Repository Mining Research Articles

On the Way to SBOMs: Investigating Design Issues and Solutions in Practice

The increase of software supply chain threats has underscored the necessity for robust security mechanisms, among which the Software Bill of Materials (SBOM) stands out as a promising solution. SBOMs, by providing a machine-readable inventory of software composition details, play a crucial role in enhancing transparency and traceability within software supply chains. This empirical study delves into the practical challenges and solutions associated with the adoption of SBOMs through an analysis of 4,786 GitHub discussions across 510 SBOM-related projects. Through repository mining and analysis, this research delineates key topics, challenges, and solutions intrinsic to the effective utilization of SBOMs. Furthermore, we shed light on commonly used tools and frameworks for SBOM generation, exploring their respective strengths and limitations. This study underscores a set of findings, for example, there are four phases of the SBOM life cycle, and each phase has a set of SBOM development activities and issues; in addition, this study emphasizes the role SBOM play in ensuring resilient software development practices and the imperative of their widespread adoption and integration to bolster supply chain security. The insights of our study provide vital input for future work and practical advancements in this topic.

The Future of ChatGPT in Medicinal Chemistry: Harnessing AI for Accelerated Drug Discovery

AbstractArtificial Intelligence (AI) has emerged as a transformative tool in various fields, including medicinal chemistry and drug discovery. The integration of artificial intelligence (AI) and machine learning (ML) technologies in medicinal chemistry has revolutionized drug discovery processes. Among AI models, ChatGPT (Generative Pre‐trained Transformer) has shown remarkable capabilities in natural language understanding and generation. This review article delves into the potential applications and prospects of ChatGPT in the domain of medicinal chemistry, focusing on its contributions to drug discovery, compound design, virtual screening, target identification, and optimization of pharmacokinetic properties. ChatGPT′s ability to generate contextually relevant text makes it a valuable tool for data mining and analysis of vast chemical and biological information repositories. In this review article, the authors have discussed the challenges and ethical considerations associated with the implementation of ChatGPT 3.5 in medicinal chemistry research. Authors also extend their acknowledgment to ChatGPT (version 3.5) for its contribution in furnishing responses to the prompt, thereby shedding light on the applications of ChatGPT in the field of medicinal chemistry. The authors have analyzed the responses of ChatGPT.

An empirical study on the usage of mocking frameworks in Apache software foundation

Mocking frameworks provide convenient APIs, which create mock objects, manipulate their behavior, and verify their execution, for the purpose of isolating test dependencies in unit testing. This study contributes an in-depth empirical study of whether and how mocking frameworks are used in Apache projects. The key findings and insights of this study include: First, mocking frameworks are widely used in 66% of Apache Java projects, with Mockito, EasyMock, and PowerMock being the top three most popular frameworks. Larger-scale and more recent projects tend to observe a stronger need to use mocking frameworks. This underscores the importance of mocking in practice and related future research. Second, mocking is overall practiced quite selectively in software projects—not all test files use mocking, nor all dependencies of a test target are mocked. It calls for more future research to gain a more systematic understanding of when and what to mock to provide formal guidance to practitioners. On top of this, the intensity of mocking in different projects shows different trends in the projects’ evolution history—implying the compound effects of various factors, such as the pace of a project’s growth, the available resources, time pressure, and priority, etc. This points to an important future research direction in facilitating best mocking practices in software evolution. Furthermore, we revealed the most frequently used APIs in the three most popular frameworks, organized based on the function types. The top five APIs in each functional type of the three mocking frameworks usually take the majority (78% to 100%) of usage in Apache projects. This indicates that developers can focus on these APIs to quickly learn the common usage of these mocking frameworks. We further investigated informal methods of mocking, which do not rely on any mocking framework. These informal mocking methods point to potential sub-optimal mocking practices that could be improved, as well as limitations of existing mocking frameworks. Finally, we conducted a developer survey to collect additional insights regarding the above analysis based on their experience, which complements our analysis based on repository mining. Overall, this study offers practitioners profound empirical knowledge of how mocking frameworks are used in practice and sheds light on future research directions to enhancing mocking in practice.

A community detection approach based on network representation learning for repository mining

In this paper, we propose a novel heterogeneous graph-based model for capturing and handling all the complex and strongly-correlated information of a software Developer Social Network (DSN) to support several analytic tasks. In particular, we challenge the problem of automatically discovering communities of software developers sharing interests for similar projects by relying on Social Network Analysis (SNA) findings. To overcome the huge graph-size issue, we leverage different graph embedding techniques. Eventually, we evaluate the proposed approach with respect to state-of-the-art approaches from an efficiency and an effectiveness point of view by carrying out an experiment involving the GitHub dataset.

How do uncertain parameters affect the analysis of host rock integrity? Methods and preliminary results for a generic clay rock site

Abstract. The thermal, hydraulic, and mechanical effects of excavating the repository mine and the thermal loading of nuclear waste on the safety of the geological barrier system are addressed in the regulations as integrity analyses. For repositories in clay rock, a modelling and assessment methodology has been developed in the ANSICHT (Methodik und Anwendungsbezug eines Sicherheits- und Nachweiskonzeptes für ein HAW-Endlager im Tonstein) project based on thermo-hydro-mechanically (THM) coupled simulations using the open-source software project OpenGeoSys and has been illustrated by its application to a generic clay rock site in northern Germany. However, the assessment can be significantly influenced by uncertainties in the model inputs, which result, on the one hand, from the limited ability to characterize the geological barrier and, on the other hand, from fundamental difficulties and inaccuracies in the measurements. Hence, the results of these established integrity analyses have to be enriched by statistical information. The developed workflow comprises different steps beginning with a realistic characterization of parameter uncertainties. A surrogate model based on mathematically sound techniques is built to capture the propagation of these uncertainties through the THM simulation and the integrity criteria evaluation. The model can then be evaluated to obtain probabilistic results for rock integrity assessment and a sensitivity analysis to identify the inputs that primarily impact the results. In this contribution, we present preliminary results based on the generic repository system from the ANSICHT project and the developed tools for stochastic analyses. This work is done as part of the BGE-funded research cluster URS (Uncertainties and Robustness with regard to the Safety of a repository for high-level radioactive waste).

SEAL: Integrating Program Analysis and Repository Mining

Software projects are complex technical and organizational systems involving large numbers of artifacts and developers. To understand and tame software complexity, a wide variety of program analysis techniques have been developed for bug detection, program comprehension, verification, and more. At the same time, repository mining techniques aim at obtaining insights into the inner socio-technical workings of software projects at a larger scale. While both program analysis and repository mining have been successful on their own, they are largely isolated, which leaves considerable potential for synergies untapped. We present SEAL, the first integrated approach that combines low-level program analysis with high-level repository information. SEAL maps repository information, mined from the development history of a project, onto a low-level intermediate program representation, making it available for state-of-the-art program analysis. SEAL’s integrated approach allows us to efficiently address software engineering problems that span multiple levels of abstraction, from low-level data flow to high-level organizational information. To demonstrate its merits and practicality, we use SEAL to determine which code changes modify central parts of a given software project, how authors interact (indirectly) with each other through code, and we demonstrate that putting static analysis’ results into a socio-technical context improves their expressiveness and interpretability.

Repository mining for changes in Simulink and Stateflow models

Repository mining for changes in Simulink and Stateflow models

Metabolite annotation from knowns to unknowns through knowledge-guided multi-layer metabolic networking

Liquid chromatography - mass spectrometry (LC-MS) based untargeted metabolomics allows to measure both known and unknown metabolites in the metabolome. However, unknown metabolite annotation is a major challenge in untargeted metabolomics. Here, we develop an approach, namely, knowledge-guided multi-layer network (KGMN), to enable global metabolite annotation from knowns to unknowns in untargeted metabolomics. The KGMN approach integrates three-layer networks, including knowledge-based metabolic reaction network, knowledge-guided MS/MS similarity network, and global peak correlation network. To demonstrate the principle, we apply KGMN in an in vitro enzymatic reaction system and different biological samples, with ~100–300 putative unknowns annotated in each data set. Among them, >80% unknown metabolites are corroborated with in silico MS/MS tools. Finally, we validate 5 metabolites that are absent in common MS/MS libraries through repository mining and synthesis of chemical standards. Together, the KGMN approach enables efficient unknown annotations, and substantially advances the discovery of recurrent unknown metabolites for common biological samples from model organisms, towards deciphering dark matter in untargeted metabolomics.

DES-Amyloidoses "Amyloidoses through the looking-glass": A knowledgebase developed for exploring and linking information related to human amyloid-related diseases.

More than 30 types of amyloids are linked to close to 50 diseases in humans, the most prominent being Alzheimer’s disease (AD). AD is brain-related local amyloidosis, while another amyloidosis, such as AA amyloidosis, tends to be more systemic. Therefore, we need to know more about the biological entities’ influencing these amyloidosis processes. However, there is currently no support system developed specifically to handle this extraordinarily complex and demanding task. To acquire a systematic view of amyloidosis and how this may be relevant to the brain and other organs, we needed a means to explore "amyloid network systems" that may underly processes that leads to an amyloid-related disease. In this regard, we developed the DES-Amyloidoses knowledgebase (KB) to obtain fast and relevant information regarding the biological network related to amyloid proteins/peptides and amyloid-related diseases. This KB contains information obtained through text and data mining of available scientific literature and other public repositories. The information compiled into the DES-Amyloidoses system based on 19 topic-specific dictionaries resulted in 796,409 associations between terms from these dictionaries. Users can explore this information through various options, including enriched concepts, enriched pairs, and semantic similarity. We show the usefulness of the KB using an example focused on inflammasome-amyloid associations. To our knowledge, this is the only KB dedicated to human amyloid-related diseases derived primarily through literature text mining and complemented by data mining that provides a novel way of exploring information relevant to amyloidoses.

Alternative Disposal Options for High-Level Radioactive Waste

Abstract. Are alternatives to the disposal of high-level radioactive waste in a geology repository conceivable? We present the results of the first phase of a research project on the state of the art in science and technology for alternative disposal options. The project is financed by the Federal Office for the Safety of Nuclear Waste Management. Most recently, in 2015, the German Commission on the Storage of High-Level Radioactive Waste (Endlagerkommission) evaluated possible disposal technologies and classified them as either promising, conceivable, or to be pursued further. Only final disposal in a geological repository was considered promising. Conceivable, but not immediately available or not advantageous, were storage in deep boreholes (DBs), long-term interim storage (LTIS), and partitioning and transmutation (P&T). All other alternative disposal options by burial, dilution, or removal from the planet were determined not to be worth pursuing. The Disposal Commission did conclude that none of the three conceivable methods (DBs, LTIS, P&T) would result in earlier disposal of high-level radioactive waste than the preferred final disposal in a mine. However, it recommended continued tracking and regular monitoring of the future development of alternative disposal options, e.g., disposal in deep boreholes. Finally, in 2017, with the amended Site Selection Act, the federal government specified disposal in a repository mine with the option of retrieval during operation or recovery for 500 years after closure. In a learning site selection process, the Federal Office for the Safety of Nuclear Waste Disposal (BASE) reviews the proposals of the project managing company, the Federal Company for Radioactive Waste Disposal (BGE), and prepares a reasoned recommendation to the federal government for a site with the best possible safety. Part of the reasoned recommendation is, among other things, a discussion of alternative disposal options to final disposal in deep geological formations. In the presentation, we report on the status of international research on alternative disposal options, discuss advantages and disadvantages of the technologies, and evaluate the potential of the technologies for the disposal of high-level radioactive waste in Germany. The LTIS is designed as dry storage in a building to be constructed above ground or near the surface and is expected to last for a period of several hundred years. With LTIS it would be possible to gain time for the development of a suitable final disposal option; however, this also postpones the disposal issue indefinitely into the future with undetermined methods. DB storage would involve sinking the storage containers into boreholes with depths of up to 5000 m. This could reduce the expense and be particularly advantageous for smaller inventories, although the potential for the use of engineered barriers would be limited and retrievability precluded according to the current state of the art in science and technology. P&T is primarily intended to separate long-lived transuranic elements from high-level radioactive waste and then convert them to short-lived fission products by neutron irradiation in reactors. The main goal is to reduce the necessary containment times in the repository by changing the inventory, but the effort to treat the waste would be significant and a repository for high-level nuclear waste is still needed. More exotic ideas for alternative disposal include deep geological injection of liquid waste, waste forms that melt themselves into rock, storage inside the ocean floor or subduction zones, shipment to space, burial in ice sheets, or dilution in the atmosphere and oceans. None of these exotic options is currently being actively pursued.

Ethics in the mining of software repositories

Research in Mining Software Repositories (MSR) is research involving human subjects, as the repositories usually contain data about developers’ and users’ interactions with the repositories and with each other. The ethics issues raised by such research therefore need to be considered before beginning. This paper presents a discussion of ethics issues that can arise in MSR research, using the mining challenges from the years 2006 to 2021 as a case study to identify the kinds of data used. On the basis of contemporary research ethics frameworks we discuss ethics challenges that may be encountered in creating and using repositories and associated datasets. We also report some results from a small community survey of approaches to ethics in MSR research. In addition, we present four case studies illustrating typical ethics issues one encounters in projects and how ethics considerations can shape projects before they commence. Based on our experience, we present some guidelines and practices that can help in considering potential ethics issues and reducing risks.

Single-state state machines in model-driven software engineering: an exploratory study

ContextModels, as the main artifact in model-driven engineering, have been extensively used in the area of embedded systems for code generation and verification. One of the most popular behavioral modeling techniques is the state machine. Many state machine modeling guidelines recommend that a state machine should have more than one state in order to be meaningful. However, single-state state machines (SSSMs) violating this recommendation have been used in modeling cases reported in the literature.ObjectiveWe aim for understanding the phenomenon of using SSSMs in practice as understanding why developers violate the modeling guidelines is the first step towards improvement of modeling tools and practice.MethodTo study the phenomenon, we conducted an exploratory study which consists of two complementary studies. The first study investigated the prevalence and role of SSSMs in the domain of embedded systems, as well as the reasons why developers use them and their perceived advantages and disadvantages. We employed the sequential explanatory strategy, including repository mining and interview, to study 1500 state machines from 26 components at ASML, a leading company in manufacturing lithography machines from the semiconductor industry. In the second study, we investigated the evolutionary aspects of SSSMs, exploring when SSSMs are introduced to the systems and how developers modify them by mining the largest state-machine-based component from the company.ResultsWe observe that 25 out of 26 components contain SSSMs. Our interviews suggest that SSSMs are used to interface with the existing code, to deal with tool limitations, to facilitate maintenance and to ease verification. Our study on the evolutionary aspects of SSSMs reveals that the need for SSSMs to deal with tool limitations grew continuously over the years. Moreover, only a minority of SSSMs have been changed between SSSM and multiple-state state machine (MSSM) during their evolution. The most frequent modifications developers made to SSSMs is inserting events with constraints on the execution of the events.ConclusionsBased on our results, we provide implications for developers and tool builders. Furthermore, we formulate hypotheses about the effectiveness of SSSMs, the impacts of SSSMs on development, maintenance and verification as well as the evolution of SSSMs.

An empirical study toward dealing with noise and class imbalance issues in software defect prediction

The quality of the defect datasets is a critical issue in the domain of software defect prediction (SDP). These datasets are obtained through the mining of software repositories. Recent studies claim over the quality of the defect dataset. It is because of inconsistency between bug/clean fix keyword in fault reports and the corresponding link in the change management logs. Class Imbalance (CI) problem is also a big challenging issue in SDP models. The defect prediction method trained using noisy and imbalanced data leads to inconsistent and unsatisfactory results. Combined analysis over noisy instances and CI problem needs to be required. To the best of our knowledge, there are insufficient studies that have been done over such aspects. In this paper, we deal with the impact of noise and CI problem on five baseline SDP models; we manually added the various noise level (0–80%) and identified its impact on the performance of those SDP models. Moreover, we further provide guidelines for the possible range of tolerable noise for baseline models. We have also suggested the SDP model, which has the highest noise tolerable ability and outperforms over other classical methods. The True Positive Rate (TPR) and False Positive Rate (FPR) values of the baseline models reduce between 20–30% after adding 10–40% noisy instances. Similarly, the ROC (Receiver Operating Characteristics) values of SDP models reduce to 40–50%. The suggested model leads to avoid noise between 40–60% as compared to other traditional models.

When and How to Make Breaking Changes

Open source software projects often rely on package management systems that help projects discover, incorporate, and maintain dependencies on other packages, maintained by other people. Such systems save a great deal of effort over ad hoc ways of advertising, packaging, and transmitting useful libraries, but coordination among project teams is still needed when one package makes a breaking change affecting other packages. Ecosystems differ in their approaches to breaking changes, and there is no general theory to explain the relationships between features, behavioral norms, ecosystem outcomes, and motivating values. We address this through two empirical studies. In an interview case study, we contrast Eclipse, NPM, and CRAN, demonstrating that these different norms for coordination of breaking changes shift the costs of using and maintaining the software among stakeholders, appropriate to each ecosystem’s mission. In a second study, we combine a survey, repository mining, and document analysis to broaden and systematize these observations across 18 ecosystems. We find that all ecosystems share values such as stability and compatibility, but differ in other values. Ecosystems’ practices often support their espoused values, but in surprisingly diverse ways. The data provides counterevidence against easy generalizations about why ecosystem communities do what they do.

Analysing Time-Stamped Co-Editing Networks in Software Development Teams using git2net

Data from software repositories have become an important foundation for the empirical study of software engineering processes. A recurring theme in the repository mining literature is the inference of developer networks capturing e.g. collaboration, coordination, or communication from the commit history of projects. Many works in this area studied networks of co-authorship of software artefacts, neglecting detailed information on code changes and code ownership available in software repositories. To address this issue, we introduce git2net, a scalable python software that facilitates the extraction of fine-grained co-editing networks in large git repositories. It uses text mining techniques to analyse the detailed history of textual modifications within files. We apply our tool in two case studies using GitHub repositories of multiple Open Source as well as a proprietary software project. Specifically, we use data on more than 1.2 million commits and more than 25,000 developers to test a hypothesis on the relation between developer productivity and co-editing patterns in software teams. We argue that git2net opens up an important new source of high-resolution data on human collaboration patterns that can be used to advance theory in empirical software engineering, computational social science, and organisational studies.

Software development with feature toggles: practices used by practitioners

Background: Using feature toggles is a technique that allows developers to either turn a feature on or off with a variable in a conditional statement. Feature toggles are increasingly used by software companies to facilitate continuous integration and continuous delivery. However, using feature toggles inappropriately may cause problems which can have a severe impact, such as code complexity, dead code, and system failure. For example, the erroneous repurposing of an old feature toggle caused Knight Capital Group, an American global financial services firm, to go bankrupt due to the implications of the resultant incorrect system behavior. Aim: The goal of this research project is to aid software practitioners in the use of practices to support software development with feature toggles through an empirical study of feature toggle practice usage by practitioners. Method: We conducted a qualitative analysis of 99 artifacts from the grey literature and 10 peer-reviewed papers about feature toggles. We conducted a survey of practitioners from 38 companies. Results: We identified 17 practices in 4 categories: Management practices, Initialization practices, Implementation practices, and Clean-up practices. We observed that all of the survey respondents use a dedicated tool to create and manage feature toggles in their code. Documenting feature toggle's metadata, setting up the default value for feature toggles, and logging the changes made on feature toggles are also frequently-observed practices. Conclusions: The feature toggle development practices discovered and enumerated in this work can help practitioners more effectively use feature toggles. This work can enable future mining of code repositories to automatically identify feature toggle practices.

What Software Architecture Styles are Popular?

One can meet the software architecture style's notion in the software engineering literature. This notion is considered important in books on software architecture and university sources. However, many software developers are not so optimistic about it. It is not clear, whether this notion is just an academic concept, or is actually used in the software industry. In this paper, we measured industrial software developers' attitudes towards the concept of software architecture style. We also investigated the popularity of eleven concrete architecture styles. We applied two methods. A developers’ survey was applied to estimate developers' overall attitude and define what the community thinks about the automatic recognition of software architecture styles. Automatic crawlers were applied to mine the open-source code from the GitHub platform. These crawlers identified style smells in repositories using the features we proposed for the architecture styles. We found that the notion of software architecture style is not just a concept of academics in universities. Many software developers apply this concept in their work. We formulated features for the eleven concrete software architecture styles and developed crawlers based on these features. The results of repository mining using the features showed which styles are popular among developers of open-source projects from commercial companies and non-commercial communities. Automatic mining results were additionally validated by the Github developers survey.

Mining Software Repository for Cleaning Bugs Using Data Mining Technique

Despite advances in technological complexity and efforts, software repository maintenance requires reusing the data to reduce the effort and complexity. However, increasing ambiguity, irrelevance, and bugs while extracting similar data during software development generate a large amount of data from those data that reside in repositories. Thus, there is a need for a repository mining technique for relevant and bug-free data prediction. This paper proposes a fault prediction approach using a data-mining technique to find good predictors for high-quality software. To predict errors in mining data, the Apriori algorithm was used to discover association rules by fixing confidence at more than 40% and support at least 30%. The pruning strategy was adopted based on evaluation measures. Next, the rules were extracted from three projects of different domains; the extracted rules were then combined to obtain the most popular rules based on the evaluation measure values. To evaluate the proposed approach, we conducted an experimental study to compare the proposed rules with existing ones using four different industrial projects. The evaluation showed that the results of our proposal are promising. Practitioners and developers can utilize these rules for defect prediction during early software development.

Deep mining of open source software bug repositories

Large scale software projects adopt bug tracking systems such as Bugzilla and Jira to manage the bugs’ fixes and store their information. Mining bug repositories is essential to automate some maintenance phase activities like bug triage. Recently, embedding and deep learning models have emerged as a breakthrough for text classification applications. This paper proposes utilizing word embedding and deep learning models for mining bug repositories, in order to identify severity classes of newly reported bugs. Embedding models were utilized to represent bug reports, due to their ability to acquire semantic relations among words and sentences. Five effective deep learning models (CNN, LSTM, GRU, hybrid CNN-LSTM/GRU) were trained to classify the bug reports to their severity classes. We attempted these models as each of them has different capabilities; CNN can extract key features of an input and reduce the feature space size. While, LSTM and GRU can represent sequential words (sentences) effectively. Experimental results on two open large-scale bug repositories, Eclipse and Mozilla, demonstrated that CNN model is the superior. However, it was found that the micro-average classification performance of the CNN could be achieved by some traditional classifiers, e.g. SVM and KNN, trained using the embedding vectors instead of the bag-of-words-model.

How to Illuminate the Dark Proteome Using the Multi-omic OpenProt Resource.

Ten of thousands of open reading frames (ORFs) are hidden within genomes. These alternative ORFs, or small ORFs, have eluded annotations because they are either small or within unsuspected locations. They are found in untranslated regions or overlap a known coding sequence in messenger RNA and anywhere in a "non-coding" RNA. Serendipitous discoveries have highlighted these ORFs' importance in biological functions and pathways. With their discovery came the need for deeper ORF annotation and large-scale mining of public repositories to gather supporting experimental evidence. OpenProt, accessible at https://openprot.org/, is the first proteogenomic resource enforcing a polycistronic model of annotation across an exhaustive transcriptome for 10 species. Moreover, OpenProt reports experimental evidence cumulated across a re-analysis of 114 mass spectrometry and 87 ribosome profiling datasets. The multi-omics OpenProt resource also includes the identification of predicted functional domains and evaluation of conservation for all predicted ORFs. The OpenProt web server provides two query interfaces and one genome browser. The query interfaces allow for exploration of the coding potential of genes or transcripts of interest as well as custom downloads of all information contained in OpenProt. © 2020 The Authors. Basic Protocol 1: Using the Search interface Basic Protocol 2: Using the Downloads interface.