Source Code Analysis Research Articles

Automating the Refactoring Process

To decrease software maintenance cost, software development companies use static source code analysis techniques. Static analysis tools are capable of finding potential bugs, anti-patterns, coding rule violations, and they can also enforce coding style standards. Although there are several available static analyzers to choose from, they only support issue detection. The elimination of the issues is still performed manually by developers. Here, we propose a process that supports the automatic elimination of coding issues in Java. We introduce a tool that uses a third-party static analyzer as input and enables developers to automatically fix the detected issues for them. Our tool uses a special technique, called reverse AST-search, to locate source code elements in a syntax tree, just based on location information. Our tool was evaluated and tested in a two-year project with six software development companies where thousands of code smells were identified and fixed in five systems that have altogether over five million lines of code.

Semantic topic models for source code analysis

Topic modeling techniques have been recently applied to analyze and model source code. Such techniques exploit the textual content of source code to provide automated support for several basic software engineering activities. Despite these advances, applications of topic modeling in software engineering are frequently suboptimal. This can be attributed to the fact that current state-of-the-art topic modeling techniques tend to be data intensive. However, the textual content of source code, embedded in its identifiers, comments, and string literals, tends to be sparse in nature. This prevents classical topic modeling techniques, typically used to model natural language texts, to generate proper models when applied to source code. Furthermore, the operational complexity and multi-parameter calibration often associated with conventional topic modeling techniques raise important concerns about their feasibility as data analysis models in software engineering. Motivated by these observations, in this paper we propose a novel approach for topic modeling designed for source code. The proposed approach exploits the basic assumptions of the cluster hypothesis and information theory to discover semantically coherent topics in software systems. Ten software systems from different application domains are used to empirically calibrate and configure the proposed approach. The usefulness of generated topics is empirically validated using human judgment. Furthermore, a case study that demonstrates thet operation of the proposed approach in analyzing code evolution is reported. The results show that our approach produces stable, more interpretable, and more expressive topics than classical topic modeling techniques without the necessity for extensive parameter calibration.

A Perspective View of different Techniques Used in Different Phases of Load Testing

Background/Objectives: To determine the quality and system characteristics, load testing has paramount importance in addition to the traditional functional testing. This study will be useful for the researchers to detect performance problems under load. Methods/Statistical Analysis: This comprehensive study is focussed on analysing different techniques for designing the load using workload intensity and workload mix in operational profiles as well as use of system models techniques and source code analysis techniques. We compare and contrast various approaches applied in load execution phase and load analysis phase. Findings: To deal with the load related problems and for recording system behaviour, realistic load test cases are designed to see functionality. Load execution testing can be done by human beings, load testing tools and also there is a use of special platforms. After completion of load test, performance analyst use tools to perform comparison against a predefined threshold values. Applications/Improvements: Although there are many existing techniques which shows correlation between performance metrics and anomalies but in practice, valid performance techniques are often limited. So, there is a need to put attention on these issues as a future work.

Guest editor's introduction to the Special Issue on Program Comprehension (ICPC 2014)

It is our pleasure to introduce you to the papers in this Special Issue based on the 22th International Conference on Program Comprehension (ICPC 2014). Program comprehension plays a central role in most of the phases of the software development life cycle, where it helps facilitate reuse, inspection, maintenance, reverse engineering, reengineering, migration, and extension of existing software systems. The International Conference on Program Comprehension (ICPC) is the primary venue for work in the area of program comprehension. It is also one of the leading venues for work in the areas of software analysis, reverse engineering, software evolution, and software visualization. ICPC provides an opportunity for researchers and industry practitioners to present and discuss the state-of-the-art and the state-of-the-practice in program comprehension and related areas. ICPC 2014 took place during June 2–3, 2014, in Hyderabad, India, and was co-located with the International Conference on Software Engineering (ICSE 2014). ICPC 2014 received a record number of submissions (76) from 19 different countries, which allowed us to assemble an excellent program that continues ICPC's tradition of providing a high-quality venue for sharing the latest advances in program comprehension. The program included 20 full research papers, 11 short papers and 5 tool demonstration papers. Of these 20 full research papers, five were invited to submit an extended version to the Journal of Software: Evolution and Process. After a rigorous reviewing process with at least three reviewers per paper, four papers were accepted for publication in this special section. The paper entitled ‘Framing Program Comprehension as Fault Localization’ by Alexandre Perez and Rui Abreu proposes an approach, coined Spectrum-based Feature Comprehension (SFC), that borrows techniques from software-fault localization that were proven to be effective even when debugging large applications. SFC analyses the program by exploiting run-time information from test case executions to identify the components that are important for a given feature, helping software engineers to understand how a program is structured and each of the functionality's dependencies are. They present a toolset, coined PANGOLIN, that implements SFC and displays its report to the user using an intuitive visualization. The paper entitled ‘Searching Crowd Knowledge to Recommend Solutions for API Usage Tasks’ by Eduardo C. Campos, Lucas B. L. de Souza, and Marcelo de A. Maia presents an approach that makes use of ‘crowd knowledge’ in Stack Overflow to recommend information that can assist developer activities. This strategy recommends a ranked list of question-answer pairs from Stack Overflow based on a query. The criteria for ranking are based on three main aspects: the textual similarity of the pairs with respect to the query related to the developer's problem, the quality of the pairs, and a filtering mechanism that considers only ‘how-to’ posts. The paper entitled, ‘AmaLgam+: Composing Rich Information Sources for Accurate Bug Localization’ by Shaowei Wang and David Lo proposes AmaLgam+, which is a method for locating relevant buggy files that combines five sources of information, namely, version history, similar reports, structure, stack traces, and reporter information. They perform a large-scale experiment on four open source projects, namely, AspectJ, Eclipse, SWT, and ZXing to localize more than 3000 bugs and compare AmaLgam+ results with those of six state-of-the-art bug localization approaches. The study showed that the newly proposed method outperforms these existing approaches in terms of mean average precision. The paper entitled, ‘Source code analysis with LDA’ by David Binkley, Daniel Heinz, Dawn Lawrie and Justin Overfelt aims to aid software engineers in their understanding of the Latent Dirichlet allocation (LDA) tuning parameters by numerically and graphically demonstrating the relationship between the tuning parameters and the LDA output. LDA has seen increasing use in the understanding of source code and its related artifacts in part because of its impressive modeling power. However, this expressive power comes at a cost: The technique includes several tuning parameters whose impact on the resulting LDA model must be carefully considered. The aim of their work is to provide insights into the tuning parameters' impact. We hope that readers will enjoy this special issue and gain useful insights from the four papers presented. We would like to thank all the authors who submitted papers to the conference and the authors who significantly extending their work for this special issue. In addition, we would like to thank the members of the ICPC 2014 program committee and the external reviewers for their time, careful reviews, and active discussions of the submitted papers, which helped making this special issue special. Finally, we would like to thank the editorial board of the Journal of Software: Evolution and Process and the publisher Wiley for providing us with the opportunity to devote this issue to the best of ICPC 2014. We also thank Journal of Software: Evolution and Process Editor Gerardo Canfora for providing expert guidance and important advice throughout the process. Enjoy!

A probabilistic model for detecting rigid domains in protein structures.

Large-scale conformational changes in proteins are implicated in many important biological functions. These structural transitions can often be rationalized in terms of relative movements of rigid domains. There is a need for objective and automated methods that identify rigid domains in sets of protein structures showing alternative conformational states. We present a probabilistic model for detecting rigid-body movements in protein structures. Our model aims to approximate alternative conformational states by a few structural parts that are rigidly transformed under the action of a rotation and a translation. By using Bayesian inference and Markov chain Monte Carlo sampling, we estimate all parameters of the model, including a segmentation of the protein into rigid domains, the structures of the domains themselves, and the rigid transformations that generate the observed structures. We find that our Gibbs sampling algorithm can also estimate the optimal number of rigid domains with high efficiency and accuracy. We assess the power of our method on several thousand entries of the DynDom database and discuss applications to various complex biomolecular systems. The Python source code for protein ensemble analysis is available at: https://github.com/thachnguyen/motion_detection : mhabeck@gwdg.de.

Source code analysis with LDA

AbstractLatent Dirichlet allocation (LDA) has seen increasing use in the understanding of source code and its related artifacts in part because of its impressive modeling power. However, this expressive power comes at a cost: The technique includes several tuning parameters whose impact on the resulting LDA model must be carefully considered. The aim of this work is to provide insights into the tuning parameters' impact. Doing so improves the comprehension of both researchers who look to exploit the power of LDA in their research and those who interpret the output of LDA‐using tools. It is important to recognize that the goal of this work isnotto establish values for the tuning parameters because there is no universalbest setting. Rather, appropriate settings depend on the problem being solved, the input corpus (in this case, typically words from the source code and its supporting artifacts), and the needs of the engineer performing the analysis. This work's primary goal is to aid software engineers in their understanding of the LDA tuning parameters by demonstrating numerically and graphically the relationship between the tuning parameters and the LDA output. A secondary goal is to enable more informed setting of the parameters. Copyright © 2016 John Wiley & Sons, Ltd.

Multivariate Welch t-test on distances.

Motivation: Permutational non-Euclidean analysis of variance, PERMANOVA, is routinely used in exploratory analysis of multivariate datasets to draw conclusions about the significance of patterns visualized through dimension reduction. This method recognizes that pairwise distance matrix between observations is sufficient to compute within and between group sums of squares necessary to form the (pseudo) F statistic. Moreover, not only Euclidean, but arbitrary distances can be used. This method, however, suffers from loss of power and type I error inflation in the presence of heteroscedasticity and sample size imbalances.Results: We develop a solution in the form of a distance-based Welch t-test, , for two sample potentially unbalanced and heteroscedastic data. We demonstrate empirically the desirable type I error and power characteristics of the new test. We compare the performance of PERMANOVA and in reanalysis of two existing microbiome datasets, where the methodology has originated.Availability and Implementation: The source code for methods and analysis of this article is available at https://github.com/alekseyenko/Tw2. Further guidance on application of these methods can be obtained from the author.Contact: alekseye@musc.edu

Cobra: a light-weight tool for static and dynamic program analysis

Static source code analysis tools have become indispensable for the development of reliable software applications. The best analyzers can reveal subtle flaws in a code base, but they can also be slow. In part this is due to the collection of detailed information about the possible data and control flow of an application to support the broadest possible range of analyses. For larger code bases it is not unusual that even the best of breed static analyzers can take an hour or more to complete an analysis. In this paper we describe a framework for a much faster, but more light-weight type of static analysis that can support interactive use for standard types of queries. The Cobra tool we designed for this purpose can scale to explore millions of lines of code interactively. The tool is mostly language agnostic, and can therefore easily be configured to resolve even dynamic program analysis queries.

AspectJ code analysis and verification with GASR

Aspect-oriented programming languages extend existing languages with new features for supporting modularization of crosscutting concerns. These features however make existing source code analysis tools unable to reason over this code. Consequently, all code analysis efforts of aspect-oriented code that we are aware of have either built limited analysis tools or were performed manually. Given the significant complexity of building them or manual analysis, a lot of duplication of effort could have been avoided by using a general-purpose tool. To address this, in this paper we present Gasr: a source code analysis tool that reasons over AspectJ source code, which may contain metadata in the form of annotations. GASR provides multiple kinds of analyses that are general enough such that they are reusable, tailorable and can reason over annotations. We demonstrate the use of GASR in two ways: we first automate the recognition of previously identified aspectual source code assumptions. Second, we turn implicit assumptions into explicit assumptions through annotations and automate their verification. In both uses GASR performs detection and verification of aspect assumptions on two well-known case studies that were manually investigated in earlier work. GASR finds already known aspect assumptions and adds instances that had been previously overlooked.

Observational slicing based on visual semantics

We describe how to slice languages with non-standard semantics.We present implementation of a slicer for Picture Description Languages.We study the PDL slices and resulting diagrams both quantitatively and qualitatively.We introduce a novel template matching for PDL slicing. Program slicing has seen a plethora of applications and variations since its introduction over 35 years ago. The dominant method for computing slices involves significant complex source-code analysis to model the dependencies in the code. A recently introduced alternative, observation-based slicing, sidesteps this complexity by observing the behavior of candidate slices. Observation-based slicing has several other strengths, including the ability to easily slice multi-language systems.However, the initial implementation of observation-based slicing, ORBS, remains rooted in tradition as it captures semantics by comparing sequences of values. This raises the question of whether it is possible to extend slicing beyond its traditional semantic roots. A few existing projects have attempted this but the extension requires considerable effort.If it is possible to build on the ORBS platform to more easily generalize slicing to languages with non-traditional semantics, then there is the potential to vastly increase the range of programming languages to which slicing can be applied. ORBS supports this by reducing the problem to that of generalizing how semantics are captured. Taking Picture Description Languages as a case study, the challenges and effectiveness of such a generalization are considered. The results show that not only is it possible to generalize the ORBS implementation, but the resulting slicer is quite effective, removing from 8% to 98% of the original source code with an average of 83%. Finally a qualitative look at the slices finds the technique very effective, at times producing minimal slices.

Aspect Oriented Re-engineering of Legacy Software Using Cross-Cutting Concern Characterization and Significant Code Smells Detection

Although object-oriented programming (OOP) methodologies immensely promote reusable and well-factored decomposition of complex source code, legacy software systems often show symptoms of deteriorating design over time due to lack of maintenance. Software systems may have different business and application contexts, but most of these systems require similar maintenance mechanism of understanding, analysis and transformation. As a consequence, intensive re-engineering efforts based on the model driven approach can be effective ensuring that best practices are followed during maintenance and eventually reducing the development cost. In this paper, we suggest detailed framework of re-engineering which includes: (i) rigorous and automated source code analysis technique for identification, characterization and prioritization of most prominent and threatening design flaws in legacy software, (ii) migration of existing the code to aspect-oriented programming (AOP) code by exploiting current state of art for aspect mining mechanism and incorporating behavioral knowledge of cross-cutting concerns. To exemplify how the approach works a case study has been conducted to experimentally validate the idea and analyze the effect of process on specific software quality spectrum. An explicit analysis of prevalent work on the subject and their critical reviews are also presented to further enhance the recognition of proposed re-engineering framework.

Source Code Analysis: Current and Future Trends & Challenges

The increasing complexity of software systems is making source code analysis a more economic option to automate the identification of defects, vulnerabilities and inefficiencies. This paper initially outlines the general anatomy of automatic source code analyzers, dimensions of analysis that can be performed with today’s state-of-the-art tools, various limitations of automatic source code analysis in the areas of programming language coverage, quantity of false positive claims, system architecture breakdowns and code/time complexity. The paper is concluded by presenting future tentative trends of source code analysis.

Reducing Friction in Software Development

Software is being produced so fast that its growth hinders its sustainability. Technical debt, which encompasses internal software quality, evolution and maintenance, reengineering, and economics, is growing such that its management is becoming the dominant driver of software engineering progress. It spans the software engineering life cycle, and its management capitalizes on recent advances in fields such as source code analysis, quality measurement, and project management. Managing technical debt will become an investment activity applying economic theories. It will effectively address the architecture level and will offer specific processes and tools employing data science and analytics to support decision making. It will also be an essential part of the software engineering curriculum. Getting ahead of the software quality and innovation curve will inevitably involve establishing technical-debt management as a core software engineering practice. This article is part of a special issue on the Future of Software Engineering.

Основанный на резюме метод реализации произвольных контекстно-чувствительных проверок при анализе исходного кода посредством символьного выполнения

A specific approach to summary-based interprocedural symbolic execution is described. The approach is suitable for analysis of program source code developed with high-level programming languages and allows executing arbitrarily complex checks during symbolic execution, including throwing reports in the callee function about defects that only become certain within the caller context. The structure of the function summary, procedure of applying the summary in a particular context, composition of symbolic values for particular contexts, effect of summary-based analysis on complexity of implementing specific checker modules, procedure for constructing path-sensitive bug reports, and other aspects of the implementation are discussed in detail. A particular implementation of the approach, based on Clang Static Analyzer, is described. The implementation is scalable enough to allow analysis of large-scale software projects in reasonable time, finding bugs faster than the existing implementation of the inlining-based interprocedural analysis, without sacrificing correctness and soundness of the analysis. Particular checker modules, which find various defects, such as integer overflows, modifications of constant-qualified memory, multithreading issues, array bound checks, exception safety checks, and file stream errors, were updated to use the summary-based approach, demonstrating flexibility of the technique proposed. The implementation was tested by running full intra-unit inter-procedural analysis of the Android Open Source Project codebase.

Statistics done wrong: the woefully complete guide

Scientific progress depends on good research, and good research needs good statistics. But statistical analysis is tricky to get right, even for the best and brightest of us. You'd be surprised how many scientists are doing it wrong. Statistics Done Wrong is a pithy, essential guide to statistical blunders in modern science that will show you how to keep your research blunder-free. You'll examine embarrassing errors and omissions in recent research, learn about the misconceptions and scientific politics that allow these mistakes to happen, and begin your quest to reform the way you and your peers do statistics. You'll find advice on: Asking the right question, designing the right experiment, choosing the right statistical analysis, and sticking to the plan How to think about p values, significance, insignificance, confidence intervals, and regression Choosing the right sample size and avoiding false positives Reporting your analysis and publishing your data and source code Procedures to follow, precautions to take, and analytical software that can help Scientists: Read this concise, powerful guide to help you produce statistically sound research. Statisticians: Give this book to everyone you know. The first step toward statistics done right is Statistics Done Wrong.

Improving static analyses of C programs with conditional predicates

Static code analysis is increasingly used to guarantee the absence of undesirable behaviors in industrial programs. Designing sound analyses is a continuing trade-off between precision and complexity. Notably, dataflow analyses often perform overly wide approximations when two control-flow paths meet, by merging states from each path.This paper presents a generic abstract interpretation based framework to enhance the precision of such analyses on join points. It relies on predicated domains, that preserve and reuse information valid only inside some branches of the code. Our predicates are derived from conditional statements, and postpone the loss of information.The work has been integrated into Frama-C, a C source code analysis platform. Experiments on real generated code show that our approach scales, and improves significantly the precision of the existing analyses of Frama-C.

Program Characterization Using Runtime Values and Its Application to Software Plagiarism Detection

Illegal code reuse has become a serious threat to the software community. Identifying similar or identical code fragments becomes much more challenging in code theft cases where plagiarizers can use various automated code transformation or obfuscation techniques to hide stolen code from being detected. Previous works in this field are largely limited in that (i) most of them cannot handle advanced obfuscation techniques, and (ii) the methods based on source code analysis are not practical since the source code of suspicious programs typically cannot be obtained until strong evidences have been collected. Based on the observation that some critical runtime values of a program are hard to be replaced or eliminated by semantics-preserving transformation techniques, we introduce a novel approach to dynamic characterization of executable programs. Leveraging such invariant values, our technique is resilient to various control and data obfuscation techniques. We show how the values can be extracted and refined to expose the critical values and how we can apply this runtime property to help solve problems in software plagiarism detection. We have implemented a prototype with a dynamic taint analyzer atop a generic processor emulator. Our value-based plagiarism detection method (VaPD) uses the longest common subsequence based similarity measuring algorithms to check whether two code fragments belong to the same lineage. We evaluate our proposed method through a set of real-world automated obfuscators. Our experimental results show that the value-based method successfully discriminates 34 plagiarisms obfuscated by SandMark, plagiarisms heavily obfuscated by KlassMaster, programs obfuscated by Thicket, and executables obfuscated by Loco/Diablo.

Identifying Renaming Opportunities by Expanding Conducted Rename Refactorings

To facilitate software refactoring, a number of approaches and tools have been proposed to suggest where refactorings should be conducted. However, identification of such refactoring opportunities is usually difficult because it often involves difficult semantic analysis and it is often influenced by many factors besides source code. For example, whether a software entity should be renamed depends on the meaning of its original name (natural language understanding), the semantics of the entity (source code semantics), experience and preference of developers, and culture of companies. As a result, it is difficult to identify renaming opportunities. To this end, in this paper we propose an approach to identify renaming opportunities by expanding conducted renamings. Once a rename refactoring is conducted manually or with tool support, the proposed approach recommends to rename closely related software entities whose names are similar to that of the renamed entity. The rationale is that if an engineer makes a mistake in naming a software entity it is likely for her to make the same mistake in naming similar and closely related software entities. The main advantage of the proposed approach is that it does not involve difficult semantic analysis of source code or complex natural language understanding. Another advantage of this approach is that it is less influenced by subjective factors, e.g., experience and preference of software engineers. The proposed approach has been evaluated on four open-source applications. Our evaluation results show that the proposed approach is accurate in recommending entities to be renamed (average precision 82 percent) and in recommending new names for such entities (average precision 93 percent). Evaluation results also suggest that a substantial percentage (varying from 20 to 23 percent) of rename refactorings are expansible.

On the capability of static code analysis to detect security vulnerabilities

Context:Static analysis of source code is a scalable method for discovery of software faults and security vulnerabilities. Techniques for static code analysis have matured in the last decade and many tools have been developed to support automatic detection.Objective: This research work is focused on empirical evaluation of the ability of static code analysis tools to detect security vulnerabilities with an objective to better understand their strengths and shortcomings.Method: We conducted an experiment which consisted of using the benchmarking test suite Juliet to evaluate three widely used commercial tools for static code analysis. Using design of experiments approach to conduct the analysis and evaluation and including statistical testing of the results are unique characteristics of this work. In addition to the controlled experiment, the empirical evaluation included case studies based on three open source programs.Results: Our experiment showed that 27% of C/C++ vulnerabilities and 11% of Java vulnerabilities were missed by all three tools. Some vulnerabilities were detected by only one or combination of two tools; 41% of C/C++ and 21% of Java vulnerabilities were detected by all three tools. More importantly, static code analysis tools did not show statistically significant difference in their ability to detect security vulnerabilities for both C/C++ and Java. Interestingly, all tools had median and mean of the per CWE recall values and overall recall across all CWEs close to or below 50%, which indicates comparable or worse performance than random guessing. While for C/C++ vulnerabilities one of the tools had better performance in terms of probability of false alarm than the other two tools, there was no statistically significant difference among tools’ probability of false alarm for Java test cases.Conclusions: Despite recent advances in methods for static code analysis, the state-of-the-art tools are not very effective in detecting security vulnerabilities.

Automatic Dynamic Data Structures Recognition to Support the Migration of Applications to the Cloud

The work presented in this manuscript describes a methodology for the recognition of Dynamic Data structures, with a focus on Queues, Pipes and Lists. The recognition of such structures is used as a basis for the mapping of sequential code to Cloud Services, in order to support the semi-automatic restructuring of source software. The goal is to develop a complete methodology and a framework based on it to ease the efforts needed to port native applications to a Cloud Platform and simplify the relative complex processes. In order to achieve such an objective, the proposed technique exploits an intermediate representation of the code, consisting in parallel Skeletons and Cloud Patterns. Logical inference rules act on a knowledge base, built during the analysis of the source code, to guide the recognition and mapping processes. Both the inference rules and knowledge base are expressed in Prolog. A prototype tool for the automatic analysis of sequential source code and its mapping to a Cloud Pattern is also presented.