The e X tensible M arkup L anguage (XML) is a file format widely used for data transmission in modern software development. In recent years, embedding SQL statements in XML files (i.e., XML-SQL) has become a popular way for developing applications with database access capability. Typically, XML-SQL code snippets demonstrate similar functionalities and structures, leading to repetitive programming work. Therefore, leveraging pre-trained code models for automated code generation presents a promising way to alleviate duplicated efforts and enhance the efficiency of developing XML-SQL code. However, XML-SQL code has strong domain-specific characteristics that general pre-trained code models typically struggle to fully harness, thereby leading to limited overall performance of general pre-trained code models. In this article, we aim to address the challenge of handling this domain-specific knowledge. First, we propose a code updating task and construct the corresponding TwinXSQL dataset to better evaluate the model’s code generation performance in the XML-SQL domain. Then, we leverage the common characteristics of XML-SQL and other programming languages (i.e., all programming languages impose grammar constraints on behavior) to design a bipartite-grammar–aware training framework (named BGA) for unsupervised pre-training, thereby improving the transfer of general-purpose code models to the XML-SQL domain. Specifically, we divide the XML-SQL code into two types of grammatical components: structure components and value components. During pre-training, we undertake three tasks, each designed to learn the internal information of these grammatical components and the relationships between them, enabling the pre-training process to better incorporate previously unlearned domain-specific knowledge of XML-SQL code. Our experimental results show that our trained model XSQLT5-base (220M) improves accuracy by 13.8% compared to the similarly sized CodeT5-base (220M). Additionally, our experiments reveal that ChatGPT, due to its inability to fully learn the XML-SQL domain knowledge, achieves a much lower generation accuracy even with few-shot samples compared to our XSQLT5-base (220M) model.

Functionality-specific vulnerabilities, which mainly occur in Application Programming Interfaces (APIs) with specific functionalities, are crucial for software developers to detect and avoid. When detecting individual functionality-specific vulnerabilities, the existing two categories of approaches are ineffective because they consider only the API bodies and are unable to handle diverse implementations of functionality-equivalent APIs. To effectively detect functionality-specific vulnerabilities, we propose APISS, the first approach to utilize API doc strings and signatures instead of API bodies. APISS first retrieves functionality-equivalent APIs for APIs with existing vulnerabilities and then migrates Proof-of-Concepts (PoCs) of the existing vulnerabilities for newly detected vulnerable APIs. To retrieve functionality-equivalent APIs, we leverage a Large Language Model for API embedding to improve the accuracy and address the effectiveness and scalability issues suffered by the existing approaches. To migrate PoCs of the existing vulnerabilities for newly detected vulnerable APIs, we design a semi-automatic schema to substantially reduce manual costs. We conduct a comprehensive evaluation to empirically compare APISS with four state-of-the-art approaches of detecting vulnerabilities and two state-of-the-art approaches of retrieving functionality-equivalent APIs. The evaluation subjects include 180 widely used Java repositories using 10 existing vulnerabilities, along with their PoCs. The results show that APISS effectively retrieves functionality-equivalent APIs, achieving a Top-1 Accuracy of 0.81 while the best of the baselines under comparison achieves only 0.55. APISS is highly efficient: the manual costs are within 10 minutes per vulnerability and the end-to-end runtime overhead of testing one candidate API is less than 2 hours. APISS detects 179 new vulnerabilities and receives 60 new CVE IDs, bringing high value to security practice.

To address security vulnerabilities arising from third-party libraries, security researchers maintain databases monitoring and curating vulnerability reports. Application developers can identify libraries affected by vulnerability reports (in short, affected libraries) by directly querying the databases with their used libraries. However, the querying results of affected libraries are not reliable due to the incompleteness of vulnerability reports. Thus, current approaches model the task of identifying affected libraries as a named-entity-recognition (NER) task or an extreme multi-label learning (XML) task. These approaches suffer from highly inaccurate results in identifying affected libraries with complex and similar names, e.g., Java libraries. To address these limitations, in this article, we propose VulLibMiner, the first to identify affected libraries from textual descriptions of both vulnerabilities and libraries, together with VulLib, a Java vulnerability dataset with their affected libraries. VulLibMiner consists of a TF-IDF matcher to efficiently screen out a small set of candidate libraries and a BERT-FNN model to effectively identify affected libraries from these candidates. We evaluate VulLibMiner using four state-of-the-art/practice approaches of identifying affected libraries on both their dataset named VeraJava and our VulLib dataset. Our evaluation results show that VulLibMiner can effectively identify affected libraries with an average F1 score of 0.669 while the state-of-the-art/practice approaches achieve only 0.547.

Code generation models based on the pre-training and fine-tuning paradigm have been increasingly attempted by both academia and industry, resulting in well-known industrial models such as Codex, CodeGen, and PanGu-Coder. After being pre-trained on a large-scale corpus of code, a model is further fine-tuned with datasets specifically for the target downstream task, e.g., generating code from natural language description. The target code being generated can be classified into two types: a standalone function, i.e., a function that invokes or accesses only built-in functions and standard libraries, and a non-standalone function, i.e., a function that invokes or accesses user-defined functions or third-party libraries. To effectively generate code especially non-standalone functions (largely ignored by existing work), in this article, we present Wenwang, an approach to improving the capability of a pre-trained model on generating code beyond standalone functions. Wenwang consists of two components: a fine-tuning dataset named WenwangData and a fine-tuned model named WenwangCoder. Compared with existing fine-tuning datasets, WenwangData additionally covers non-standalone functions. Besides the docstring and code snippet for a function, WenwangData also includes its contextual information collected via program analysis. Based on PanGu-Coder, we produce WenwangCoder by fine-tuning PanGu-Coder on WenwangData with our context-aware fine-tuning technique so that the contextual information can be fully leveraged during code generation. On CoderEval and HumanEval, WenwangCoder outperforms three state-of-the-art models with similar parameter sizes (at the scale of around 300M), namely CodeGen, PanGu-Coder, and PanGu-FT. Although WenwangCoder does not outperform ChatGPT on HumanEval, WenwangCoder with smaller model parameter sizes can achieve similar effects to ChatGPT on CoderEval. Our experimental results also shed light on a number of promising optimization directions based on existing pre-trained models.

Tianyu Chen, Lin Li, ZhuLiuchuan ZhuLiuchuan, Zongyang Li, Xueqing Liu, Guangtai Liang, Qianxiang Wang, Tao Xie. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2024.

Numerous third-party libraries introduced into client projects are not actually required, resulting in modern software being gradually bloated. Software developers may spend much unnecessary effort to manage the bloated dependencies: keeping the library versions up-to-date, making sure that heterogeneous licenses are compatible, and resolving dependency conflict or vulnerability issues.

Code generation models based on the pre-training and fine-tuning paradigm have been increasingly attempted by both academia and industry, resulting in well-known industrial models such as Codex, CodeGen, and PanGu-Coder. To evaluate the effectiveness of these models, multiple existing benchmarks (e.g., HumanEval and AiXBench) are proposed, including only cases of generating a standalone function, i.e., a function that may invoke or access only built-in functions and standard libraries. However, non-standalone functions, which typically are not included in the existing benchmarks, constitute more than 70% of the functions in popular open-source projects, and evaluating models' effectiveness on standalone functions cannot reflect these models' effectiveness on pragmatic code generation scenarios (i.e., code generation for real settings of open source or proprietary code).

The performance of repository-level code completion depends upon the effective leverage of both general and repository-specific knowledge. Despite the impressive capability of code LLMs in general code completion tasks, they often exhibit less satisfactory performance on repository-level completion due to the lack of repository-specific knowledge in these LLMs. To address this problem, we propose GraphCoder, a retrieval-augmented code completion framework that leverages LLMs' general code knowledge and the repository-specific knowledge via a graph-based retrieval-generation process. In particular, GraphCoder captures the context of completion target more accurately through code context graph (CCG) that consists of control-flow, data- and control-dependence between code statements, a more structured way to capture the completion target context than the sequence-based context used in existing retrieval-augmented approaches; based on CCG, GraphCoder further employs a coarse-to-fine retrieval process to locate context-similar code snippets with the completion target from the current repository. Experimental results demonstrate both the effectiveness and efficiency of GraphCoder: Compared to baseline retrieval-augmented methods, GraphCoder achieves higher exact match (EM) on average, with increases of +6.06 in code match and +6.23 in identifier match, while using less time and space.

Unit testing is an essential activity in software development for verifying the correctness of software components. However, manually writing unit tests is challenging and time-consuming. The emergence of Large Language Models (LLMs) offers a new direction for automating unit test generation. Existing research primarily focuses on closed-source LLMs (e.g., ChatGPT and CodeX) with fixed prompting strategies, leaving the capabilities of advanced open-source LLMs with various prompting settings unexplored. Particularly, open-source LLMs offer advantages in data privacy protection and have demonstrated superior performance in some tasks. Moreover, effective prompting is crucial for maximizing LLMs' capabilities. In this paper, we conduct the first empirical study to fill this gap, based on 17 Java projects, five widely-used open-source LLMs with different structures and parameter sizes, and comprehensive evaluation metrics. Our findings highlight the significant influence of various prompt factors, show the performance of open-source LLMs compared to the commercial GPT-4 and the traditional Evosuite, and identify limitations in LLM-based unit test generation. We then derive a series of implications from our study to guide future research and practical use of LLM-based unit test generation.

Unit testing could be used to validate the correctness of basic units of the software system under test. To reduce manual efforts in conducting unit testing, the research community has contributed with tools that automatically generate unit test cases, including test inputs and test oracles (e.g., assertions). Recently, ATLAS, a deep learning (DL) based approach, was proposed to generate assertions for a unit test based on other already written unit tests. Despite promising, the effectiveness of ATLAS is still limited. To improve the effectiveness, in this work, we make the first attempt to leverage Information Retrieval (IR) in assertion generation and propose an IR-based approach, including the technique of IR-based assertion retrieval and the technique of retrieved-assertion adaptation. In addition, we propose an integration approach to combine our IR-based approach with a DL-based approach (e.g., ATLAS) to further improve the effectiveness. Our experimental results show that our IR-based approach outperforms the state-of-the-art DL-based approach, and integrating our IR-based approach with the DL-based approach can further achieve higher accuracy. Our results convey an important message that information retrieval could be competitive and worthwhile to pursue for software engineering tasks such as assertion generation, and should be seriously considered by the research community given that in recent years deep learning solutions have been over-popularly adopted by the research community for software engineering tasks.

In recent years, applying deep learning to detect semantic code clones has received substantial attention from the research community. Accordingly, various evaluation benchmark datasets, with the most popular one as BigCloneBench, are constructed and selected as benchmarks to assess and compare different deep learning models for detecting semantic clones. However, there is no study to investigate whether an evaluation benchmark dataset such as BigCloneBench is properly used to evaluate models for detecting semantic code clones. In this article, we present an experimental study to show that BigCloneBench typically includes semantic clone pairs that use the same identifier names, which however are not used in non-semantic-clone pairs. Subsequently, we propose an undesirable-by-design Linear-Model that considers only which identifiers appear in a code fragment; this model can achieve high effectiveness for detecting semantic clones when evaluated on BigCloneBench, even comparable to state-of-the-art deep learning models recently proposed for detecting semantic clones. To alleviate these issues, we abstract a subset of the identifier names (including type, variable, and method names) in BigCloneBench to result in AbsBigCloneBench and use AbsBigCloneBench to better assess the effectiveness of deep learning models on the task of detecting semantic clones.

Code clones are similar code fragments that share the same semantics but may differ syntactically to various degrees. Detecting code clones helps reduce the cost of software maintenance and prevent faults. Various approaches of detecting code clones have been proposed over the last two decades, but few of them can detect semantic clones, i.e., code clones with dissimilar syntax. Recent research has attempted to adopt deep learning for detecting code clones, such as using tree-based LSTM over Abstract Syntax Tree (AST). However, it does not fully leverage the structural information of code fragments, thereby limiting its clone-detection capability. To fully unleash the power of deep learning for detecting code clones, we propose a new approach that uses tree-based convolution to detect semantic clones, by capturing both the structural information of a code fragment from its AST and lexical information from code tokens. Additionally, our approach addresses the limitation that source code has an unlimited vocabulary of tokens and models, and thus exploiting lexical information from code tokens is often ineffective when dealing with unseen tokens. Particularly, we propose a new embedding technique called position-aware character embedding (PACE), which essentially treats any token as a position-weighted combination of character one-hot embeddings. Our experimental results show that our approach substantially outperforms an existing state-of-the-art approach with an increase of 0.42 and 0.15 in F1-score on two popular code-clone benchmarks (OJClone and BigCloneBench), respectively, while being more computationally efficient. Our experimental results also show that PACE enables our approach to be substantially more effective when code clones contain unseen tokens.

In modern software development, developers rely on version control systems like Git to collaborate in the branch-based development workflow. One downside of this workflow is the conflicts occurred when merging contributions from different developers: these conflicts are tedious and error-prone to be correctly resolved, reducing the efficiency of collaboration and introducing potential bugs. The situation becomes even worse, with the popularity of refactorings in software development and evolution, because current merging tools (usually based on the text or tree structures of source code) are unaware of refactorings. In this paper, we present IntelliMerge, a graph-based refactoring-aware merging algorithm for Java programs. We explicitly enhance this algorithm's ability in detecting and resolving refactoring-related conflicts. Through the evaluation on 1,070 merge scenarios from 10 popular open-source Java projects, we show that IntelliMerge reduces the number of merge conflicts by 58.90% comparing with GitMerge (the prevalent unstructured merging tool) and 11.84% comparing with jFSTMerge (the state-of-the-art semi-structured merging tool) without sacrificing the auto-merging precision (88.48%) and recall (90.22%). Besides, the evaluation of performance shows that IntelliMerge takes 539 milliseconds to process one merge scenario on the median, which indicates its feasibility in real-world applications.

Programmers always fix bugs when maintaining software. Previous studies showed that developers apply repeated bug fixes-similar or identical code changes-to multiple locations. Based on the observation, researchers built tools to identify code locations in need of similar changes, or to suggest similar bug fixes to multiple code fragments. However, some fundamental research questions, such as what are the characteristics of repeated bug fixes, are still unexplored. In this paper, we present a comprehensive empirical study with 341,856 bug fixes from 3 open source projects to investigate repeated fixes in terms of their frequency, edit locations, and semantic meanings. Specifically, we sampled bug reports and retrieved the corresponding fixing patches in version history. Then we chopped patches into smaller fixes (edit fragments). Among all the fixes related to a bug, we identified repeated fixes using clone detection, and put a fix and its repeated ones into one repeated-fix group. With these groups, we characterized the edit locations, and investigated the common bug patterns as well as common fixes.Our study on Eclipse JDT, Mozilla Firefox, and LibreOffice shows that (1) 15-20% of bugs involved repeated fixes; (2) 73-92% of repeated-fix groups were applied purely to code clones; and (3) 39% of manually examined groups focused on bugs relevant to additions or deletions of whole if-structures. These results deepened our understanding of repeated fixes. They enabled us to assess the effectiveness of existing tools, and will further provide insights for future research directions in automatic software maintenance and program repair.

JavaScript frameworks, such as jQuery, are widely used for developing web applications. To facilitate using these JavaScript frameworks to implement a feature (e.g., functionality), a large number of programmers often search for code snippets that implement the same or similar feature. However, existing code search approaches tend to be ineffective, without taking into account the fact that JavaScript code snippets often implement a feature based on various relationships (e.g., sequencing, condition, and callback relationships) among the invoked framework API methods. To address this issue, we present a novel Relationship-Aware Code Search (RACS) approach for finding code snippets that use JavaScript frameworks to implement a specific feature. In advance, RACS collects a large number of code snippets that use some JavaScript frameworks, mines API usage patterns from the collected code snippets, and represents the mined patterns with method call relationship (MCR) graphs, which capture framework API methods’ signatures and their relationships. Given a natural language (NL) search query issued by a programmer, RACS conducts NL processing to automatically extract an action relationship (AR) graph, which consists of actions and their relationships inferred from the query. In this way, RACS reduces code search to the problem of graph search: finding similar MCR graphs for a given AR graph. We conduct evaluations against representative real-world jQuery questions posted on Stack Overflow, based on 308,294 code snippets collected from over 81,540 files on the Internet. The evaluation results show the effectiveness of RACS: the top 1 snippet produced by RACS matches the target code snippet for 46% questions, compared to only 4% achieved by a relationship-oblivious approach.

API-library switching is to change an underlying API library to another one for a given program. API-library switching is frequent in software-development process, with typical examples as migrating programs across platforms or across incompatible versions of API libraries. Manual API-library switching is time-consuming and error-prone. To address this problem, previous research has proposed a series of rule based code-transformation approaches. However, these existing approaches are ineffective in conducting code transformation for those original code snippets containing a sequence of method invocations correlated with each other and in need of being considered together when transformed. We call the pair of an original code snippet and its transformed target code snippet as a compositional-mapping instance. Through our empirical investigation, we confirm that compositional-mapping instances widely exist during API-library switching. To handle compositional-mapping instances, in this paper, we propose a novel code-transformation approach named as CMIT. Our evaluations compare CMIT with an existing rule-based code transformation approach. The evaluation results show that, compared to the existing approach, CMIT is more flexible, and CMIT increases the recall on average by 33.8% without decreasing the precision.

Bug localization, i.e., locating bugs in code snippets, is a frequent task in software development. Although static bug-finding tools are available to reduce manual effort in bug localization, these tools typically detect bugs with known project-independent bug patterns. However, many bugs in real-world code snippets are project-specific. To address this issue, in this paper, we propose a novel approach for LOcating Bugs By Searching the most similar sample snippet (LOBBYS). LOBBYS detects bugs with the help of crowd-contributed correct code, which implement the function that buggy code is expected to implement. Given a buggy code snippet, LOBBYS takes two steps to locate the bug: (1) normalize the bug-gy snippet, and then search for the most similar sample snippet from the code base; (2) align the buggy code and sample code snip-pets, find the difference between the two code snippets, and generate a bug report based on the difference. To evaluate LOBBYS, we build one algorithm-oriented code base and select some buggy snippets from two real-world systems. The result shows that LOBBYS can effectively locate bugs for buggy snippets with high precision. Under the similarity of 50%, 70% and 90%, LOBBYS achieves bug-localization precision as 67%, 83%, and 92%.

Learning programming at scale underlies computer science education ranging from basic programming to advanced software engineering topics. There are strong needs of providing effective system supports for learning programming at scale. Among various desirable characteristics of such system supports, system supports shall allow students to write programs via an online Integrated Development Environment (IDE), allow students to get feedback on how they perform on the given programming exercises, etc. To aim for such effective system supports for learning programming at scale, research teams from Peking University have developed two systems: POP (denoting Peking University Online Programming System) and POJ (denoting Peking University Online Judge System). These two systems have achieved high impact among students around the world (especially those in China). In this paper, we present the overview of the two systems, along with our ongoing and future work on extending the systems for achieving higher effectiveness in supporting learning programming at scale.

Elastic resource management is one of the key characteristics of cloud computing systems. Existing elastic approaches focus mainly on single resource consumption such as CPU consumption, rarely considering comprehensively various features of applications. Applications deployed on a PaaS are usually heterogeneous. While sharing the same resource, these applications are usually quite different in resource consuming. How to deploy these heterogeneous applications on the smallest size of hardware thus becomes a new research topic. In this paper, we take into consideration application's CPU consumption, I/O consumption, consumption of other server resources and application's request rate, all of which are defined as application features. This paper proposes a practical and effective elasticity approach based on the analysis of application features. The evaluation experiment shows that, compared with traditional approach, our approach can save up to 32.8% VMs without significant increase of average response time and SLA violation.

Lightweight static bug-detection tools such as FindBugs, PMD, Jlint, and Lint4j detect bugs with the knowledge of generic bug patterns (e.g., objects of java.io.InputStream are not closed in time after used). Besides generic bug patterns, different projects under analysis may have some project-specific bug patterns. For example, in a revision of the Xerces project, the class field "fDTDHandler" is dereferenced without proper null-checks, while it could actually be null at runtime. We name such bug patterns directly related to objects instantiated in specific projects as Project-Specific Bug Patterns (PSBPs). Due to lack of such PSBP knowledge, existing tools usually fail in effectively detecting most of this kind of bugs. We name bugs belonging to the same project and sharing the same PSBP as sibling bugs. If some sibling bugs are fixed in a fix revision but some others remain, we treat such fix as an incomplete fix. To address such incomplete fixes, we propose a PSBP-based approach for detecting sibling bugs and implement a tool called Sibling-Bug Detector (SBD). Given a fix revision, SBD first infers the PSBPs implied by the fix revision. Then, based on the inferred PSBPs, SBD detects their related sibling bugs in the same project. To evaluate SBD, we apply it to seven popular open-source projects. Among the 108 warnings reported by SBD, 63 of them have been confirmed as real bugs by the project developers, while two existing popular static detectors (FindBugs and PMD) cannot report most of them.

Recently many popular websites such as Twitter and Flickr expose their data through web service APIs, enabling third-party organizations to develop client applications that provide function-alities beyond what the original websites offer. These client appli-cations should follow certain constraints in order to correctly in-teract with the web services. One common type of such constraints is Dependency Constraints on Parameters. Given a web service operation O and its parameters Pi, Pj, these constraints describe the requirement on one parameter Pi that is dependent on the conditions of some other parameter(s) Pj. For example, when requesting the Twitter operation "GET statuses/user_timeline", a user_id parameter must be provided if a screen_name parameter is not provided. Violations of such constraints can cause fatal errors or incorrect results in the client applications. However, these con-straints are often not formally specified and thus not available for automatic verification of client applications. To address this issue, we propose a novel approach, called INDICATOR, to automatically infer dependency constraints on parameters for web services, via a hybrid analysis of heterogeneous web service artifacts, including the service documentation, the service SDKs, and the web services themselves. To evaluate our approach, we applied INDICATOR to infer dependency constraints for four popular web services. The results showed that INDICATOR effectively infers constraints with an average precision of 94.4% and recall of 95.5%.

Failing to release unneeded system resources such as I/O streams can result in resource leaks, which can lead to performance degradation and system crashes. Existing resource-leak detectors are usually based on predefined defect patterns to detect resource leaks in software. However, they typically report too many false positives and negatives, and also lack effective warning prioritization. Our empirical investigation shows that, their predefined defect patterns are not precise enough, and moreover, their used defect detection processes are not suitable enough for the defect patterns. In our approach, we introduce a novel Expressive Defect Pattern Specification Notation (EDPSN). With EDPSN, a resource-leak defect pattern can be defined more precisely by specifying conditional method calls and more expressively by including guiding information for the defect detection and warning prioritization process, such as the characteristics of its preferred defect detection process and the effective prioritization impact factors for its related warnings. Based on the EDPSN-based defect pattern, our approach tries to flexibly tune out a suitable defect detection and warning prioritization process. Through evaluations on three real-world projects (Eclipse-3.0.1, JBoss-3.0.6, and Weka-3.6.4), we show that our approach achieves high average precision (96%) and recall (74%), 26% and 49% higher than existing approaches, respectively.

With the on-demand service provision ability and elastic nature, cloud computing provides a suitable development and running environment for internetware, to support its cooperation and evolvement. Among the three service models of cloud computing, Platform-as-a-Service (PaaS) provides internetware application developers with sufficient and convenient computing resources to develop and run their applications. As with other cloud computing models, monitoring is the basis of on-demand service provision and elastic scalability in PaaS. Apart from this, monitoring is also a required service that should be provided to PaaS consumers. However, due to the diversity and heterogeneity of the objects to be monitored in PaaS, monitoring is not easy to implement. Additionally, it is difficult to perform manual or automatic administration on PaaS based on raw monitoring data in the form of metric data set. In this paper, we propose a model-driven monitoring approach for PaaS. By transforming low-level monitoring data to high-level monitoring model based on meta-model definitions and transforming rules, this approach not only simplifies the implementation of PaaS monitoring system, but also presents a high-level abstraction of the whole PaaS, which reduces the difficulty of PaaS management. We built a graphic modeling tool to assist the definition of the meta-model and transforming rules, and applied this approach in the implementation of a PaaS monitoring system in practice.

Software systems commonly use resources such as network connections or external file handles. Once finish using the resources, the software systems must release these resources by explicitly calling specific resource-releasing API methods. Failing to release resources properly could result in resource leaks or even outright system failures. Existing verification techniques could analyze software systems to detect defects related to failing to release resources. However, these techniques require resource-releasing specifications for specifying which API method acquires/releases certain resources, and such specifications are not well documented in practice, due to the large amount of manual effort required to document them. To address this issue, we propose an iterative mining approach, called RRFinder, to automatically mining resource-releasing specifications for API libraries in the form of (resource-acquiring, resource-releasing) API method pairs. RRFinder first identifies resource-releasing API methods, for which RRFinder then identifies the corresponding resource-acquiring API methods. To identify resource-releasing API methods, RRFinder performs an iterative process including three steps: model-based prediction, call-graph-based propagation, and class-hierarchy-based propagation. From heterogeneous information (e.g., source code, natural language), the model-based prediction employs a classification model to predict the likelihood that an API method is a resource-releasing method. The call-graph-based and class-hierarchy-based propagation propagates the likelihood information across methods. We evaluated RRFinder on eight open source libraries, and the results show that RRFinder achieved an average recall of 94.0% with precision of 86.6% in mining resource-releasing specifications, and the mined specifications are useful in detecting resource leak defects.

Due to the benefits of cloud computing, many desktop applications have been migrated into the cloud. In order to program in the cloud, lots of IDEs are also moved into the cloud at recent years. Although online IDE can bring developers a lot of convenience for their developing process, some tough problems are still less touched. This paper summarized three main kinds of actual problems from three aspects (Function implementation, Security guarantee, Advanced utilization) encountered when using the online IDE, and proposed three solutions (Services composition, Program behavior analysis, Program behavior mining) to handle these according problems. Finally, this paper introduce a real online IDE (CEclipse) developed by our research group and apply the three solutions in this online IDE.

Monitoring plays a significant role in improving the quality of service in cloud computing. It helps clouds to scale resource utilization adaptively, to identify defects in services for service developers, and to discover usage patterns of numerous end users. However, due to the heterogeneity of components in clouds and the complexity arising from the wealth of runtime information, monitoring in clouds faces many new challenges. In this paper, we propose a runtime model for cloud monitoring (RMCM), which denotes an intuitive representation of a running cloud by focusing on common monitoring concerns. Raw monitoring data gathered by multiple monitoring techniques are organized by RMCM to present a more intuitive profile of a running cloud. We applied RMCM in the implementation of a flexible monitoring framework, which can achieve a balance between runtime overhead and monitoring capability via adaptive management of monitoring facilities. Our experience of utilizing the monitoring framework on a real cloud demonstrates the feasibility and effectiveness of our approach.

Application Programming Interface (API) constraints on objects are rules that API client code must follow in order to get expected results from these objects. Runtime verification, an important approach for detecting API constraint violations, usually suffers from high runtime overhead. This paper focuses on temporal API constraints on multiple interacting objects. Violation detection of such constraints is more challenging than violation detection of single object constraints, and may induce higher runtime overhead. To reduce the runtime overhead, without compromising the effectiveness of verification, we propose a Lazy Verification Approach (LAVA), which enables verification lazily. Verification probes in LAVA are loaded automatically during the program execution as late as possible. And only probes on objects that have been bound by a binding point (a special method invocation that binds involved objects together) are enabled. Based on these optimization strategies, we implemented an efficient and flexible runtime verification framework. We show the effectiveness of our approach by applying it to verify five constraints in the DaCapo [1] benchmark. The empirical results show that our approach can reduce the number of method invocation events sent by probes, which is the main cause of runtime overhead, by 74% to 100% on average, and bring about an optimization ratio of 44.1% to 89.9% on runtime overhead.

In order to improve ineffective warning prioritization of static analysis tools, various approaches have been proposed to compute a ranking score for each warning. In these approaches, an effective training set is vital in exploring which factors impact the ranking score and how. While manual approaches to build a training set can achieve high effectiveness but suffer from low efficiency (i.e., high cost), existing automatic approaches suffer from low effectiveness. In this paper, we propose an automatic approach for constructing an effective training set. In our approach, we select three categories of impact factors as input attributes of the training set, and propose a new heuristic for identifying actionable warnings to automatically label the training set. Our empirical evaluations show that the precision of the top 22 warnings for Lucene, 20 for ANT, and 6 for Spring can achieve 100% with the help of our constructed training set.

Web service technology aims to enable the interoperation of heterogeneous systems and the reuse of distributed functions in an unprecedented scale and has achieved significant success. There are still, however, challenges to realize its full potential. One of these challenges is to ensure the behavior of Web services consistent with their requirements. Monitoring events that are relevant to Web service requirements is, thus, an important technique. This paper introduces an online monitoring approach for Web service requirements. It includes a pattern-based specification of service constraints that correspond to service requirements, and a monitoring model that covers five kinds of system events relevant to client request, service response, application, resource, and management, and a monitoring framework in which different probes and agents collect events and data that are sensitive to requirements. The framework analyzes the collected information against the prespecified constraints, so as to evaluate the behavior and use of Web services. The prototype implementation and experiments with a case study shows that our approach is effective and flexible, and the monitoring cost is affordable.

Typical enterprise and military software systems consist of millions of lines of code with complicated dependence on diverse library abstractions. Manually debugging these codes imposes developers overwhelming workload and difficulties. To address software quality concerns efficiently, this paper proposes an ontology-based static analysis approach to automatically detect bugs in the source code of Java programs. First, we elaborate bug list collected, classify bugs into different categories, and translate bug patterns into SWRL (semantic Web rule language) rules using an ontology tool, Protege. An ontology model of Java program is created according to Java program specification using Protege as well. Both SWRL rules and the program ontology model are exported in OWL (Web ontology language) format. Second, Java source code under analysis is parsed into the abstract syntax tree (AST), which is automatically mapped to the individuals of the program ontology model. SWRL bridge takes in the exported OWL file (representing the SWRL rules model and program ontology model) and the individuals created for the Java code, conduits to Jess (a rule engine), and obtains inference results indicating any bugs. We perform experiments to compare bug detection capability with well-known FindBugs tool. A prototype of bug detector tool is developed to show the validity of the proposed static analysis approach.

Software that runs in the network environment is facing with many challenges. One of them is the dynamic feature of the network. To keep the quality of service, the service entity needs to adapt promptly to the changing environment. The traditional system software, operating system, which is used mainly to manage the hardware resources of computer, doesn't provide enough support for application adaptation at runtime. This paper introduces a middleware based approach that enhances the adaptability of software system. The key contribution of the proposed approach is that it clearly separates the adaptation program from the function program at runtime. The past, current and future work of MASS are introduced also.

High quality is one of the critical elements contributing to Web service's success. Monitoring events that are sensitive to quality of Web services is thus an important issue for Web services. This paper proposes an online monitoring approach for web service. This approach is driven by a quality model which covers five kinds of events: the response to client, application execution, changing states of resources, client request, and management operations. We introduce a monitoring framework that collects quality sensitive events by multiple kinds of probes and agents. The framework can do some analysis according to the pre-specified constraints, so as to evaluate the quality of web service. The initial implementation and experiment with a web-based auction example shows that our approach is feasible, and the monitoring cost is affordable.

Monitoring sensitive events is of great significance for adaptive software. Specifying a sufficient set of constraints prior to software deployment is necessary to detect the presence of such events during execution. Here we propose a visual constraint specifying approach, which can generate monitoring code automatically, so as to make the constraint specification easy, and the adaptation of software easy. The detailed representing approach, generating algorithm, and a typical implementation are introduced also

As software systems evolve by adding new extensions some unexpected conflicts may occur, which is known as the feature interaction problem (PIP). PIP is a threat to the dependability of software systems as it can break system security and safety. A major cause for PIP is the non-determinism related with sending or receiving the predefined signals of the base subsystem by extensions. This paper analyzes the problems and proposes to enforce necessary constraints to prevent the PIP. In addition, we present a systematic approach to acquire heuristically constraints from system specifications

Many software systems need to provide services continuously and uninterruptedly. Meanwhile, these software systems need to keep evolving continuously to fix bugs, add functions, improve algorithms, adapt to new running environments and platforms, or prevent potential problems. This situation makes online evolution an important issue in the field of software maintenance and evolution. This paper proposes a component-based approach to online software evolution. Nowadays component technology has been widely adopted. Component technology facilitates software evolution, but also introduces some new issues. In our approach, an application server is used to evolve the application, without special support from the compiler or operating system. The implementation and performance analysis of our approach are also covered. Copyright © 2006 John Wiley & Sons, Ltd.

Monitoring of sensitive events is a key step for controlling the behavior of software. Specifying a sufficient set of constraints prior to software deployment is necessary for detecting the presence of such events during execution. Here we focus on issues related to service level constraints including types of constraints, the runtime structure of constraints and the related entities. An experiment to assess the feasibility of the proposed approach is also reported.

Runtime environment of software are becoming more and more dynamic and changeful, while pervasive computing and Web services further this situation. Software systems are not only becoming larger, more complex, and also more rigid, which make it difficult to evolve software. This paper focuses on online evolution, more exactly, how to make online evolution process convenient and smart, with help of runtime software architecture (RSA). Following issues are discussed in this paper: types of software environment changes, the incarnation of RSA, retrieval and manipulation of RSA, the relation between RSA and the runtime system, and a visual tool to show RSA, and make evolution process more easy and intuitionist.

Component-based reuse is a hopeful solution to the software crisis. Research on software architecture (SA) has revealed a component-based vision of the gross structure of software and provides a top-down approach to direct the component-oriented development process. But the gap between SA design and final implementation prevents it from playing a fundamental role in the process. On the other hand, the component-based software development (CBSD) technology such as Java 2 platform enterprise edition (J2EE) and Common Object Request Broker Architecture (CORBA) provides a feasible bottom-up way to construct systems from standard components, forming an implementation basis for an integrated component-oriented development process. In this paper we propose an architecture-based component composition (ABC) approach, which uses SA model as the blueprint of development and COTS middleware as the run-time platform to support an automated component-oriented development process.

Most online evolution of an application depends on its runtime environment. This paper addresses how to support online evolution by an application server, which is considered as a third kind of system software, besides OS and DBMS. From the view of requirements, evolutions of software can be divided into four categories: evolutions that do not alter requirements, evolutions that alter functional requirements, evolutions that alter local constraint requirements, and evolutions that alter global constraint requirements. All changes at the requirement level should be mapped to changes at the implementation level. In our approach implementation level entities, such as components and interceptors are responsible for online evolution. Evolutions in implementation level include adding, removing, updating, and reconfiguring the entities. One of the keys to our approach is to carefully distinguish states of components and interceptors, that is, whether they are in a ready, active, executing or evolving state. A well-designed architecture and feasible mechanisms for runtime instance loading are also keys to the solution. Based on this approach, an application server prototype, named PKUAS, has been implemented and is introduced in our paper.