Software Code Bases Research Articles

Using Third-Party Components’ Metadata to Analyze Cross-cutting Concerns

Context: Modularity is a key concept in software development. Well-modularized systems are easier to maintain and evolve, but achieving good modularity is difficult. Concerns that are important, but not central to a systems' main business rules, frequently end up scattered and entangled throughout several software modules. Those so called cross-cutting concerns are a major source of loss of modularity and code decay in software systems. Motivation: Studies on cross-cutting concerns often resort to manual identification of concerns, but manual identification is effort demanding, does not scale, and tends to be imprecise. Automatic approaches are therefore very attractive when the codebase is extensive. In modern systems, developers implement modules to address central business rules, but they tend to add third-party components in the codebase to materialize concerns related to other secondary aspects. Logging, database access, and tests automation are examples of concerns that are usually implemented with the help of imported components and are prone to scatter and tangle throughout the codebase. Aims: This paper proposes a method to track this type of cross-cutting concern. Our work takes advantage of the addition of metadata about components to track them. The method scales by automating the identification and analysis of concerns scattered throughout the software codebase. We define a new metric, Dedication to Concern (DtC), to measure how much source code modules focus on implementing the identified concerns. Working Method: We describe our method to mine cross-cutting concerns from the metadata related to the use of components. The method is instantiated as a tool, architectural knowledge suite (AKS). The tool is used to analyze concerns in a set of large Java projects. The results are used to feed an action research study, during which software development specialists analyze the AKS outputs to evaluate and evolve the method. Conclusion: The semi-automated approach is feasible and scalable, and can be used to analyze secondary concerns that are currently being imported into modern software systems via third-party components.

From text to threats: A language model approach to software vulnerability detection

Abstract In the rapidly-evolving landscape of software development, the detection of vulnerabilities in source code has become of paramount importance. Our study introduces a novel knowledge distillation (KD) technique aimed at enhancing vulnerability detection in software codebases. Using benchmark datasets such as SARD, SeVC, Devign, and D2A, we assess the prowess of the KD method when applied to different classifiers, specifically GPT2, CodeBERT, and LSTM. The empirical results are revealed a marked improvement in the performance of these classifiers upon the implementation of the KD technique, particularly with the GPT-2 model demonstrating the most promising outcomes. This work underscores the potential of integrating transformer-based learning models, like GPT-2, with knowledge distillation for more efficient and accurate vulnerability detection.

Refactoring embedded software: A study in healthcare domain

In embedded software industry, stakeholders usually promote run-time properties (e.g., performance, energy efficiency, etc.) as quality drivers, which in many cases leads to a compromise at the levels of design-time qualities (e.g., maintainability , reusability, etc.). Such a compromise does not come without a cost; since embedded systems need heavy maintenance cycles. To assure effective bug-fixing, shorten the time required for releasing updates, a refactoring of the software codebase needs to take place regularly. Objective: This study aims to investigate how refactorings are applied in ES industry; and propose a systematic approach that can guide refactoring through a 3-step process for refactoring: (a) planning; (b) design; and (c) evaluation. The aforementioned goals were achieved by conducting a single case study in a company that develops medical applications for bio-impedance devices; and follows a rather systematic refactoring process in periodic timestamps. Three data collection approaches have been used: surveys, interviews (10 practitioners), and artifact analysis (51 refactoring activities). The results of the study suggest that: (a) maintainability and reusability are the design-time quality attributes that motivate the refactoring of Embedded Software (ES), with 30% of the participants considering them as of “Very High” importance; (b) the refactorings that are most frequently performed are “Extract Method”, “Replace Magic Number with Constant” and “Remove Parameter”. We note that the “Extract Method” refactoring has an applicability of more than over 80%; and (c) to evaluate the refactoring process engineers use tools producing structural metrics, internal standards, and reviews. The outcomes of this study can be useful to both researchers and practitioners, in the sense that the former can focus their efforts on aspects that are meaningful to industry, whereas the latter are provided with a systematic refactoring process.

A Systematic Framework to Identify Violations of Scenario-dependent Driving Rules in Autonomous Vehicle Software

Safety compliance is paramount to the safe deployment of autonomous vehicle (AV) technologies in real-world transportation systems. As AVs will share road infrastructures with human drivers and pedestrians, it is an important requirement for AVs to obey standard driving rules. Existing AV software testing methods, including simulation and road testing, only check fundamental safety rules such as collision avoidance and safety distance. Scenario-dependent driving rules, including crosswalk and intersection rules, are more complicated because the expected driving behavior heavily depends on the surrounding circumstances. However, a testing framework is missing for checking scenario-dependent driving rules on various AV software. In this paper, we design and implement a systematic framework AVChecker for identifying violations of scenario-dependent driving rules in AV software using formal methods. AVChecker represents both the code logic of AV software and driving rules in proposed formal specifications and leverages satisfiability modulo theory (SMT) solvers to identify driving rule violations. To improve the automation of systematic rule-based checking, AVChecker provides a powerful user interface for writing driving rule specifications and applies static code analysis to extract rule-related code logic from the AV software codebase. Evaluations on two open-source AV software platforms, Baidu Apollo and Autoware, uncover 19 true violations out of 28 real-world driving rules covering crosswalks, traffic lights, stop signs, and intersections. Seven of the violations can lead to severe risks of a collision with pedestrians or blocking traffic.

A Systematic Framework to Identify Violations of Scenario-dependent Driving Rules in Autonomous Vehicle Software

Safety compliance is paramount to the safe deployment of autonomous vehicle (AV) technologies in real-world transportation systems. As AVs will share road infrastructures with human drivers and pedestrians, it is an important requirement for AVs to obey standard driving rules. Existing AV software testing methods, including simulation and road testing, only check fundamental safety rules such as collision avoidance and safety distance. Scenario-dependent driving rules, including crosswalk and intersection rules, are more complicated because the expected driving behavior heavily depends on the surrounding circumstances. However, a testing framework is missing for checking scenario-dependent driving rules on various AV software. In this paper, we design and implement a systematic framework AVChecker for identifying violations of scenario-dependent driving rules in AV software using formal methods. AVChecker represents both the code logic of AV software and driving rules in proposed formal specifications and leverages satisfiability modulo theory (SMT) solvers to identify driving rule violations. To improve the automation of systematic rule-based checking, AVChecker provides a powerful user interface for writing driving rule specifications and applies static code analysis to extract rule-related code logic from the AV software codebase. Evaluations on two open-source AV software platforms, Baidu Apollo and Autoware, uncover 19 true violations out of 28 real-world driving rules covering crosswalks, traffic lights, stop signs, and intersections. Seven of the violations can lead to severe risks of a collision with pedestrians or blocking traffic.

From one to hundreds: multi-licensing in the JavaScript ecosystem

Open source licenses create a legal framework that plays a crucial role in the widespread adoption of open source projects. Without a license, any source code available on the internet could not be openly (re)distributed. Although recent studies provide evidence that most popular open source projects have a license, developers might lack confidence or expertise when they need to combine software licenses, leading to a mistaken project license unification. This license usage is challenged by the high degree of reuse that occurs in the heart of modern software development practices, in which third-party libraries and frameworks are easily and quickly integrated into a software codebase. This scenario creates what we call “multi-licensed” projects, which happens when one project has components that are licensed under more than one license. Although these components exist at the file-level, they naturally impact licensing decisions at the project-level. In this paper, we conducted a mix-method study to shed some light on these questions. We started by parsing 1,426,263 (source code and non-source code) files available on 1,552 JavaScript projects, looking for license information. Among these projects, we observed that 947 projects (61%) employ more than one license. On average, there are 4.7 licenses per studied project (max: 256). Among the reasons for multi-licensing is to incorporate the source code of third-party libraries into the project’s codebase. When doing so, we observed that 373 of the multi-licensed projects introduced at least one license incompatibility issue. We also surveyed with 83 maintainers of these projects aimed to cross-validate our findings. We observed that 63% of the surveyed maintainers are not aware of the multi-licensing implications. For those that are aware, they adopt multiple licenses mostly to conform with third-party libraries’ licenses.

Migrating large codebases to C++ Modules

ROOT has several features which interact with libraries and require implicit header inclusion. This can be triggered by reading or writing data on disk, or user actions at the prompt. Often, the headers are immutable, and reparsing is redundant. C++ Modules are designed to minimize the reparsing of the same header content by providing an efficient on-disk representation of C++ Code. ROOT has released a C++ Modules-aware technology preview, which intends to become the default for the ROOT 6.20 release.In this paper, we will summarize our experience with migrating C++ Modules to LHC experiment’s software codebases, particularly for CMS software (CMSSW). We outline the challenges with adopting C++ Modules for CMSSW, including the integration of C++ Modules support in the CMS build system and we will evaluate the CMSSW performance benefits.

Fast distributed compilation and testing of large C++ projects

High energy physics experiments traditionally have large software codebases primarily written in C++ and the LHCb physics software stack is no exception. Compiling from scratch can easily take 5 hours or more for the full stack even on an 8-core VM. In a development workflow, incremental builds often do not significantly speed up compilation because even just a change of the modification time of a widely used header leads to many compiler and linker invokations. Using powerful shared servers is not practical as users have no control and maintenance is an issue. Even though support for building partial checkouts on top of published project versions exists, by far the most practical development workflow involves full project checkouts because of off-the-shelf tool support (git, intellisense, etc.) This paper details a deployment of distcc, a distributed compilation server, on opportunistic resources such as development machines. The best performance operation mode is achieved when preprocessing remotely and profiting from the shared CernVM File System. A 10 (30) fold speedup of elapsed (real) time is achieved when compiling Gaudi, the base of the LHCb stack, when comparing local compilation on a 4 core VM to remote compilation on 80 cores, where the bottleneck becomes non-distributed work such as linking. Compilation results are cached locally using ccache, allowing for even faster rebuilding. A recent distributed memcached-based shared cache is tested as well as a more modern distributed system by Mozilla, sccache, backed by S3 storage. These allow for global sharing of compilation work, which can speed up both central CI builds and local development builds. Finally, we explore remote caching and execution services based on Bazel, and how they apply to Gaudi-based software for distributing not only compilation but also linking and even testing.

An Open-Source Techno-Economic Assessment Framework for 5G Deployment

Optimal network planning is crucial to ensure viable investments. However, engineering analysis and cost assessment frequently occur independently of each other. Whereas considerable research has been undertaken on 5G networks, there is a lack of openly accessible tools that integrate the engineering and cost aspects, in a techno-economic assessment framework capable of providing geospatially-explicit network analytics. Consequently, this paper details an open-source python simulator for integrated modelling of 5G (pysim5G), that enables both engineering and cost metrics to be assessed in a single unified framework. The tool includes statistical analysis of radio interference to assess the system-level performance of 4G and 5G frequency band coexistence (including millimeter wave), while simultaneously quantifying the costs of ultra-dense 5G networks. An example application of this framework explores the techno-economics of 5G infrastructure sharing strategies, finding that total deployment costs can be reduced by 30% using either passive site sharing, or passive backhaul sharing, or by up to 50% via a multi-operator radio access network. The key contribution is a fully-tested, open-source software codebase, allowing users to undertake integrated techno-economic assessment of 5G deployments in a single geospatial framework.

Modular Software Architecture for Fully Coupled Spacecraft Simulations

Computer simulations of spacecraft dynamics are widely used in industry and academia to predict how spacecraft will behave during proposed mission concepts. Current technology and performance requirements have placed pressure on simulations to be increasingly more representative of the environment and the physics that spacecraft will encounter. This results in increasingly complex computer simulations. Designing the software architecture in a modular way is a crucial step to allow for ease of testing, maintaining, and scaling of the software code base. However, for complex spacecraft modeling including flexible or multibody dynamics, modularizing the software is not a trivial task because the resulting equations of motion are fully coupled nonlinear equations. In this paper, a software architecture is presented for creating complex fully coupled spacecraft simulations with a modular framework. The architecture provides a solution to these common issues seen in dynamics modeling. The modularization of the fully coupled equations of motion is completed by solving the complex equations analytically such that the spacecraft rigid-body translational and rotational accelerations are solved for first and the other second-order state derivatives are found later. This architecture is implemented in the Basilisk astrodynamics software package and is a fully tested example of the proposed software architecture.

Benefits of reverse engineering technologies in software development makerspace

In the recent decades, the amount of data produced by scientific, engineering, and life science applications has increased with several orders of magnitude. In parallel with this development, the applications themselves have become increasingly complex in terms of functionality, structure, and behavior. In the same time, development and production cycles of such applications exhibit a tendency of becoming increasingly shorter, due to factors such as market pressure and rapid evolution of supporting and enabling technologies. As a consequence, an increasing fraction of the cost of creating new applications and manufacturing processes shifts from the creation of new artifacts to the adaption of existing ones. A key component of this activity is the understanding of the design, operation, and behavior of existing manufactured artifacts, such as software code bases, hardware systems, and mechanical assemblies. For instance, in the software industry, it is estimated that maintenance costs exceed 80% of the total costs of a software product's lifecycle, and software understanding accounts for as much as half of these maintenance costs. To facilitate the software development process, it would be ideal to have tools that automatically generate or help to generate UML (Unified Modeling Language) models from source code. Reverse engineering the software architecture from source code provides a valuable service to software practitioners. Case tools implementing MDA and reverse-engineering constitute an important opportunity of software development engineers. So MDA and reverse engineering is an important key witch make makerspace more productive and more efficient.

Modern and Responsive Mobile-enabled Web Applications

Rapid web technology improvements in the last few years have powered software developers to quickly write responsive mobile-friendly applications. The innovative web frameworks and libraries make it easy to have same software code base for desktop and mobile devices. Single-page applications offer a more-native-app-like experience to the user. This also means a web application can easily be converted to a native mobile application if desired. This allows software products to be evolved continuously at a much faster pace with features added on daily basis. The software companies who can adopt these technologies will most likely see the benefit in the long run as they can offer new and modified products faster than their competitors.In this paper, we review some of the state-of-the-art web technologies, third-party libraries, and frameworks for quick interactive web development. Finally, we present a simple interactive browser-based, mobile friendly web application which was developed using one of the latest web development framework.

ATLAS software configuration and build tool optimisation

ATLAS software code base is over 6 million lines organised in about 2000 packages. It makes use of some 100 external software packages, is developed by more than 400 developers and used by more than 2500 physicists from over 200 universities and laboratories in 6 continents. To meet the challenge of configuration and building of this software, the Configuration Management Tool (CMT) is used. CMT expects each package to describe its build targets, build and environment setup parameters, dependencies on other packages in a text file called requirements, and each project (group of packages) to describe its policies and dependencies on other projects in a text project file. Based on the effective set of configuration parameters read from the requirements files of dependent packages and project files, CMT commands build the packages, generate the environment for their use, or query the packages. The main focus was on build time performance that was optimised within several approaches: reduction of the number of reads of requirements files that are now read once per package by a CMT build command that generates cached requirements files for subsequent CMT build commands; introduction of more fine-grained build parallelism at package task level, i.e., dependent applications and libraries are compiled in parallel; code optimisation of CMT commands used for build; introduction of package level build parallelism, i. e., parallelise the build of independent packages. By default, CMT launches NUMBER-OF-PROCESSORS build commands in parallel. The other focus was on CMT commands optimisation in general that made them approximately 2 times faster. CMT can generate a cached requirements file for the environment setup command, which is especially useful for deployment on distributed file systems like AFS or CERN VMFS. The use of parallelism, caching and code optimisation significantly-by several times-reduced software build time, environment setup time, increased the efficiency of multi-core computing resources utilisation, and considerably improved software developer and user experience.

Is Brain Emulation Dangerous?

Abstract Brain emulation is a hypothetical but extremely transformative technology which has a non-zero chance of appearing during the next century. This paper investigates whether such a technology would also have any predictable characteristics that give it a chance of being catastrophically dangerous, and whether there are any policy levers which might be used to make it safer. We conclude that the riskiness of brain emulation probably depends on the order of the preceding research trajectory. Broadly speaking, it appears safer for brain emulation to happen sooner, because slower CPUs would make the technology‘s impact more gradual. It may also be safer if brains are scanned before they are fully understood from a neuroscience perspective, thereby increasing the initial population of emulations, although this prediction is weaker and more scenario-dependent. The risks posed by brain emulation also seem strongly connected to questions about the balance of power between attackers and defenders in computer security contests. If economic property rights in CPU cycles1 are essentially enforceable, emulation appears to be comparatively safe; if CPU cycles are ultimately easy to steal, the appearance of brain emulation is more likely to be a destabilizing development for human geopolitics. Furthermore, if the computers used to run emulations can be kept secure, then it appears that making brain emulation technologies ―open‖ would make them safer. If, however, computer insecurity is deep and unavoidable, openness may actually be more dangerous. We point to some arguments that suggest the former may be true, tentatively implying that it would be good policy to work towards brain emulation using open scientific methodology and free/open source software codebases

SimPL: A product-line modeling methodology for families of integrated control systems

ContextIntegrated control systems (ICSs) are heterogeneous systems where software and hardware components are integrated to control and monitor physical devices and processes. A family of ICSs share the same software code base, which is configured differently for each product to form a unique installation. Due to the complexity of ICSs and inadequate automation support, product configuration in this context is typically error-prone and costly. ObjectiveAs a first step to overcome these challenges, we propose a UML-based product-line modeling methodology that provides a foundation for semi-automated product configuration in the specific context of ICSs. MethodWe performed a comprehensive domain analysis to identify characteristics of ICS families, and their configuration challenges. Based on this, we formulated the characteristics of an adequate configuration solution, and derived from them a set of modeling requirements for a model-based solution to configuration. The SimPL methodology is proposed to fulfill these requirements. ResultsTo evaluate the ability of SimPL to fulfill the modeling requirements, we applied it to a large-scale industrial case study. Our experience with the case study shows that SimPL is adequate to provide a model of the product family that meets the modeling requirements. Further evaluation is still required to assess the applicability and scalability of SimPL in practice. Doing this requires conducting field studies with human subjects and is left for future work. ConclusionWe conclude that configuration in ICSs requires better automation support, and UML-based approaches to product family modeling can be tailored to provide the required foundation.

Implementing Two-lane Highway Simulation Modeling into CORSIM1

While urban areas and the corresponding traffic demand continue to grow, rural areas are experiencing significant growth as well. This growth is now resulting in congestion on facilities that previously did not have any. One area that is becoming a concern, particularly in Florida, is rural areas transitioning into a more developed area. Access to these areas is usually by twolane highways, but within these areas, there may be an occasional traffic signal, and possibly segments of multilane highway as well. Currently, no analysis tool exists for analyzing two-lane highway facilities with occasional intersections. The signal spacing and other general characteristics of these roadways do not fit with the analysis criteria for signalized arterials in the Highway Capacity Manual (HCM), and the two-lane highway analysis procedure does not account for interruptions to the flow, such as from signals. To pursue further investigation of the traffic operations within these areas and to assist with developing a facilitylevel analysis methodology, a simulation tool is required. However, the existing simulation tools cannot fully meet the research demands. The objective of this project was to develop a simulation tool that is capable of modeling the combination of two-lane highway segments and signalized intersections. The development approach used was to incorporate this modeling capability into CORSIM by making the necessary additions and modifications to the existing CORSIM software code base. The primary issues that had to be addressed to implement this modeling capability included: developing the model components that deal with passing maneuvers in an oncoming lane, developing the model components that deal with passing lanes, and developing a mechanism to link highway segments to signalized intersections. Preliminary testing showed that the developed two-lane highway modeling logic produced results that are reasonably consistent with expected traffic flow theory and field observations discussed in the literature.

Copying 0.03 percent of software code base not 'de minimis'

Copying 54 out of 160,000 lines of a software code base is not non-actionable de minimis copying when the code is sufficiently important to the operation of the program.

Heterogeneous temporal probabilistic agents

To date, there has been no work on temporal probabilistic agent reasoning on top of heterogeneous legacy databases and software modules. We will define the concept of a heterogeneous temporal probabilistic (HTP) agent. Such agents can be built on top of existing databases, data structures, and software code bases without explicitly accessing the internal code of those systems and can take actions compatible with a policy or operating principles specified by an agent developer. We will develop a formal semantics for such agents through the notion of a feasible temporal probabilistic status interpretation (FTPSI for short). Intuitively, an FTPSI specifies what all an HTP agent is permitted/forbidden/obliged to do at various times t . As changes occur in the environment, the HTP agent must compute a new FTPSI. HTP agents continuously compute FTPSIs in order to determine what they should do and, hence, the problem of computing FTPSIs is very important. We give a sound and complete algorithm to compute FTPSIs for a very large class of HTP agents called strict HTP agents. In a given state, many FTPSIs may exist. These represent alternative courses of action that the HTP agent can take. We provide a notion of an optimal FTPSI that selects an FTPSI optimizing an objective function and give a sound and complete algorithm to compute an optimal FTPSI.