Code Inspection Research Articles

A study on an efficient OSS inspection scheme based on encrypted GML

The importance of Open Source Software (OSS) has increased in recent years. OSS is software that is jointly developed and maintained globally through open collaboration and knowledge sharing. OSS plays an important role, especially in the Information Technology (IT) field, by increasing the efficiency of software development and reducing costs. However, licensing issues, security issues, etc., may arise when using OSS. Some services analyze source code and provide OSS-related data to solve these problems, a representative example being Blackduck. Blackduck inspects the entiresource code within the project and provides OSS information and related data included in the whole project. Therefore, there are problems such as inefficiency due to full inspection of the source code and difficulty in determining the exact location where OSS is identified. This paper proposes a scheme to intuitively analyze source code through Graph Modelling Language (GML) conversion to solve these problems. Additionally, encryption is applied to GML to performsecure GML-based OSS inspection. The study explains the process of converting source code to GML and performing OSS inspection. Afterward, we compare the capacity and accuracy of text-based OSS inspection and GML-based OSS inspection. Signcryption is applied to performsafe, GML-based, efficient OSS inspection.

GBSR: Graph-based suspiciousness refinement for improving fault localization

Fault Localization (FL) is an important and time-consuming phase of software debugging. The essence of FL lies in the process of calculating the suspiciousness of different program entities (e.g., statements) and generating a ranking list to guide developers in their code inspection. Nonetheless, a prevalent challenge within existing FL methodologies is the propensity for program entities with analogous execution information to receive a similar suspiciousness. This phenomenon can lead to confusion among developers, thereby reducing the effectiveness of debugging significantly. To alleviate this issue, we introduce fine-grained contextual information (such as partial code structural, coverage, and features from mutation analysis) to enrich the characteristics of program entities. Graphical structures are proposed to organize such information, where the passed and failed tests are constructed separately with the consideration of their differential impacts. In order to support the analysis of multidimensional features and the representation of large-scale programs, the PageRank algorithm is adopted to compute each program entity’s weight. Rather than altering the fundamental FL process, we leverage these computed weights to refine the suspiciousness produced by various FL techniques, thereby providing developers with a more precise and actionable ranking of potential fault locations. The proposed strategy Graph-Based Suspiciousness Refinement (GBSR) is evaluated on 243 real-world faulty programs from the Defects4J. The results demonstrate that GBSR can improve the accuracy of various FL techniques. Specifically, for the refinement with traditional SBFL and MBFL techniques, the number of faults localized by the first position of the ranking list (Top-1) is increased by 189% and 68%, respectively. Furthermore, GBSR can also boost the state-of-the-art learning-based FL technique Grace by achieving a 2.8% performance improvement in Top-1.

Enhancing human-machine pair inspection with risk number and code inspection diagram

Software inspection is a widely-used approach to software quality assurance. Human-Machine Pair Inspection (HMPI) is a novel software inspection technology proposed in our previous work, which is characterized by machine guiding programmers to inspect their own code during programming. While our previous studies have shown the effectiveness of HMPI in telling risky code fragments to the programmer, little attention has been paid to the issue of how the programmer can be effectively guided to carry out inspections. To address this important problem, in this paper we propose to combine Risk Number with Code Inspection Diagram (CID) to provide accurate guidance for the programmer to efficiently carry out inspections of his/her own programs. By following the Code Inspection Diagram, the programmer will inspect every checking item shown in the CID to efficiently determine whether it actually contain bugs. We describe a case study to evaluate the performance of this method by comparing its inspection time and number of detected errors with our previous work. The result shows that the method is likely to guide the programmer to inspect the faulty code earlier and be more efficient in detecting defects than the previous HMPI established based on Cognitive Complexity.

Intelligent patrol inspection of low code enabled electric power communication equipment based on digital transformation

Intelligent patrol inspection of low code enabled electric power communication equipment based on digital transformation

A declarative approach to detecting design patterns from Java execution traces and source code

Design patterns are invaluable for software engineers because they help obtain well-structured and reusable object-oriented software components and contribute towards ease of software comprehension, maintenance, and modification. However, identifying design patterns from an inspection of the source code is not easy because, in most cases, there are no syntactic cues that signal their presence. This topic has therefore elicited considerable interest in the field. The novel aspect of our work is that we propose a set of primitives using which we can declaratively specify design patterns based on a combination of static and dynamic information. Our experimental work is carried out in the context of Java: static information is extracted from Java source code, and dynamic information from an execution trace of a program. Each declarative pattern specification is automatically translated into an SQL query which retrieves all instances of the design pattern present in the program. We illustrate our approach with the well-known Gang-of-Four design patterns and the approach extends to other such design patterns. The experimental results show the efficacy of our approach for representative programs for all GoF patterns in addition to more extensive case studies, JHotDraw, Junit, and QuickUML.

Development of Honey Badger-Cat Swarm Optimisation-Based Parallel Cascaded Deep Network for Software Bug Prediction Framework

Software bug prediction is mainly used for testing and code inspection. So, software bug prediction is carried out by network measures over the decades. But, the classical fault prediction method failed to obtain the semantic difference among various programs. Thus, it degrades the working of the prediction model, which is designed using these aspects. It is necessary to obtain the semantic difference for designing the prediction model accurately and effectively. In a software defect prediction system, it faces many difficulties in identifying the defect modules like correlation, irrelevance aspects, data redundancy, and missing samples or values. Consequently, many researchers are designed to detect software bug prediction that categorises faulty as well as non-faulty modules with software matrices. But, there are only a few works focussed to mitigate the class imbalance problem in bug prediction. In order to overcome the problem, it is required to develop an efficient software bug prediction method with the enhanced classifier. For this experimentation, the input data are taken from the standard online data sources. Initially, the input data undergo pre-processing phase and then, the pre-processed data are provided as input to the feature extraction by utilising the Auto-Encoder. These obtained features are utilised in getting the optimal fused features with the help of a new Hybrid Honey Badger Cat Swarm Algorithm (HHBCSA). Finally, these features are fed as input to the Optimised Parallel Cascaded Deep Network (OPCDP), where the “Extreme Learning Machine (ELM) and Deep Belief Network (DBN)” are used for the prediction of software bugs, in which the parameters from both classifiers are optimised by proposed HHBCSA algorithm. From the investigations, the recommended software bug prediction method offers a quicker bug prediction result, which helps to detect and remove the software bug easily and accurately.

Udon: Efficient Debugging of User-Defined Functions in Big Data Systems with Line-by-Line Control

Many big data systems are written in languages such as C, C++, Java, and Scala to process large amounts of data efficiently, while data analysts often use Python to conduct data wrangling, statistical analysis, and machine learning. User-defined functions (UDFs) are commonly used in these systems to bridge the gap between the two ecosystems. In this paper, we propose Udon, a novel debugger to support fine-grained debugging of UDFs. Udon encapsulates the modern line-by-line debugging primitives, such as the ability to set breakpoints, perform code inspections, and make code modifications while executing a UDF on a single tuple. It includes a novel debug-aware UDF execution model to ensure the responsiveness of the operator during debugging. It utilizes advanced state-transfer techniques to satisfy breakpoint conditions that span across multiple UDFs. It incorporates various optimization techniques to reduce the runtime overhead. We conduct experiments with multiple UDF workloads on various datasets and show its high efficiency and scalability.

Deep learning-based software bug classification

Context:Accurate classification of bugs can help accelerate the bug triage process, code inspection, and repair activities. In this context, many machine learning techniques have been proposed to classify bugs. The expressive power of deep learning could be used to further improve classification. Objective:We propose a novel deep learning-based bug classification approach. Methods:We first build a bug taxonomy with eight bug classes, each characterized by a set of keywords. Subsequently, we heuristically annotate a moderately large set (∼1.36M) of software bug resolution reports using an earth-mover distance technique based on the keywords. Finally, we use four attention-based classification techniques to classify these curated bugs. Results:Our experiments on a carefully collected dataset indicate that our proposed technique achieved a mean F1-Score of 84.78% and a mean macro-average ROC of 98.25%. Conclusion:Our proposed approach was observed to outperform the existing techniques by 16.88% on an average in terms of F1-Score for the considered dataset.

A New Approach to Web Application Security: Utilizing GPT Language Models for Source Code Inspection

Due to the proliferation of large language models (LLMs) and their widespread use in applications such as ChatGPT, there has been a significant increase in interest in AI over the past year. Multiple researchers have raised the question: how will AI be applied and in what areas? Programming, including the generation, interpretation, analysis, and documentation of static program code based on promptsis one of the most promising fields. With the GPT API, we have explored a new aspect of this: static analysis of the source code of front-end applications at the endpoints of the data path. Our focus was the detection of the CWE-653 vulnerability—inadequately isolated sensitive code segments that could lead to unauthorized access or data leakage. This type of vulnerability detection consists of the detection of code segments dealing with sensitive data and the categorization of the isolation and protection levels of those segments that were previously not feasible without human intervention. However, we believed that the interpretive capabilities of GPT models could be explored to create a set of prompts to detect these cases on a file-by-file basis for the applications under study, and the efficiency of the method could pave the way for additional analysis tasks that were previously unavailable for automation. In the introduction to our paper, we characterize in detail the problem space of vulnerability and weakness detection, the challenges of the domain, and the advances that have been achieved in similarly complex areas using GPT or other LLMs. Then, we present our methodology, which includes our classification of sensitive data and protection levels. This is followed by the process of preprocessing, analyzing, and evaluating static code. This was achieved through a series of GPT prompts containing parts of static source code, utilizing few-shot examples and chain-of-thought techniques that detected sensitive code segments and mapped the complex code base into manageable JSON structures.Finally, we present our findings and evaluation of the open source project analysis, comparing the results of the GPT-based pipelines with manual evaluations, highlighting that the field yields a high research value. The results show a vulnerability detection rate for this particular type of model of 88.76%, among others.

Assessment of Regional Nursing Home Preparedness for and Regulatory Responsiveness to Wildfire Risk in the Western US

It is uncertain whether emergency preparedness and regulatory oversight for US nursing homes are aligned with local wildfire risk. To evaluate the likelihood that nursing homes at elevated risk of wildfire exposure meet US Centers for Medicare & Medicaid Services (CMS) emergency preparedness standards and to compare the time to reinspection by exposure status. This cross-sectional study of nursing homes in the continental western US from January 1, 2017, through December 31, 2019, was conducted using cross-sectional and survival analyses. The prevalence of high-risk facilities within 5 km of areas at or exceeding the 85th percentile of nationalized wildfire risk across areas overseen by 4 CMS regional offices (New Mexico, Mountain West, Pacific/Southwest, and Pacific Northwest) was determined. Critical emergency preparedness deficiencies cited during CMS Life Safety Code Inspections were identified. Data analysis was performed from October 10 to December 12, 2022. The primary outcome classified whether facilities were cited for at least 1 critical emergency preparedness deficiency during the observation window. Regionally stratified generalized estimating equations were used to evaluate associations between risk status and the presence and number of deficiencies, adjusted for nursing home characteristics. For the subset of facilities with deficiencies, differences in restricted mean survival time to reinspection were evaluated. Of the 2218 nursing homes in this study, 1219 (55.0%) were exposed to elevated wildfire risk. The Pacific/Southwest had the highest percentage of both exposed (680 of 870 [78.2%]) and unexposed (359 of 486 [73.9%]) facilities with 1 or more deficiencies. The Mountain West had the largest difference in the percentage of exposed (87 of 215 [40.5%]) vs unexposed (47 of 193 [24.4%]) facilities with 1 or more deficiencies. Exposed facilities in the Pacific Northwest had the greatest mean (SD) number of deficiencies (4.3 [5.4]). Exposure was associated with the presence of deficiencies in the Mountain West (odds ratio [OR], 2.12 [95% CI, 1.50-3.01]) and the presence (OR, 1.84 [95% CI, 1.55-2.18]) and number (rate ratio, 1.39 [95% CI, 1.06-1.83]) of deficiencies in the Pacific Northwest. Exposed Mountain West facilities with deficiencies were reinspected later, on average, than unexposed facilities (adjusted restricted mean survival time difference, 91.2 days [95% CI, 30.6-151.8 days]). In this cross-sectional study, regional heterogeneity in nursing home emergency preparedness for and regulatory responsiveness to local wildfire risk was observed. These findings suggest that there may be opportunities to improve the responsiveness of nursing homes to and regulatory oversight of surrounding wildfire risk.

Just-in-Time Defect Prediction for Self-driving Software via a Deep Learning Model

Edge computing is applied to various applications and is typically applied to autonomous driving software. As the self-driving system becomes complicated and the proportion of software increases, accidents caused by software defects increase. Just-in-time (JIT) defect prediction is a technique that identifies defects during the software development phase, which helps developers prioritize code inspection. Many researchers have proposed various JIT models, but it is difficult to find a case in which JIT defect prediction was performed on edge computing applications. In particular, due to the characteristic of self-driving software, which is frequently updated, there is a high risk of inducing defects into the update process. In this work, we propose a JIT defect prediction model via deep learning for edge computing applications called JIT4EA. Our research goal is to develop an effective model to predict defects in edge computing applications. To do this, we perform defect prediction on self-driving software, a representative edge computing application. We use pre-trained unified cross-modal pre-training for code representation (UniXCoder) to embed commit messages and code changes. We use bidirectional-LSTM(Bi-LSTM) for context and semantic learning. As a result of the experiment, it was confirmed that the proposed JIT4EA performed better than state-of-the-art methods and could reduce the code inspection effort.

Large‐scale characterization of Java streams

AbstractJava streams are receiving the attention of developers targeting the Java virtual machine (JVM) as they ease the development of data‐processing logic, while also favoring code extensibility and maintainability through a concise and declarative style based on functional programming. Recent studies aim to shedding light on how Java developers use streams. However, they consider only small sets of applications and mainly apply manual code inspection and static analysis techniques. As a result, the large‐scale dynamic analysis of stream processing remains an open research question. In this article, we present the first large‐scale empirical study on the use of streams in Java code exercised via unit tests. We present stream‐analyzer, a novel dynamic program analysis (DPA) that collects runtime information and key metrics, which enable a fine‐grained characterization of sequential and parallel stream processing. We use a fully automatic approach to massively apply our DPA for the analysis of open‐source software projects hosted on GitHub. Our findings advance the understanding of the use of Java streams. Both the scale of our analysis and the profiling of dynamic information enable us to confirm with more confidence the outcome highlighted at a smaller scale by related work. Moreover, our study reports the popularity of many features of the Stream API and highlights multiple findings about runtime characteristics unique to streams, while also revealing inefficient stream processing and stream misuses. Finally, we present implications of our findings for developers of the Stream API, tool builders and researchers, and educators.

Modern Code Reviews—Survey of Literature and Practice

Background: Modern Code Review (MCR) is a lightweight alternative to traditional code inspections. While secondary studies on MCR exist, it is u a nknown whether the research community has targeted themes that practitioners consider important. Objectives: The objectives are to provide an overview of MCR research, analyze the practitioners’ opinions on the importance of MCR research, investigate the alignment between research and practice, and propose future MCR research avenues. Method: We conducted a systematic mapping study to survey state of the art until and including 2021, employed the Q-Methodology to analyze the practitioners’ perception of the relevance of MCR research, and analyzed the primary studies’ research impact. Results: We analyzed 244 primary studies, resulting in five themes. As a result of the 1,300 survey data points, we found that the respondents are positive about research investigating the impact of MCR on product quality and MCR process properties. In contrast, they are negative about human factor– and support systems–related research. Conclusion: These results indicate a misalignment between the state of the art and the themes deemed important by most survey respondents. Researchers should focus on solutions that can improve the state of MCR practice. We provide an MCR research agenda that can potentially increase the impact of MCR research.

CADV: A software visualization approach for code annotations distribution

Code annotations is a widely used feature in Java systems to configure custom metadata on programming elements. Their increasing presence creates the need for approaches to assess and comprehend their usage and distribution. In this context, software visualization has been studied and researched to improve program comprehension in different aspects. This study aimed at designing a software visualization approach that graphically displays how code annotations are distributed and organized in a software system and developing a tool, as a reference implementation of the approach, to generate views and interact with users. We conducted an empirical evaluation through questionnaires and interviews to evaluate our visualization approach considering four aspects: effectiveness for program comprehension, perceived usefulness, perceived ease of use, and suitability for the intended audience. The resulting data was used to perform a qualitative and quantitative analysis. The tool identifies package responsibilities providing visual information about their annotations at different levels. Using the developed tool, the participants achieved a high correctness rate in the program comprehension tasks and performed very well in questions about the overview of the system under analysis. Finally, participants perceived that the tool outperforms existing approaches for code inspection when searching for information related to code annotations. The results show that the visualization approach using the developed tool is effective in program comprehension tasks related to code annotations, which can also be used to identify responsibilities in the application packages. Moreover, it was evaluated as suitable for newcomers to overview the usage of annotations in the system and for architects to perform a deep analysis that can potentially detect misplaced annotations and abnormal growths on their usage.

Does symmetry preclude the evolution of senescence? A comment on Pen and Flatt 2021

Does symmetry preclude the evolution of senescence? A comment on Pen and Flatt 2021

Association of Nursing Home Exposure to Hurricane-Related Inundation With Emergency Preparedness

Whether US nursing homes are well prepared for exposure to hurricane-related inundation is uncertain. To estimate the prevalence of nursing homes exposed to hurricane-related inundation and evaluate whether exposed facilities are more likely to meet Centers for Medicare & Medicaid Services (CMS) emergency preparedness standards. This cross-sectional study included CMS-certified nursing homes in Coastal Atlantic and Gulf Coast states from January 1, 2017, to December 31, 2019. The prevalence of facilities exposed to at least 2 feet of hurricane-related inundation used models from the National Hurricane Center across coastal areas overseen by 5 CMS regional offices: New England, New York metropolitan area, Mid-Atlantic region, Southeast and Eastern Gulf Coast, and Western Gulf Coast. Critical emergency preparedness deficiencies cited during CMS life safety code inspections were identified. The analysis used generalized estimating equations with binomial and negative binomial distributions to evaluate associations between exposure status and the presence and number of critical emergency preparedness deficiencies. Regionally stratified associations (odds ratios [ORs]) and rate ratios [RRs]) with 95% CIs, adjusted for state-level fixed effects and nursing home characteristics, were reported. Of 5914 nursing homes, 617 (10.4%) were at risk of inundation exposure, and 1763 (29.8%) had a critical emergency preparedness deficiency. Exposed facilities were less likely to be rural, were larger, and had similar CMS health inspection, quality, and staffing ratings compared with unexposed facilities. Exposure was positively associated with the presence and number of emergency preparedness deficiencies for the nursing homes within the Mid-Atlantic region (adjusted OR, 1.91 [95% CI, 1.15-3.20]; adjusted RR, 2.51 [95% CI, 1.41-4.47]). Conversely, exposure was negatively associated with the number of emergency preparedness deficiencies among facilities within the Western Gulf Coast (aRR, 0.55 [95% CI, 0.36-0.86]). The associations for the number of emergency preparedness deficiencies remained after correction for multiple comparisons. The findings of this cross-sectional study suggest that the association between exposure to hurricane-related inundation and nursing home emergency preparedness differs considerably across the Coastal Atlantic and Gulf regulatory regions. These findings further suggest that there may be opportunities to reduce regional heterogeneity and improve the alignment of nursing home emergency preparedness with surrounding environmental risks.

DeepLineDP: Towards a Deep Learning Approach for Line-Level Defect Prediction

Defect prediction is proposed to assist practitioners effectively prioritize limited Software Quality Assurance (SQA) resources on the most risky files that are likely to have post-release software defects. However, there exist two main limitations in prior studies: (1) the granularity levels of defect predictions are still coarse-grained and (2) the surrounding tokens and surrounding lines have not yet been fully utilized. In this paper, we perform a survey study to better understand how practitioners perform code inspection in modern code review process, and their perception on a line-level defect prediction. According to the responses from 36 practitioners, we found that 50% of them spent at least 10 minutes to more than one hour to review a single file, while 64% of them still perceived that code inspection activity is challenging to extremely challenging. In addition, 64% of the respondents perceived that a line-level defect prediction tool would potentially be helpful in identifying defective lines. Motivated by the practitioners’ perspective, we present DeepLineDP, a deep learning approach to automatically learn the semantic properties of the surrounding tokens and lines in order to identify defective files and defective lines. Through a case study of 32 releases of 9 software projects, we find that the risk score of code tokens varies greatly depending on their location. Our DeepLineDP is 17%-37% more accurate than other file-level defect prediction approaches; is 47%-250% more cost-effective than other line-level defect prediction approaches; and achieves a reasonable performance when transferred to other software projects. These findings confirm that the surrounding tokens and surrounding lines should be considered to identify the fine-grained locations of defective files (i.e., defective lines).

What, why and when to go virtual: An international analysis of early adopters of virtual building energy codes inspections

To meet greenhouse gas reduction targets, several countries are pursuing more ambitious policies in their buildings and construction sectors, such as introducing zero net energy/carbon building codes. Countries often report not having enough qualified staff for performing building energy code inspections and many are exploring faster, easier, and more reliable methods to check the compliance of buildings with their codes. Building inspections are a critical element for ensuring code compliance and they have traditionally been performed in person. However, in-person inspections can be labor and travel intensive, costly, and prone to human error. In this paper, the authors explore how virtual inspections, particularly in light of the recent COVID-19 pandemic, have impacted processes for building code compliance checks in jurisdictions and communities around the world. The authors collected data on four key parameters (time and financial savings, scope of inspections, changing practices and technological innovation, and benefits to consumers) from six jurisdictions and communities in five countries (Australia, Canada, Singapore, United Arab Emirates, and the United States) to analyze the impacts of virtual inspections on code compliance checks. The analysis found the greatest value from virtual inspections in geographically dispersed regions and for cities experiencing rapid building construction. The study also explored emerging technologies that are being piloted for virtual inspections. Although many of these technologies hold promise, more resources and capacity are needed to make them viable for use in building energy code inspections.

Static Analysis for Ada, C/C++ and Python

Spazio IT has been working on the Independent Software Verification and Validation of several codebases, some written in Ada, others in C/C++ and more recently also in Python; in all cases Spazio IT has used static analysis techniques and tools facilitating code inspection. Static analysis has always proven to be beneficial, but depending on the programming language, its advantages have emerged in different areas and namely: metrics and structural analysis for Ada, bugs finding at execution/semantic level for C/C++ and errors finding at compilation/syntactical level for Python. The paper presents first some general considerations on static analysis, then it concentrates on static analysis specifically applied to Ada, C/C++ and Python codebases. Finally, the paper describes Spazio IT future activities in the area of static analysis.

An exploratory study of bug prediction at the method level

During the past decades, researchers have proposed numerous studies to predict bugs at different granularity levels, such as the file level, package level, module level, etc. However, the prediction models at the method level are rarely investigated. In this paper, we investigate to predict bug-prone methods based on method-level code metrics or history measures, and analyze the prediction importance of each metric. To proceed our study, we first propose a series of code metrics and history measures for conducting method-level bug predictions. Next, we compare the performance of different types of prediction models. Finally, we conduct analyses about the prediction power of each metric, based on which, we further analyze whether we can simplify the prediction models. Through our evaluation on eighteen large-scale projects, we have presented: (1) conducting method-level bug prediction has potentials of saving a large portion of effort on code reviews and inspections; (2) models using the proposed code metrics or history measures could achieve a good prediction performance; (3) the prediction importance of each metric distributes differently; (4) a highly simplified prediction model could be derived by just using a few important metrics. This study presents how to systematically build models for predicting bug-prone methods, and provides empirical evidence for developers to best select metrics to build method-level bug prediction models.