Large-scale Codebase Research Articles

A Transformer-based approach to highly granular source code authorship attribution

Traditional source code authorship identification methods often rely on features such as textual similarity, programming style or metadata, however, these methods often struggle to extract the precise source code authoring style when dealing with large-scale code bases or complex programming patterns, resulting in poor performance. Therefore, this paper proposes a Transformer-based high fine-grained source code author attribution method.Aiming at the problem of roughness of existing literature on word segmentation, this paper proposes a high fine-grained source code segmentation method to extract higher fine-grained features. Aiming at the problem of feature dimension redundancy, this paper adopts the Transformer network to locate sensitive features that can characterise the author's style.To verify the effectiveness of the model, it was tested on GCJ-C++ and GCJ-Java datasets. The experimental results show that the proposed method model achieves higher recognition accuracy in the source code authorship attribution problem compared to the traditional methods.

A Transformer-based approach to highly granular source code authorship attribution

Traditional source code authorship identification methods often rely on features such as textual similarity, programming style or metadata, however, these methods often struggle to extract the precise source code authoring style when dealing with large-scale code bases or complex programming patterns, resulting in poor performance. Therefore, this paper proposes a Transformer-based high fine-grained source code author attribution method.Aiming at the problem of roughness of existing literature on word segmentation, this paper proposes a high fine-grained source code segmentation method to extract higher fine-grained features. Aiming at the problem of feature dimension redundancy, this paper adopts the Transformer network to locate sensitive features that can characterise the author's style.To verify the effectiveness of the model, it was tested on GCJ-C++ and GCJ-Java datasets. The experimental results show that the proposed method model achieves higher recognition accuracy in the source code authorship attribution problem compared to the traditional methods.

Context and Multi-Features-Based Vulnerability Detection: A Vulnerability Detection Frame Based on Context Slicing and Multi-Features.

With the increasing use of open-source libraries and secondary development, software projects face security vulnerabilities. Existing studies on source code vulnerability detection rely on natural language processing techniques, but they overlook the intricate dependencies in programming languages. To address this, we propose a framework called Context and Multi-Features-based Vulnerability Detection (CMFVD). CMFVD integrates source code graphs and textual sequences, using a novel slicing method called Context Slicing to capture contextual information. The framework combines graph convolutional networks (GCNs) and bidirectional gated recurrent units (BGRUs) with attention mechanisms to extract local semantic and syntactic information. Experimental results on Software Assurance Reference Datasets (SARDs) demonstrate CMFVD's effectiveness, achieving the highest F1-score of 0.986 and outperforming other models. CMFVD offers a promising approach to identifying and rectifying security flaws in large-scale codebases.

Query-oriented two-stage attention-based model for code search

Applying code search models to search through a large-scale codebase can significantly contribute to developers finding and reusing existing code. Researchers have applied deep learning (DL) techniques to code search models, which first compute deeper semantics representation for query and candidate code snippets, and then rank code snippets. However, these models do not well deeply analyze the semantics gap (i.e., the difference and correlation between queries written in natural language and code in programming languages), or suitably apply the correlation to the code search task. Moreover, most DL-based models use complex networks, slowing down code search tasks.To build the correlation of two languages, and apply the correlation well to code search task, we propose a query-oriented code search model named QobCS. QobCS leverage two attention-based stages, which are simple and quick, and the cooperation of the two stages bridges the semantic gap between code and query. Stage1 learns deeper semantics representation for code and query. Stage2 applies their deeper semantic correlation and query’s intention to learn better code representation.We evaluated QobCS on two datasets. On dataset1/dataset2 with 485k/542k code snippets, QobCS achieves the MRRs of 0.701/0.595, outperforming DL-based code search models DeepCS, CARLCS-CNN, UNIF, and our prior study TabCS. For efficiency, our model shows desirable performances on both datasets compared to DL-based models.

Code semantic enrichment for deep code search

Code search aims to retrieve code snippets from a large-scale codebase, where the semantics of the searched code match developers’ query intent. Code is a low-level implementation of programming intents, but query is always expressed as clear and high-level semantics, which makes it difficult for DL-based approaches to learn the semantic relationship between them. Through a large-scale empirical analysis on more than 2.2 million pairs of Java code and description, we found that the semantics of code and query can be aligned by enriching code with the descriptions of other code in terms of similar implementation. Based on the finding, we propose a code semantic enrichment approach for deep code search, named SemEnr. Specifically, we first enrich semantics for all code snippets in the training and testing data. We estimated the syntactic similarity of each code snippet from the training data and retrieved the most similar one for each. Thereafter, the semantics of one code snippet is represented by its code tokens and the description of the retrieved most similar code. During the model training, we used the attention mechanism to embed pairs of enriched code and query into the shared high-dimensional vector space. To enhance the quality of our learned representations, we integrated a multi-perspective co-attention mechanism, employing Convolutional Neural Networks (CNNs) to capture local correlations between code and query. Finally, we evaluated the effectiveness of our approach by performing experiments on two extensively used Java datasets. Our experimental results reveal that SemEnr achieves an MRR of 0.698 and 0.631, outperforming the best baseline CAT (a state-of-the-art DL-based model) by 19.93% and 18.83%, respectively. In addition, we conducted a user study involving 50 real-world queries to assess SemEnr’s performance, and the findings suggest that SemEnr outperformed baseline models by returning more relevant code snippets.

Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases

Enterprise environment often screens large-scale (millions of lines of code) codebases with static analysis tools to find bugs and vulnerabilities. Parfait is a static code analysis tool used in Oracle to find security vulnerabilities in industrial codebases. Recently, many studies show that there are complicated cryptographic vulnerabilities caused by misusing cryptographic APIs in Java TM 1 In this paper, we describe how we realize a precise and scalable detection of these complicated cryptographic vulnerabilities based on Parfait framework. The key challenge in the detection of cryptographic vulnerabilities is the high false alarm rate caused by pseudo-influences. Pseudo-influences happen if security-irrelevant constants are used in constructing security-critical values. Static analysis is usually unable to distinguish them from hard-coded constants that expose sensitive information. We tackle this problem by specializing the backward dataflow analysis used in Parfait with refinement insights, an idea from the tool CryptoGuard [ 20 ]. We evaluate our analyzer on a comprehensive Java cryptographic vulnerability benchmark and eleven large real-world applications. The results show that the Parfait-based cryptographic vulnerability detector can find real-world cryptographic vulnerabilities in large-scale codebases with high true-positive rates and low runtime cost.

CRAM: Code Recommendation With Programming Context Based on Self-Attention Mechanism

Code recommendation with programming context is to use the contextual code surrounding the missing code to automatically find that which of the code snippets would be useful to assist in the completion of the program. In this way, the developers need not take time to formulate explicit queries or write descriptions. Existing work only treats code as textual documents and use information retrieval techniques to retrieve relevant code snippets, which is difficult to capture the semantics of code adequately. The self-attention mechanism have achieved promising progress in various natural language processing tasks, especially for extracting deep semantic information from long sequences. Inspired from this, we propose a novel code recommendation with programming context based on self-attention mechanism (CRAM). The proposed approach first builds a small-scale candidate set from codebase. Then, it utilizes self-attention networks in the abstract syntax tree to capture the deep semantics of code, and finally recommend the relevant code to developers. We conduct several experiments to evaluate our approach in a large-scale codebase containing 741 148 code snippets. The experimental results show that CRAM can effectively recommend code and outperforms related work in recall, precision, and NDCG.

Opportunities and Challenges in Code Search Tools

Code search is a core software engineering task. Effective code search tools can help developers substantially improve their software development efficiency and effectiveness. In recent years, many code search studies have leveraged different techniques, such as deep learning and information retrieval approaches, to retrieve expected code from a large-scale codebase. However, there is a lack of a comprehensive comparative summary of existing code search approaches. To understand the research trends in existing code search studies, we systematically reviewed 81 relevant studies. We investigated the publication trends of code search studies, analyzed key components, such as codebase, query, and modeling technique used to build code search tools, and classified existing tools into focusing on supporting seven different search tasks. Based on our findings, we identified a set of outstanding challenges in existing studies and a research roadmap for future code search research.

CodeMatcher: Searching Code Based on Sequential Semantics of Important Query Words

To accelerate software development, developers frequently search and reuse existing code snippets from a large-scale codebase, e.g., GitHub. Over the years, researchers proposed many information retrieval (IR)-based models for code search, but they fail to connect the semantic gap between query and code. An early successful deep learning (DL)-based model DeepCS solved this issue by learning the relationship between pairs of code methods and corresponding natural language descriptions. Two major advantages of DeepCS are the capability of understanding irrelevant/noisy keywords and capturing sequential relationships between words in query and code. In this article, we proposed an IR-based model CodeMatcher that inherits the advantages of DeepCS (i.e., the capability of understanding the sequential semantics in important query words), while it can leverage the indexing technique in the IR-based model to accelerate the search response time substantially. CodeMatcher first collects metadata for query words to identify irrelevant/noisy ones, then iteratively performs fuzzy search with important query words on the codebase that is indexed by the Elasticsearch tool and finally reranks a set of returned candidate code according to how the tokens in the candidate code snippet sequentially matched the important words in a query. We verified its effectiveness on a large-scale codebase with ~41K repositories. Experimental results showed that CodeMatcher achieves an MRR (a widely used accuracy measure for code search) of 0.60, outperforming DeepCS, CodeHow, and UNIF by 82%, 62%, and 46%, respectively. Our proposed model is over 1.2K times faster than DeepCS. Moreover, CodeMatcher outperforms two existing online search engines (GitHub and Google search) by 46% and 33%, respectively, in terms of MRR. We also observed that: fusing the advantages of IR-based and DL-based models is promising; improving the quality of method naming helps code search, since method name plays an important role in connecting query and code.

Self-Attention Networks for Code Search

Developers tend to search and reuse code snippets from a large-scale codebase when they want to implement some functions that exist in the previous projects, which can enhance the efficiency of software development. As the first deep learning-based code search model, DeepCS outperforms prior models such as Sourcere and CodeHow. However, it utilizes two separate LSTM to represent code snippets and natural language descriptions respectively, which ignores semantic relations between code snippets and their descriptions. Consequently, the performance of DeepCS falls into the bottleneck, and thus our objective is to break this bottleneck. We propose a self-attention joint representation learning model, named SAN-CS ( S elf- A ttention N etwork for C ode S earch). Comparing with DeepCS, we directly utilize the self-attention network to construct our code search model. By a weighted average operation, self-attention networks can fully capture the contextual information of code snippets and their descriptions. We first utilize two individual self-attention networks to represent code snippets and their descriptions, respectively, and then we utilize the self-attention network to conduct an extra joint representation network for code snippets and their descriptions, which can build semantic relationships between code snippets and their descriptions. Therefore, SAN-CS can break the performance bottleneck of DeepCS. We evaluate SAN-CS on the dataset shared by Gu et al. and choose two baseline models , DeepCS and CARLCS-CNN. Experimental results demonstrate that SAN-CS achieves significantly better performance than DeepCS and CARLCS-CNN. In addition, SAN-CS has better execution efficiency than DeepCS at the training and testing phase. This paper proposes a code search model, SAN-CS. It utilizes the self-attention network to perform the joint attention representations for code snippets and their descriptions, respectively. Experimental results verify the effectiveness and efficiency of SAN-CS.

CSDA: A novel attention-based LSTM approach for code search

Previous studies have proposed semantic-based approaches for code search over large-scale codebases, which has bridged the gap in understanding the semantics between natural language and source-code language. However, these studies either failed to determine an effective method for semantic representations or lacked the distinction of semantic features. In this study, we propose a novel attention-based LSTM neural network known as CSDA (Code Search based on Description Attention), which can effectively improve the code search performance. The proposed model can focus on different parts of a semantic feature when numerous aspects of a source code snippet are used as input. As opposed to assigning the same weight to different parts of the semantic vector, CSDA takes the semantics of natural language descriptions into account, so that the subtle differences hidden in the code snippet can be discriminated and associated with the corresponding queries. We compare CSDA with the existing state-of-the-art approach CODEnn, which uses a jointly embedding technique for code search. Our experimental evaluation demonstrates that CSDA outperforms previous methods and achieves superior code search performance to CODEnn, with higher success rates and mean reciprocal ranks. This study provides significant insights into the use of semantic representation methods in deep learning-based code search approaches.

KernelGraph: Understanding the kernel in a graph

The Linux kernel has grown to 20 million lines of code, which have been contributed by almost 14,000 programmers. The complexity of the Linux kernel challenges the kernel maintenance and makes comprehending the kernel more difficult for developers learning the kernel. Automated tool support is crucial for comprehending such a large-scale program involving a high volume of code. In this article, we present KernelGraph, which enhances understanding of the Linux kernel by providing a visual representation of kernel internals. KernelGraph resembles online map systems and facilitates kernel code navigation in an intuitive and interactive way. We describe the key techniques used in KernelGraph to process the vast amount of information in the kernel codebase quickly. We also implemented two applications built atop KernelGraph to enhance kernel comprehension. KernelGraph was presented to 30 participants, who were asked several questions about their kernel comprehension in a controlled study. Our experimental results show that, compared with other source code comprehension tools, KernelGraph improves kernel comprehension by enabling people to visually browse the kernel code and by providing an effective means for exploring the kernel structure. The ability to switch seamlessly between high-level views and source code significantly reduces the gap between source code and high-level mental representation. KernelGraph can be easily extended to support visualizations of other large-scale codebases.