease interpretability of code and identification of code behavior. Large Language Models(LLMs) have been proposed for code synthesis and code analysis. This paper attempts to understand how well LLMs can analyse code and identify code behavior. Specifically, this paper systematically evaluates several LLMs’ capabilities to detect obfuscated code and identify behavior across a variety of obfuscation techniques with varying levels of complexity. LLMs proved to be better at detecting obfuscations that changed identifiers, even to misleading ones, compared to obfuscations involving code insertions (unused variables, as well as variables that replace constants with expressions that evaluate to those constants). Hardest to detect were obfuscations that layered multiple simple transformations. For these, only 20-40% of the LLMs’ responses were correct. Adding misleading documentation was also successful in misleading LLMs. We provide all our code to replicate results at https://github.com/SwindleA/LLMCodeObfuscation. Overall, our results suggest a gap in LLMs’ ability to understand code.

Bridging the Gap between Source Code and Requirements Using GPT (Student Abstract)

Reverse engineering involves analyzing the design, architecture, and functionality of systems, and is crucial for legacy systems. Legacy systems are outdated software systems that are still in use and often lack proper documentation, which makes their maintenance and evolution challenging. To address this, we introduce SC2Req, utilizing the Generative Pre-trained Transformer (GPT) for automated code analysis and requirement generation. This approach aims to convert source code into understandable requirements and bridge the gap between those two. Through experiments on diverse software projects, SC2Req shows the potential to enhance the accuracy and efficiency of the translation process. This approach not only facilitates faster software development and easier maintenance of legacy systems but also lays a strong foundation for future research, promoting better understanding and communication in software development.

Can You Give Me a Lift?

Static Analysis (SA) is the practice of examining computer program source code for errors or vulnerabilities outside the compiler’s capabilities. To carry out Static Analysis on computer programs, various tools exist that parse and examine each line for known issues. These tools do not compile the program, nor do they run the program. Instead, they analyse the source code directly and infer properties about the program without executing it - thus “static” analysis. Static analysis is not new. Early UNIX contained a program called “lint” for static analysis; a tool that has now existed since the late 1970s (Johnson 1978). Increasingly, however, modern static analysis practices indicate a more focused intent; find cybersecurity weaknesses. At the 22nd European Conference on Cyber Warfare and Security, the authors presented the background of Intermediate Representations (IRs) and described how this “middleware” representation can be utilized for static analysis of source code for cybersecurity weaknesses. By examining an IR, potential flaws in the source code can be located. When utilizing the IR as opposed to the original high-level language, the static analysis process becomes independent of the original source language; if several languages such as C, Rust, and others all compile into the same IR, static analysis of the IR allows the analysis process to no longer be tied to the high-level language grammar or syntax. The previous paper implemented a literature survey of available IR analysis tools to discover prior work; the authors have subsequently advanced the research and are actively using an IR framework, LLVM, for vulnerability analysis. In this research, source code in a high-level language is first compiled to LLVM and the resulting IR is used for analysis. This approach uses a “code-to-IR” SA analysis preparation paradigm. At the same time, there is the potential for binary “lifters” to be used. These tools “lift” an executable program – binary machine instructions – back to LLVM. In this way, the paradigm can also be reversed such that static analysis of LLVM can be performed on source code compiled into LLVM, or on executable programs in the field that are “lifted”. This begs: how effective are these “lifters”? In this work, the authors present experiences in installation and operation of several binary “lifters” available as open-source projects. Some are supported better than others, some operate better than others, and some don’t operate at all. Those that do lead to the follow-up: Is the “lifted” code suitable for static analysis, or is it too obfuscated relative to the original program? This paper describes just that – our efforts and results in locating a binary “lifter” suitable for bringing executable program test cases back to LLVM for analysis by the cybersecurity vulnerability tool concurrently under development.

MAAP code analysis for the in-vessel phase of Fukushima-Daiichi Nuclear Power Station Unit 1 and comparison of the results among Units 1 to 3

The accident progression of the in-vessel phase of Fukushima Daiichi Nuclear Power Station Unit 1 was analyzed using the MAAP code. Although there is a large uncertainty in the initial stage of accident progression behavior in Unit 1 with little measurement data, it is presumed to have similarities to that of Unit 3. As a result, in Unit 1, since there was almost no alternative water injection during the in-vessel phase, cooling of the debris transferred to the lower plenum was small. It was likely that a large molten pool of metals had formed, and that the steam supply to the high-temperature core materials was suppressed and metal oxidation was relatively small. The analysis results for Unit 1 were compared with those for Units 2 and 3, and differences between units such as the thermal conditions of the debris that relocated to the pedestal and the degree of metal oxidation were shown.

The role of operational code and the Cyprus negotiations: the case of Derviş Eroğlu as the Turkish Cypriot leader

ABSTRACT This study aims to contribute to the literature on the Cyprus negotiations at the individual level and to identify the political-psychological factors underlying the negotiations through operational code analysis. Moreover, it also aims to analyze the role of operational code in intercommunal negotiations at the macro-function level. Using the Verbs In Context System (VICS) method, a quantitative variant of the operational code approach, this study examines President Eroğlu’s verbs in his public statements between 2010 and 2015 when he was in office and measures his political beliefs in the context of the Cyprus negotiations. It then discusses the macro-functionality of his operational code, especially at the domestic level. The external dimension of the operational code of Eroğlu related to his beliefs about the other was identified as ‘conflicting,’ but the internal dimension related to his beliefs about himself as ‘somewhat cooperative.’ In terms of macro-functionality, it was reported that Eroğlu’s operational code was far from serving the federal vision in intercommunal talks. Besides, it was concluded that his overall operational code contributed to the reproduction of the status quo and related nationalist and ethicist dominant identities in both the north and south of Cyprus.

Exploring ChatGPT’s code refactoring capabilities: An empirical study

ChatGPT has shown great potential in the field of software engineering with its ability to generate code. Yet, ChatGPT’s ability to interpret code has been deemed unreliable and faulty, which causes concern for the platform’s ability to properly refactor code. To confront this concern, we carried out a study to assess ChatGPT’s abilities and limitations in refactoring code. We divided the study into three parts: if ChatGPT can refactor the code, if the refactored code preserves the behavior of the original code segments, and if ChatGPT is capable of providing documentation for the refactored code to provide insights into intent, instructions, and impact. We focused our research specifically on eight quality attributes to use when prompting ChatGPT to refactor our dataset of 40 Java code segments. After collecting the refactored code segments from ChatGPT, as well as data on whether the behavior was preserved, we ran the refactored code through PMD, a source code analyzer, to find programming flaws. We also tested ChatGPT’s accuracy in generating documentation for the refactored code and analyzed the difference between the results of each quality attribute. We conclude that ChatGPT can provide many useful refactoring changes that can improve the code quality which is crucial. ChatGPT offered improved versions of the provided code segments 39 out of 40 times even if it is as simple as suggesting clearer names for variables or better formatting. ChatGPT was able to recommend numerous options ranging from minor changes such as renaming methods and variables to major changes such as modifying the data structure. ChatGPT’s strengths and accuracy were in suggesting minor changes because it had difficulty addressing and understanding complex errors and operations. Although most of the changes were minor, they made significant improvements because converting loops, simplifying calculations, and removing redundant statements have a crucial effect on runtime, memory, and readability. However, our results also indicate how ChatGPT can be unpredictable in its responses which threatens the reliability of ChatGPT. Asking ChatGPT the same prompt often yields different results, so some outputs were more accurate than others. This makes it difficult to fully access ChatGPT’s capabilities due to its variation and inconsistency. Due to ChatGPT’s limitations of its reliance on its data set, it lacks understanding of the broader context so it may occasionally make errors and suggest alternations that are neither applicable nor necessary. Overall, ChatGPT has proved to be a beneficial tool for programming as it is capable of providing advantageous suggestions, even if it is on a small scale. However, human programmers are still needed to oversee these changes and determine their significance. ChatGPT should be used as an aid to programmers since we cannot completely depend on it yet.