基于开发者协作关系和信息检索的需求跟踪系统

目前自动化需求跟踪的研究广泛使用文本信息检索技术。然而信息检索会遗漏一些文本不相似但是实际相关的软件制品,导致自动化跟踪的精度不高。针对上述问题,提出利用开发者协作关系来进行优化,研发了基于开发者协作关系和信息检索的需求跟踪系统。该系统在进行需求跟踪时,首先用信息检索推荐与需求文本上相似的代码,然后从代码提交日志中挖掘开发者协作关系,根据开发者协作关系再推荐相关代码,用户根据两次推荐的结果确定正确的需求代码跟踪关系。试验结果表明该系统能够找到信息检索遗漏的需求跟踪关系,能够提高自动化跟踪的准确性,节省跟踪时间。     

Studying software evolution using topic models

Topic models are generative probabilistic models which have been applied to information retrieval to automatically organize and provide structure to a text corpus. Topic models discover topics in the corpus, which represent real world concepts by frequently co-occurring words. Recently, researchers found topics to be effective tools for structuring various software artifacts, such as source code, requirements documents, and bug reports. This research also hypothesized that using topics to describe the evolution of software repositories could be useful for maintenance and understanding tasks. However, research has yet to determine whether these automatically discovered topic evolutions describe the evolution of source code in a way that is relevant or meaningful to project stakeholders, and thus it is not clear whether topic models are a suitable tool for this task.In this paper, we take a first step towards evaluating topic models in the analysis of software evolution by performing a detailed manual analysis on the source code histories of two well-known and well-documented systems, JHotDraw and jEdit. We define and compute various metrics on the discovered topic evolutions and manually investigate how and why the metrics evolve over time. We find that the large majority (87%–89%) of topic evolutions correspond well with actual code change activities by developers. We are thus encouraged to use topic models as tools for studying the evolution of a software system.     

代码相似性检测方法与工具综述

在代码开源的潮流下,代码克隆在提高代码质量和降低开发成本的同时,一定程度地影响了软件系统的稳定性、健壮性与可维护性。代码相似性检测在计算机与信息安全发展方面具有重要的意义。为应对代码克隆带来的各种危害,目前学术界和工业界提出了很多代码相似性检测的方法,这些方法按照源代码信息处理程度可分为基于文本、词法、语法、语义和度量值5类;并开发了相应的检测工具,这些工具实现了很好的检测效果,但在大数据时代背景下也面临着数据规模不断扩大带来的一系列挑战。文中综述了代码相似性检测的方法,对5类检测方法做了详细比较;结合传统方法与机器学习技术,归类了不同检测方法对应的检测工具;按照不同评价标准评估了检测工具的检测效果,总结了每种检测方法的首选检测工具,并对未来代码相似性检测的研究方向做出了展望。     

Semantic clustering: Identifying topics in source code

Many of the existing approaches in Software Comprehension focus on program structure or external documentation. However, by analyzing formal information the informal semantics contained in the vocabulary of source code are overlooked. To understand software as a whole, we need to enrich software analysis with the developer knowledge hidden in the code naming. This paper proposes the use of information retrieval to exploit linguistic information found in source code, such as identifier names and comments. We introduce Semantic Clustering, a technique based on Latent Semantic Indexing and clustering to group source artifacts that use similar vocabulary. We call these groups semantic clusters and we interpret them as linguistic topics that reveal the intention of the code. We compare the topics to each other, identify links between them, provide automatically retrieved labels, and use a visualization to illustrate how they are distributed over the system. Our approach is language independent as it works at the level of identifier names. To validate our approach we applied it on several case studies, two of which we present in this paper.Note: Some of the visualizations presented make heavy use of colors. Please obtain a color copy of the article for better understanding.     

Improving Fault Detection in Modified Code ——- A Study from the Telecommunication Industry

Many software systems are developed in a number of consecutive releases. In each release not only new code is added but also existing code is often modified. In this study we show that the modified code can be an important source of faults. Faults are widely recognized as one of the major cost drivers in software projects. Therefore, we look for methods that improve the fault detection in the modified code. We propose and evaluate a number of prediction models that increase the efficiency of fault detection. To build and evaluate our models we use data collected from two large telecommunication systems produced by Ericsson. We evaluate the performance of our models by applying them both to a different release of the system than the one they are built on and to a different system. The performance of our models is compared to the performance of the theoretical best model, a simple model based on size, as well as to analyzing the code in a random order （not using any model）. We find that the use of our models provides a significant improvement over not using any model at all and over using a simple model based on the class size. The gain offered by our models corresponds to 38-57% of the theoretical maximum gain.     

Bug localization using latent Dirichlet allocation

ContextSome recent static techniques for automatic bug localization have been built around modern information retrieval (IR) models such as latent semantic indexing (LSI). Latent Dirichlet allocation (LDA) is a generative statistical model that has significant advantages, in modularity and extensibility, over both LSI and probabilistic LSI (pLSI). Moreover, LDA has been shown effective in topic model based information retrieval. In this paper, we present a static LDA-based technique for automatic bug localization and evaluate its effectiveness.ObjectiveWe evaluate the accuracy and scalability of the LDA-based technique and investigate whether it is suitable for use with open-source software systems of varying size, including those developed using agile methods.MethodWe present five case studies designed to determine the accuracy and scalability of the LDA-based technique, as well as its relationships to software system size and to source code stability. The studies examine over 300 bugs across more than 25 iterations of three software systems.ResultsThe results of the studies show that the LDA-based technique maintains sufficient accuracy across all bugs in a single iteration of a software system and is scalable to a large number of bugs across multiple revisions of two software systems. The results of the studies also indicate that the accuracy of the LDA-based technique is not affected by the size of the subject software system or by the stability of its source code base.ConclusionWe conclude that an effective static technique for automatic bug localization can be built around LDA. We also conclude that there is no significant relationship between the accuracy of the LDA-based technique and the size of the subject software system or the stability of its source code base. Thus, the LDA-based technique is widely applicable.     

基于LDA的软件代码主题摘要自动生成方法

理解软件代码的功能是软件复用的一个重要环节。基于主题建模技术的代码理解方法能够挖掘软件代码中潜在的主题,这些主题在一定程度上代表了软件代码所实现的功能。但是使用主题建模技术所挖掘出的代码主题有着语义模糊、难以理解的弊端。潜在狄利克雷分配(Latent Dirichlet Allocation,LDA)技术是一种比较常用的主题建模技术, 其在软件代码主题挖掘领域已取得了较好的结果,但同样存在上述问题。为此,需要为主题生成解释性文本描述。基于LDA的软件代码主题摘要自动生成方法除了利用主题建模技术对源代码生成主题之外,还利用文档、问答信息等包含软件系统功能描述的各类软件资源挖掘出代码主题的描述文本并提取摘要,从而能够更好地帮助开发人员理解软件的功能。     

Agents for case-based software reuse

The effective reuse of previously engineered components has become a core activity in any object-oriented software development project. The task is, however, often problematic when it comes to actual retrieval and understanding of the class library in, e.g., Java. Newcomers, especially, in a software company or novices in Java programming will need time to obtain a good overview of available components. This article explores the use of intelligent agents in a case-based tool for software reuse. By introducing agent support to the retrieval mechanism of the tool we show how retrieval efficiency may be improved. The cooperating agents assist the user in retrieval of code for potential reuse in an automated way and in the background. This makes it possible for the developer to concentrate fully on her task. The tool aids in program understanding and adaptation. Thus, it allows an exploratory approach to program development and increases reuse efficiency.     

基于程序控制流图源代码相似程度分析系统

源代码相似程度分析在软件工程和计算机教学等领域都有重要的应用.软件工程领域的源代码盗窃和著作权纠纷仲裁,计算机教学领域的学生作业作弊分析都需要源代码相似程度的分析.良好的源代码相似程序分析软件还可以应用于相似代码聚类和搜索引擎的源代码搜索领域.尽管源代码相似程度分析问题由来已久,但是这个问题并没有令人十分满意和惊喜的研究结果.源代码有其特殊结构,使用传统的纯文本相似度分析显然是不合适的.将首先介绍这个问题的研究历史和进展,简单分析这个问题的难点所在,继而介绍一个新的基于程序控制流图分析的源代码相似程度分析系统,并给出其算法和实现细节.文章最后将分析这个方法的优劣所在,讨论这个方法的进一步改进方向.     

二进制代码相似性检测技术综述

代码相似性检测常用于代码预测、知识产权保护和漏洞搜索等领域,可分为源代码相似性检测和二进制代码相似性检测。软件的源代码通常难以获得,因此针对二进制代码的相似性检测技术能够适用的场景更加广泛,学术界也先后提出了多种检测技术,文中对近年来该领域的研究进行了综述。首先总结代码相似性检测的基本流程和需要解决的难题(如跨编译器、跨编译器优化配置、跨指令架构检测);然后根据关注的代码信息的不同,将当前的二进制代码相似性检测技术分为4类,即基于文本的、基于属性度量的、基于程序逻辑的和基于语义的检测技术,并列举了部分代表性方法和工具(如Karta,discovRE,Ge-nius,Gemini,SAFE等);最后根据发展脉络和最新研究成果,对该领域的发展方向进行了分析和论述。     

On the relationship between similar requirements and similar software

Recommender systems for requirements are typically built on the assumption that similar requirements can be used as proxies to retrieve similar software. When a stakeholder proposes a new requirement, natural language processing (NLP)-based similarity metrics can be exploited to retrieve existing requirements, and in turn, identify previously developed code. Several NLP approaches for similarity computation between requirements are available. However, there is little empirical evidence on their effectiveness for code retrieval. This study compares different NLP approaches, from lexical ones to semantic, deep-learning techniques, and correlates the similarity among requirements with the similarity of their associated software. The evaluation is conducted on real-world requirements from two industrial projects from a railway company. Specifically, the most similar pairs of requirements across two industrial projects are automatically identified using six language models. Then, the trace links between requirements and software are used to identify the software pairs associated with each requirements pair. The software similarity between pairs is then automatically computed with JPLag. Finally, the correlation between requirements similarity and software similarity is evaluated to see which language model shows the highest correlation and is thus more appropriate for code retrieval. In addition, we perform a focus group with members of the company to collect qualitative data. Results show a moderately positive correlation between requirements similarity and software similarity, with the pre-trained deep learning-based BERT language model with preprocessing outperforming the other models. Practitioners confirm that requirements similarity is generally regarded as a proxy for software similarity. However, they also highlight that additional aspect comes into play when deciding software reuse, e.g., domain/project knowledge, information coming from test cases, and trace links. Our work is among the first ones to explore the relationship between requirements and software similarity from a quantitative and qualitative standpoint. This can be useful not only in recommender systems but also in other requirements engineering tasks in which similarity computation is relevant, such as tracing and change impact analysis.

     

基于软件结构的文档与代码间可追踪性研究

正确建立软件文档与代码间的可追踪关系对程序理解、软件维护等非常重要。近年来,软件文档与代码间的可追踪性研究大多基于文本词汇相似度,没有充分利用软件文档和代码所蕴含的结构信息,针对这一问题提出了将软件结构信息与信息检索模型相结合进行文档与代码间可追踪性分析的方法。通过对文档和代码结构信息的分析,改善预处理效果,优化相似度计算过程,进而提高整体方法的有效性。实验结果表明,该方法比单纯基于信息检索的方法在查全率和查准率上都有所提高,而且能提取到更多的可追踪性链。     

方法级别的细粒度软件缺陷定位方法

当软件缺陷报告在跟踪系统中被指派给开发人员进行缺陷修复之后,缺陷修复人员就需要根据提交的缺陷报告来进行软件缺陷定位,并做出相应的代码变更,以修复该软件缺陷.在缺陷修复的整个过程中,软件缺陷定位占用了开发人员大量的时间.提出了一种方法级别的细粒度软件缺陷定位方法MethodLocator,以提高软件修复人员的工作效率.MethodLocator首先对缺陷报告和源代码方法体利用词向量（word2vec）和TF-IDF结合的方法进行向量表示;然后,根据源代码文件中方法体之间的相似度对方法体进行扩充;最后,通过对扩充后的方法体和缺陷报告计算其余弦距离并排序,来定位为修复软件缺陷所需做出变更的方法.在4个开源软件项目ArgoUML、Ant、Maven和Kylin上的实验结果表明,MethodLocator方法优于现有的缺陷定位方法,它能够有效地将软件缺陷定位到源代码的方法级别上.     

Software assessment using metrics: A comparison across large C++ and Java systems

This paper presents an assessment method to evaluate the quality of object oriented software systems. The assessment method is based on source code abstraction, object–oriented metrics and graphical representation. The metrics used and the underlying model representing the software are presented. The assessment method experiment is part of an industrial research effort with the Bell Canada Quality Engineering and Research Group. It helps evaluators assess the quality and risks associated with software by identifying code fragments presenting unusual characteristics. The assessment method evaluates object–oriented software systems at three levels of granularity: system level, class level and method level. One large C++ and eight Java software systems, for a total of over one million lines of code, are presented as case studies. A critical analysis of the results is presented comparing the systems and the two languages. This revised version was published online in June 2006 with corrections to the Cover Date.     

基于代码克隆检测的代码来源分析方法

随着软件生态系统和开源社区的发展,代码常在多个软件系统中复制、传播和演化,给软件系统带来了软件质量的不确定性和风险,因此,高效地查找软件系统代码可能的来源是当前研究的热点之一。提出一种基于代码克隆检测的代码来源分析方法,将目标软件代码以方法为单位切割为代码片段,转换为词袋后,在大规模代码资源库中进行并行化代码克隆检测,从而实现方法粒度的代码来源分析。基于该方法,设计并实现了一个代码来源分析工具。该工具能自动分析被测软件项目代码与代码资源库中多个项目以及版本之间的可能来源。实验结果表明,该系统能够有效地找出目标项目在大规模代码库中的代码来源信息,辅助软件维护人员理解和维护代码。     

面向代码相似性检测的相似哈希改进方法

代码相似性检测（Code Similarity Detection）是软件工程领域的基本任务之一，其在剽窃检测、许可证违反检测、软件复用分析以及漏洞发现等方向均有重要作用.随着软件开源化的普及以及开源代码量的高速增长，开源代码在各个领域的应用日益频繁，给传统的代码相似性检测方法带来了新的挑战.现有的一些基于词法、语法、语义的检测方法存在算法较为复杂，对解析工具有依赖性，消耗资源高，可移植性差，候选对比项数量较多等问题，在大规模代码库上有一定局限性.基于相似哈希（simhash）指纹的代码相似性检测算法将代码降维至一个指纹，能够在数据集规模较大的情况下实现快速相似文件检索，并通过海明距离阈值控制匹配结果的相似度范围.通过实验对现有的基于代码行粒度的相似哈希算法进行验证，发现其在大规模数据集下存在行覆盖问题，即高频行特征对低频行特征的覆盖现象，导致结果精确度较低.受TF-IDF算法思想启发，针对上述问题创新性地提出了分语言行筛选优化方法，通过各种语言的行筛选器对代码文件行序列进行筛选，从而消除高频出现但语义信息包含较少的行对结果的影响.对改进前后方法进行一系列对比实验，结果表明改进后的方法在海明距离阈值为0至8的情况下均能够实现高精确度的相似文件对检索，阈值为8时在两个数据集下的精确度较改进前的方法分别提升了98.6%和52.2%.在本文建立的130万个开源项目，386486112个项目文件的大规模代码库上进行实验，验证了本文的方法能够快速检测出待测文件的相似文件结果，平均单个文件检测时间为0.43s，并取得了97%以上的检测精度.     

Optimal Prefix Codes And Huffman Codes

Existence of the optimal prefix codes is shown in this paper. Relationship between the optimal prefix code and the Huffman code is also discussed. We prove that all Huffman codes are optimal prefix codes and conversely optimal prefix codes need not be Huffman codes. Especially, the problem of whether the optimal prefix code has to be maximal is presented. Although for information source alphabets of being not greater than four letters we show that an optimal prefix code must be maximal, it remains to be an open problem in general. As seen from Huffman codes, optimal prefix codes are used not only for statistical modeling but also for dictionary methods. Moreover, it is obtained that the complexity of breaking an optimal prefix code is NP-complete from the viewpoint of computational difficulty.     

代码混淆技术研究综述

代码混淆技术是一种语义保留的代码变换技术,是衡量代码相似度检测方法的重要指标之一。本文主要对现有的代码混淆手段的研究现状和发展进行了综述。首先阐述了代码混淆的相关定义,然后介绍了现有的几种代码混淆手段,对代码混淆手段进行了系统的分类,分别介绍了每种代码混淆手段。最后对代码混淆手段进行了总结与评价。     

基于多特征值的源代码相似性检测技术

在软件开发的过程中,开发人员通过复制粘贴式的开发方式或者模块化的开发方式来完成需求是十分常见的,这两种开发方式可以提高开发效率,但同时会导致软件系统中出现大量的相同代码或者相似代码,大量的相似代码会给软件维护等方面带来很大的困难,这也是最常见的重构对象。源代码相似性度量是指利用一定的检测方法分析程序源代码间的相似程度。该技术被应用于代码抄袭检测、代码克隆检测、软件知识产权保护、代码复用等多个领域。为了提高代码相似性度量的准确性,提出了一种基于多特征值的源代码相似性检测技术。构建了源代码注释、型构、代码文本语句与结构中特征提取的方法,并给出了源代码相似度检测的度量模型。通过与权威的代码相似检测系统Moss进行对比实验,结果表明该方法可以更准确地检测出相似代码。     

Source code size estimation approaches for object-oriented systems from UML class diagrams: A comparative study

BackgroundSource code size in terms of SLOC (source lines of code) is the input of many parametric software effort estimation models. However, it is unavailable at the early phase of software development.ObjectiveWe investigate the accuracy of early SLOC estimation approaches for an object-oriented system using the information collected from its UML class diagram available at the early software development phase.MethodWe use different modeling techniques to build the prediction models for investigating the accuracy of six types of metrics to estimate SLOC. The used techniques include linear models, non-linear models, rule/tree-based models, and instance-based models. The investigated metrics are class diagram metrics, predictive object points, object-oriented project size metric, fast&&serious class points, objective class points, and object-oriented function points.ResultsBased on 100 open-source Java systems, we find that the prediction model built using object-oriented project size metric and ordinary least square regression with a logarithmic transformation achieves the highest accuracy (mean MMRE = 0.19 and mean Pred(25) = 0.74).ConclusionWe should use object-oriented project size metric and ordinary least square regression with a logarithmic transformation to build a simple, accurate, and comprehensible SLOC estimation model.