Extract Method is one of the most frequently performed refactoring operations for the decomposition of large and complex methods, which can also be combined with other refactoring operations to remove a variety of design flaws. Several Extract Method refactoring tools have been proposed based on the quantification of extraction criteria. To the best of our knowledge, state-of-the-art related techniques can be broadly divided into two categories: the first line is non-machine-learning-based approaches built on heuristics, and the second line is machine learning-based approaches built on historical data. Most of these approaches characterize the extraction criteria by deriving software metrics from fine-grained code properties. However, in most cases, these metrics can be challenging to concretize, and their selections and thresholds also largely rely on expert knowledge. Thus, in this paper, we propose an approach to automatically recommend Extract Method refactoring opportunities named REMS via mining multi-view representations from code property graph. We fuse various representations together using compact bilinear pooling and further train machine learning classifiers to guide the extraction of suitable lines of code as new method. We evaluate our approach on two publicly available datasets. The results show that our approach outperforms five state-of-the-art refactoring tools including GEMS, JExtract, SEMI, JDeodorant, and Segmentation in effectiveness and usefulness. Our approach demonstrates an increase of 29% in precision, 15% in recall, and 23% in f1-measure. The results also unveil practical suggestions and provide new insights that benefit additional extract-related refactoring techniques.

Software vulnerabilities are now reported unprecedentedly due to the recent development of automated vulnerability hunting tools. However, fixing vulnerabilities still mainly depends on programmers’ manual efforts. Developers need to deeply understand the vulnerability and affect the system’s functions as little as possible. In this paper, with the advancement of Neural Machine Translation (NMT) techniques, we provide a novel approach called SeqTrans to exploit historical vulnerability fixes to provide suggestions and automatically fix the source code. To capture the contextual information around the vulnerable code, we propose to leverage data-flow dependencies to construct code sequences and feed them into the state-of-the-art transformer model. The fine-tuning strategy has been introduced to overcome the small sample size problem. We evaluate SeqTrans on a dataset containing 1,282 commits that fix 624 CVEs in 205 Java projects. Results show that the accuracy of SeqTrans outperforms the latest techniques and achieves 23.3% in statement-level fix and 25.3% in CVE-level fix. In the meantime, we look deep inside the result and observe that the NMT model performs very well in certain kinds of vulnerabilities like CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization).

Blockchain technology has the characteristics of decentralization, traceability and tamper-proof, which creates a reliable decentralized trust mechanism, further accelerating the development of blockchain finance. However, the anonymization of blockchain hinders market regulation, resulting in increasing illegal activities such as money laundering, gambling and phishing fraud on blockchain financial platforms. Thus, financial security has become a top priority in the blockchain ecosystem, calling for effective market regulation. In this paper, we consider identifying Ethereum accounts from a graph classification perspective, and propose an end-to-end graph neural network framework namedEthident, to characterize the behavior patterns of accounts and further achieve account de-anonymization. Specifically, we first construct an Account Interaction Graph (AIG) using raw Ethereum data. Then we design a hierarchical graph attention encoder namedHGATEas the backbone of our framework, which can effectively characterize the node-level account features and subgraph-level behavior patterns. For alleviating account label scarcity, we further introduce contrastive self-supervision mechanism as regularization to jointly train our framework. Comprehensive experiments on Ethereum datasets demonstrate that our framework achieves superior performance in account identification, yielding 1.13% ~ 4.93% relative improvement over previous state-of-the-art. Furthermore, detailed analyses illustrate the effectiveness ofEthidentin identifying and understanding the behavior of known participants in Ethereum (e.g. exchanges, miners, etc.), as well as that of the lawbreakers (e.g. phishing scammers, hackers, etc.), which may aid in risk assessment and market regulation.

In recent years, Complex Network theory and graph algorithms have been proved to be effective in predicting software bugs. On the other hand, as a widely-used algorithm in Complex Network theory, k-core decomposition has been used in software engineering domain to identify key classes. Intuitively, key classes are more likely to be buggy since they participate in more functions or have more interactions and dependencies. However, there is no existing research uses k-core decomposition to analyze software bugs. To fill this gap, we first use k-core decomposition on Class Dependency Networks to analyze software bug distribution from a new perspective. An interesting and widely existed tendency is observed: for classes in k-cores with larger k values, there is a stronger possibility for them to be buggy. Based on this observation, we then propose a simple but effective equation named as top-core which improves the order of classes in the suspicious class list produced by effort-aware bug prediction models. Based on an empirical study on 18 open-source Java systems, we show that the bug prediction models' performances are significantly improved in 85.2 percent experiments in the cross-validation scenario and in 80.95 percent experiments in the forward-release scenario, after using top-core. The models' average performances are improved by 11.5 and 12.6 percent, respectively. It is concluded that the proposed top-core equation can help the testers or code reviewers locate the real bugs more quickly and easily in software bug prediction practices.

Test case prioritization is widely used in testing with the purpose of detecting faults as early as possible. Most existing techniques exploit coverage to prioritize test cases based on the hypothesis that a test case with higher coverage is more likely to catch bugs. Statement coverage and function coverage are the two widely used coverage granularity. The former typically achieves better test case prioritization in terms of fault detection capability, while the latter is more efficient because it incurs less overhead. In this paper we argue that static information such as statement and function coverage may not be the best criteria for guiding dynamic executions. Executions that cover the same set of statements /functions can may exhibit very different behavior. Therefore, the abstraction that reduces program behavior to statement/function coverage can be too simplistic to predicate fault detection capability. We propose a new approach that exploits function call sequences to prioritize test cases. This is based on the observation that the function call sequences rather than the set of executed functions is a better indicator of program behavior. Test cases that reveal unique function call sequences may have better chance to encounter faults. We choose function instead of statement sequences due to the consideration of efficiency. We have developed and implemented a new prioritization strategy AGC (Additional Greedy method Call sequence), that exploit function call sequences. We compare AGC against existing test case prioritization techniques on eight real-world open source Java projects. Our experiments show that our approach outperforms existing techniques on large programs (but not on small programs) in terms of bug detection capability. The performance shows a growth trend when the size of program increases.

Convolutional Neural Network (CNN) has achieved success in Android malware detection and many other fields. However, the empirical evaluation of previous studies have shown that no single machine learning classifier is capable to provide the best accuracy in any context. In this paper, a new method for Android malware detection is proposed, we replace the single machine learning classifier in CNN with Adaptive Selection of Classifiers (ASC) to improve the performance of malware classification. We test our method on 1746 apk samples with 1000 malware, the result shows the accuracy of our approach performs 4.27% better than the state-of-art CNN model used in the current research.

Network measures have been proved to be useful in predicting software defects. Leveraging the dependency relationships between software modules, network measures can capture various structural features of software systems. However, existing studies have relied on user-defined network measures (e.g., degree statistics or centrality metrics), which are inflexible and require high computation cost, to describe the structural features. In this paper, we propose a new method called node2defect which uses a newly proposed network embedding technique, node2vec, to automatically learn to encode dependency network structure into low-dimensional vector spaces to improve software defect prediction. Specifically, we firstly construct a program's Class Dependency Network. Then node2vec is used to automatically learn structural features of the network. After that, we combine the learned features with traditional software engineering features, for accurate defect prediction. We evaluate our method on 15 open source programs. The experimental results show that in average, node2defect improves the state-of-the-art approach by 9.15% in terms of F-measure.