We introduce KASTroid1, a static taint analysis framework designed to detect information leakage vulnerabilities in Kotlin-based Android applications, with a focus on insecure usage of broadcasts. As Kotlin increasingly replaces Java as the preferred language for Android development, ensuring the security of inter-component communication, particularly through broadcasts, is critical. KASTroid employs a novel static analysis approach to identify tainted flows arising from unsafe broadcast practices, such as the use of implicit broadcasts via sendBroadcast, which can expose sensitive user data to unauthorized applications. We evaluated KASTroid on a dataset of 1,716 Kotlin Android applications and found that over 70% of broadcasts are implicit, posing significant privacy risks. To demonstrate the framework’s effectiveness, we present a case study on a previous version of AndroidAPS, a medical application, where KASTroid identified unsafe broadcast usage that could leak sensitive information to other local applications. Our findings highlight the importance of secure broadcast practices and demonstrate KASTroid’s ability to assist developers in detecting and remedying such vulnerabilities.

The safety and privacy of medical devices is critical, as they directly affect the health of users and handle sensitive personal data. Ensuring that these devices meet safety and security standards is essential, especially with the rise of do-it-yourself solutions such as open-source artificial pancreas systems (APSs) for insulin delivery. In this work, we study AndroidAPS, an APS controller written in Kotlin, and propose an approach to detect safety and security issues. We develop a modeling and analysis framework for Kotlin applications that extracts a structural model and supports detecting logging vulnerabilities and ensuring the application of safety constraints. We conduct two experiments. The first examines logging behavior to check for privacy risks. Out of $\mathbf{3, 0 5 9 ~ l o g g i n g}$ instances, our tool identified 48 sinks that received 144 sensitive flows, with $68 \%$ precision due to coarse-grained flagging. The second experiment verifies that calculation-related values are validated against safety constraints before being set to the profile. We show that AndroidAPS generally adheres to its safety design properties, but it has one calculation-related value that is not explicitly validated at the plugin level and only partially validated earlier in the flow.

The automated synthesis of behavioural models in the form of state machines (SMs) from higher-level specifications has a high potential impact on the efficiency and accuracy of software development using models. In this paper, inspired by program synthesis techniques, we propose a model synthesis approach that takes as input a structural model of a system and its desired system properties, and automatically synthesizes executable SMs for its components. To this end, we first generate a synthesis formula for each component, consistent with the system properties, and then perform a State Space Exploration (SSE) of each component, based on its synthesis formula. The result of the SSE is saved in a Labeled Transition System (LTS), for which we then synthesize detailed actions for each of its transitions. Finally, we transform the LTSs into UML-RT (UML real-time profile) SMs, and integrate them with the original structural models. We assess the applicability, performance, and scalability of our approach using several different use cases extracted from the literature.

Summary Model‐driven engineering is an increasingly prevalent approach in software engineering where models are the primary artifacts throughout a project's life cycle. A growing form of analysis and quality assurance in these projects is model clone detection, which identifies similar model elements. As model clone detection research and tools emerge, methods must be established to assess model clone detectors and techniques. In this paper, we describe the MuMonDE framework, which researchers and practitioners can use to evaluate model clone detectors using mutation analysis on the models each detector is geared towards. MuMonDE applies mutation testing in a novel way by randomly mutating model elements within existing projects to emulate various types of clones that can exist within that domain. It consists of 2 main phases. The mutation phase involves determining the mutation targets, selecting the appropriate mutation operations, and injecting mutants. The second phase, evaluation, involves detecting model clones, preprocessing clone reports, analyzing those reports to calculate recall and precision, and visualizing the data. We introduce MuMonDE by describing each phase in detail. We present our experiences and examples in successfully developing a MuMonDE implementation capable of evaluating Simulink model clone detectors. We validate MuMonDE by demonstrating its ability to answer evaluation questions and provide insights based on the data it generates. With this research using mutation analysis, our goal is to improve model clone detection and its analytical capabilities, thus improving model‐driven engineering as a whole.

The Linux kernel provides its services to the application layer using so-called system calls. All system calls combined form the Application Programming Interface (API) of the kernel. Hence, system calls provide us with a window into the development process and design decisions that are made for the Linux kernel. Our paper [1] presents the result of an empirical study of the changes (8,770) that were made to the system calls during the last decade (i.e., from April 2005 to December 2014). The main contributions and most important findings of our study are:

Based on the simple, naive idea of text-line differencing of pretty-printed code, at ICPC 2008 we introduced NICAD [5], the first code clone detector explicitly aimed at finding intentional "near-miss" (Type 3) clones. Using the TXL [2] parser to identify and pretty-print all instances of a code unit of interest (functions, blocks, etc.), NICAD provides several ways to pre-process the code before comparison, including flexible formatting, renaming, normalization and abstraction, making it suitable for finding all kinds of clones in a wide range of different applications. In this talk we will outline the journey from that initial naive idea to an efficient, scalable, flexible clone detection tool that handles more than ten different languages with high accuracy in both precision and recall [8]. Along the way we will highlight our experience in tuning our initial prototype to production speed and scalability [4], we will review its application in a range of large-scale clone experiments [3, 6, 7], and describe its evolution to handle new domains such as subsystem clones in graphical models [1]. Finally, we will close with new methods based on NICAD [9, 10] and its lessons for clone detection research in the future.

There have been a great many methods and tools proposed for software clone detection. While some work has been done on assessing and comparing performance of these tools, very little empirical evaluation has been done. In particular, accuracy measures such as precision and recall have only been roughly estimated, due both to problems in creating a validated clone benchmark against which tools can be compared, and to the manual effort required to hand check large numbers of candidate clones. In order to cope with this issue, over the last 10 years we have been working towards building cloning benchmarks for objectively evaluating clone detection tools. Beginning with our WCRE 2008 paper, where we conducted a modestly large empirical study with the NiCad clone detection tool, over the past ten years we have extended and grown our work to include several languages, much larger datasets, and model clones in languages such as Simulink. From a modest set of 15 C and Java systems comprising a total of 7 million lines in 2008, our work has progressed to a benchmark called BigCloneBench with eight million manually validated clone pairs in a large inter-project source dataset of more than 25,000 projects and 365 million lines of code. In this paper, we present a history and overview of software clone detection benchmarks, and review the steps of ourselves and others to come to this stage. We outline a future for clone detection benchmarks and hope to encourage researchers to both use existing benchmarks and to contribute to building the benchmarks of the future.

This paper is an evaluation of UML for Real-Time (UML-RT) for modelling Self-Adaptive Software (SAS) systems. Using a systematic review of the different features of UML-RT (optional capsules, SAP/SPP communication, hierarchical state machines, etc.), we analyse the suitability of the language for modelling structural and behavioural adaptations at design-and run-time. We evaluate these features in the context of their current state of support in Papyrus-RT, an Eclipse-based MDE tool for UML-RT recently developed by the Eclipse PolarSys Working Group. The use of UML-RT and Eclipse Papyrus for Real-Time (Papyrus-RT) for different kinds of adaptation is demonstrated using two real-time system case studies.

With the increasing use of Simulink modeling in embedded system development, there comes a need for effective techniques and tools to support managing these models and their related artifacts. Because maintenance of models makes up such a large portion of the cost and effort of the system as a whole, it is increasingly important to ensure that the process of managing models is as simple, intuitive and efficient as possible. Part of model management comes in the form of impact analysis - the ability to determine the impact of a change to a model on related artifacts such as test cases and other models. This paper presents an approach to impact analysis for Simulink models, and a tool to implement it (SimPact). We validate our tool as an impact predictor against the maintenance history of a large set of industrial models and their tests. The results show a high level of both precision and recall in predicting actual impact of model changes on tests.

Studies of code repositories have long been used to understand the use of programming languages and to provide insight into how they should evolve. Such studies can highlight features that are rarely used and can safely be removed to simplify the language. Conversely, combinations of features that are frequently used together can be identified and possibly replaced with new features to improve the user experience. Unfortunately, this kind of research has not been as popular in Model Driven Development (MDD). More specifically, using repositories of model transformations (in any language) to understand how the features of these languages are used has not been investigated much, despite its potential benefits. In this paper, we study the use of the ATL model transformation language in an ATL transformation repository. We identify three research questions aimed at providing insight into how ATL's features are actually used. Using the TXL source transformation language, we implement a parser-based analyzer to extract information from the ATL Zoo. We use this information to answer these research questions and provide additional observations based on manual inspection of ATL artifacts.

This paper presents an industrial case study that explores the co-evolution relationship between Matlab Simulink Models and their associated test suites. Through an analysis of differences between releases of both the models and their tests, we are able to determine what the relation between the model evolution and test evolution is, or if one exists at all. Using this comparison methodology, we present empirical results from a production system of 64 Matlab Simulink Models evolving over 9 releases. In our work we show that in this system there is a strong co-evolution relationship (a correlation value of r = 0.9, p < 0.01) between the models and tests, and we examine the cases where the relationship does not exist. We also pose, and answer, three specific research questions about the practices of development and testing over time for the system under study.

As software architecture methods and tools become increasingly model-driven, evaluating architecture artifacts must adjust correspondingly. Model-driven evaluation of architecture quality has advantages over traditional evaluation techniques, especially when applied in a model-driven context. One approach we found successful in performing model-driven analysis involves using model clone detection, whereby we detect subsystems that are similar to example systems that are positive and negative quality indicators. In this paper we present our ideas on applying model clone detection to realize model-driven evaluation of software architectures, which contain many high-level systems and interactions. We propose having model-based representations of architectural patterns and styles, and employing model clone detection to identify positive and negative architectural aspects for evaluation, including reliability and security. We provide our insights on how this research can be applied to popular architectural paradigms, relation to previous work, and present discussion points on how it will impact software architecture quality evaluation.

A hurdle in the growth of model driven software engineering is our ability to evaluate the quality of models automatically. One perspective is that software quality is a function of the existence, or lack thereof, of good and bad properties, also known as patterns and antipatterns, respectively. In this paper, we introduce the notion of using model clone detection to detect model pattern and antipattern instances by looking for models that are cross clones of pattern models. By detecting patterns at the model level, analysis is accomplished earlier in the engineering process, can be applied to primarily model-based projects, and remains at the same level of abstraction that engineers are used to. We outline the process of using model clone detection for this purpose, including representing the patterns and detection of instances. We present some Simulink examples of pattern representations and discuss future work and research in the area.

Make is one of the oldest build technologies and is still widely used today, whether by manually writing Make files, or by generating them using tools like Auto tools and CMake. Despite its conceptual simplicity, modern Make implementations such as GNU Make have become very complex languages, featuring functions, macros, lazy variable assignments and (in GNU Make 4.0) the Guile embedded scripting language. Since we are interested in understanding how widespread such complex language features are, this paper studies the use of Make features in almost 20,000 Make files, comprised of over 8.4 million lines, from more than 350 different open source projects. We look at the popularity of features and the difference between hand-written Make files and those generated using various tools. We find that generated Make files use only a core set of features and that more advanced features (such as function calls) are used very little, and almost exclusively in hand-written Make files.

One challenge facing the Model-Driven Engineering community is the need for model quality assurance. Specifically, there should be better facilities for analyzing models automatically. One measure of quality is the presence or absence of good and bad properties, such as patterns and antipatterns, respectively. We elaborate on and validate our earlier idea of detecting patterns in model-based systems using model clone detection by devising a Simulink antipattern instance detector. We chose Simulink because it is prevalent in industry, has mature model clone detection techniques, and interests our industrial partners. We demonstrate our technique using near-miss cross-clone detection to find instances of Simulink antipatterns derived from the literature in four sets of public Simulink projects. We present our detection results, highlight interesting examples, and discuss potential improvements to our approach. We hope this work provides a first step in helping practitioners improve Simulink model quality and further research in the area.

SimNav is a graphical user interface designed for displaying and navigating clone classes of Simulink models detected by the model clone detector Simone. As an embedded Simulink interface tool, SimNav allows model developers to explore detected clones directly in their own model development environment rather than a separate research tool interface. SimNav allows users to open selected models for side-by-side comparison, in order to visually explore clone classes and view the differences in the clone instances, as well as to explore the context in which the clones exist. This tool paper describes the motivation, implementation, and use cases for SimNav.

The TXL source transformation system is widely used in industry and academia for both research and production tasks involving source transformation and software analysis. While it is designed to be accessible to software practitioners, understanding how to use TXL effectively takes time and has a steep learning curve. This tutorial is designed to get you over the initial hump and rapidly move you from a TXL novice to the skills necessary to use it effectively in real applications. Consisting of a combination of one hour lecture presentations followed by one hour practice sessions, this is a hands-on tutorial in which participants quickly learn the basics of how to use TXL effectively in their research or industrial practice.

PHP is by far the most popular WEB scripting language, accounting for more than 80% of existing websites. PHP is dynamically typed, which means that variables take on the type of the objects that they are assigned, and may change type as execution proceeds. While some type changes are likely not harmful, others involving function calls and global variables may be more difficult to understand and the source of many bugs. Hack, a new PHP variant endorsed by Facebook, attempts to address this problem by adding static typing to PHP variables, which limits them to a single consistent type throughout execution.

This paper presents a semi-automated framework for identifying and representing different kinds of variability in Simulink models. Based on the observed variants found in similar subsystem patterns inferred using Simone, a text-based model clone detection tool, we propose a set of variability operators for Simulink models. By applying these operators to six example systems, we are able to represent the variability in their similar subsystem patterns as a single subsystem template directly in the Simulink environment. The product of our framework is a single consolidated subsystem model capable of expressing the observed variability across all instances of each inferred pattern. The process of pattern inference and variability analysis is largely automated and can be easily applied to other collections of Simulink models. The framework is aimed at providing assistance to engineers to identify, understand, and visualize patterns of subsystems in a large model set. This understanding may help in reducing maintenance effort and bug identification at an early stage of the software development.

The large success of Content management Systems (CMS) such as WordPress is largely due to the rich ecosystem of themes and plugins developed around the CMS that allows users to easily build and customize complex Web applications featuring photo galleries, contact forms, and blog pages. However, the design of the CMS, the plugin-based architecture, and the implicit characteristics of the programming language used to develop them (often PHP), can cause interference or unwanted side effects between the resources declared and used by different plugins. This paper describes the problem of interference between plugins in CMS, specifically those developed using PHP, and outlines an approach combining static and dynamic analysis to detect and locate such interference. Results of a case study conducted over 10 WordPress plugins shows that the analysis can help to identify and locate plugin interference, and thus be used to enhance CMS quality assurance.

Model-clone detection is a relatively new area and there are a number of different approaches in the literature. As the area continues to mature, it becomes necessary to evaluate and compare these approaches and validate new ones that are introduced. We present a mutation-analysis based model-clone detection framework that attempts to automate and standardize the process of comparing multiple Simulink model-clone detection tools or variations of the same tool. By having such a framework, new research directions in the area of model-clone detection can be facilitated as the framework can be used to validate new techniques as they arise. We begin by presenting challenges unique to model-clone tool comparison including recall calculation, the nature of the clones, and the clone report representation. We propose our framework, which we believe addresses these challenges. This is followed by a presentation of the mutation operators that we plan to inject into our Simulink models that will introduce variations of all the different model clone types that can then be searched for by each respective model-clone detector.

This survey paper presents the current state of model comparison as it applies to Model-Driven Engineering. We look specifically at how model matching is accomplished, the application of the approaches, and the types of models that approaches are intended to work with. Our paper also indicates future trends and directions. We find that many of the latest model comparison techniques are geared towards facilitating arbitrary meta models and use similarity-based matching. Thus far, model versioning is the most prevalent application of model comparison. Recently, however, work on comparison for versioning has begun to stagnate, giving way to other applications. Lastly, there is wide variance among the tools in the amount of user effort required to perform model comparison, as some require more effort to facilitate more generality and expressive power. 1

In this paper, we discuss model-to-model comparison techniques that can be used to assist with model-tomodel transformation testing. Using an existing real-world model transformation, we illustrate and qualitatively evaluate the comparison techniques, highlighting the associated strengths and weaknesses of each in the context of transformation testing. 1

Long before MDE became a popular method for software development, Simulink was firmly established as a tool for model--driven development of hybrid industrial systems. While practical and expressive for model creation and reuse, Simulink lacks for good abstraction mechanisms, and copy--paste--modify is a standard paradigm in Simulink development, leading to large numbers of variants of similar submodels. SIMONE is a framework and tool for automatically identifying, classifying and formalizing submodel patterns in Simulink models, using near-miss clone detection to find similarities and model merging to identify points of variance. The result is a set of submodel patterns which can be used as a reference for variance in the models, supporting consistency analysis, test optimization, fault identification and the disciplined generation of new subsystem instances using feature selection.

The IEEE International Conference on Software Maintenance (ICSM) is the premiere international venue in software maintenance and evolution, where participants from academia, government, and industry meet and share ideas and experiences for solving critical software maintenance problems. In 2011, the 27th edition of ICSM was held at the Williamsburg Lodge, in the heart of Williamsburg, VA, USA. Williamsburg, once the capital of England's oldest, wealthiest, and most populous North American colony, is one of the most important American historical landmarks. ICSM 2011 was held from September 25 to 30, 2011. The conference was preceded by two co-located events, the 11th IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM) and the International Workshop on the Maintenance and Evolution of Service-Oriented and Cloud-Based Systems (MESOCA). It was followed by two other co-located events, the 13th IEEE International Symposium on Web Systems Evolution (WSE) and the 6th IEEE International Workshop on Visualizing Software for Understanding and Analysis (VISSOFT). ICSM 2011 attracted 127 submissions, each of which was reviewed by at least three members of the ICSM Program Committee. Following a week and a half of online discussion supported by EasyChair, 36 papers were selected for publication and presentation in the Technical Program of the conference. Consensus was aimed for and reached in almost all cases. The topics of accepted papers ranged from Reverse Engineering and Program Comprehension to Impact Analysis, Traceability, Migration and Evolution, Refactoring, Software Clones, Linguistic Analysis, and Regression Testing. The conference program included the ICSM Doctoral Symposium, Tutorials, Tool Demonstrations, Posters, the Industry track, and the Early Research Achievements track. This special section of the Journal of Software: Evolution and Process contains extended versions of the papers selected by the ICSM 2011 Program Committee among the best papers presented at the conference. These extended versions have additionally undergone the rigorous JSEP journal review process: they were reviewed by three anonymous referees under the supervision and coordination of the guest editors. We are proud to present you the three excellent papers that are the results of this process. Paper 1, ‘An empirical study of faults in late propagation clone genealogies’, by Liliane Barbour, Foutse Khomh, and Ying Zou, investigates the history of clone evolution over time, focusing on the phenomenon of late propagation. Late propagation occurs whenever one of two clones diverges from the other, as a result of code evolution, while later such changes are reconciled, so as to remove the divergence. The authors have defined eight types of late propagation, and they have evaluated empirically the relationship between fault proneness and late propagation of various type. They have also investigated whether reconciling changes are fault-fixing changes. This paper contributes to our knowledge of the risks associated with clones and with their evolution over time. Paper 2, ‘Evaluating test-to-code traceability recovery methods through controlled experiments’, by Abdallah Qusef, Gabriele Bavota, Rocco Oliveto, Andrea De Lucia, and David Binkley, presents a combination of two controlled experiments comparing the effectiveness of four different approaches to recovering traceability links between test cases and code. Traceability addresses the problem of identifying links between software artifacts of different types, and test-to-code traceability addresses the issue of identifying precisely which sections of code are actually tested by a given test case. In the experiments presented in this paper, the effectiveness of the four approaches on three large Java systems is compared using a manual consensus of three PhD student programmers as a reference answer. Both accuracy and practical usefulness to programmers are explored, demonstrating that the authors' own SCOTCH method can be significantly more effective than existing techniques. Paper 3, ‘How developers perform feature location tasks: a human-centric and process-oriented exploratory study’, by Jinshui Wang, Xin Peng, Zhenchang Xing, and Wenyun Zhao, describes an empirical study of feature location in code by software developers. Feature location addresses the problem of identifying which parts of the source code of a system are concerned with implementing a specific business or technical concern. Automation in feature location has been a popular topic in the software maintenance research community for some time. In this paper, the authors choose instead to seek insight from how programmers actually perform the task in practice, concluding that the process can be understood at three levels of granularity, each of which is influenced by a number of external factors. The empirical insights reported here can be used to inform future work in supporting and automating this important aspect of software maintenance. We wish to thank the authors for having contributed to this special section, the ICSM 2011 Program Committee for their indications on which papers to include in the special section, and the journal referees, for their detailed and constructive comments, which greatly helped the authors to improve their papers. James R. Cordy is Professor and past Director of the School of Computing at Queen's University at Kingston, Canada. From 1995 to 2000, he was Vice President and Chief Research Scientist at Legasys Corporation, a software technology company specializing in legacy software system analysis and renovation. Dr. Cordy received his PhD degree from the University of Toronto, where he served several years as lecturer and senior research associate before moving to Queen's University in 1985. As leader of the TXL project, with hundreds of academic and industrial users worldwide, he is the author of more than 140 refereed contributions in programming languages, software engineering, and artificial intelligence and has served widely as member and chair of many conferences and workshops in programming languages and software engineering, most recently as Program Chair of ICSM 2011, IWSC 2011, and CASCON 2013 and as General Chair of SCAM 2012 and WCRE 2012. Dr. Cordy is an ACM Distinguished Scientist, a senior member of the IEEE, and an IBM Visiting Scientist and Faculty Fellow. Paolo Tonella is head of the Software Engineering Research Unit at Fondazione Bruno Kessler (FBK), in Trento, Italy. He received his PhD degree in Software Engineering from the University of Padova in 1999, with the thesis ‘Code Analysis in Support to Software Maintenance’. In 2011, he was awarded the ICSE 2001 MIP (Most Influential Paper) award, for his paper: ‘Analysis and testing of web applications’. He is the author of ‘Reverse engineering of object oriented code’, Springer, 2005. He participated in several industrial and EU projects on software analysis and testing. Dr. Tonella was Program Chair of ICSM 2011 and ICPC 2007 and General Chair of ISSTA 2010 and ICSM 2012. Among the others, he served in the program committees of ICSE, FSE, ICSM, ISSTA, ICST, and ICPC. In 2007, Paolo Tonella was ranked among the top 50 Software Engineering scholars (Communications of the ACM, vol. 50, n. 6, pp. 81–85). He has been recognized as a distinguished TOSEM referee several times in recent years (including 2011–2012). His key contributions to the research in software engineering include the following: a comprehensive reverse engineering method for object oriented software, pioneering research on model extraction for web testing and foundational work on evolutionary testing of object oriented software.

While graph-based techniques show good results in finding exactly similar subgraphs in graphical models, they have great difficulty in finding near-miss matches. Text-based clone detectors, on the other hand, do very well with near-miss matching in source code. In this paper we introduce SIMONE, an adaptation of the mature text-based code clone detector NICAD to the efficient identification of structurally meaningful near-miss subsystem clones in graphical models. By transforming graph-based models to normalized text form, SIMONE extends NICAD to identify near-miss subsystem clones in Simulink models, uncovering important model similarities that are difficult to find in any other way.

In Model Driven Engineering (MDE), models are first-class citizens, and model transformation is MDE's "heart and soul". Since model transformations are executed for a family of conforming models, their validity becomes a crucial issue. This paper proposes to explore the question of the formal verification of model transformation properties through a tri-dimensional approach: the transformation involved, the properties of interest addressed, and the formal verification techniques used to establish the properties. This work allows a better understanding of the expected properties for a particular transformation, and facilitates the identification of the suitable tools and techniques for enabling their verification.

Software clones are identical or similar pieces of code, design or other artifacts. Clones are known to be closely related to various issues in software engineering, such as software quality, complexity, architecture, refactoring, evolution, licensing, plagiarism, and so on. Various characteristics of software systems can be uncovered through clone analysis, and system restructuring can be performed by merging clones.

Welcome to the 27thIEEE International Conference on Software Maintenance in Williamsburg, Virginia, USA. ICSM is continuing its journey around the world in a new location. The conference is hosted by the Williamsburg Lodge, situated in the heart of Historical Williamsburg. We hope you will enjoy the location as much as the conference.

Incremental clone detection is designed to efficiently find only those clones that cross between a previous version of a system and a new version in order to update a previous clone analysis. If we instead use a different system as the new version, then it can be used to find only those clones that cross between two different systems. Live scatter plots are a visualization technique that helps localize clones quickly using pop-up information directly from points in the scatter plot. In this paper we explore how these two can be used together to rapidly expose and analyze similarities between two different systems at several levels of abstraction. Using the NiCad incremental clone detector, we find function clones between two recent versions of Linux and FreeBSD, analyze the nature and causes of some of these similarities in detail, and compare our observations with the earlier study of token-sequence clones between previous versions of these systems using CCFinder almost a decade ago.

The problem of finding code cloned from open source code in software systems is of interest both to the open source community (e.g., for GPL and other open source license enforcement) and the industrial community (e.g., to prevent GPL "contamination" of proprietary commercial software systems). The largest collection of open source software in general distribution is the collection of eight DVDs in the Debian source distribution, and checking for cross-cloning with the Debian source distribution goes a long way towards finding any possible copying from the set of all open source code in the world. The NiCad clone detector is an open source language- sensitive robust clone detector that has been shown to yield both high precision and high recall in detecting syntactically meaningful near-miss clones such as functions and blocks. Given a directory of new source code to check, DebCheck uses NiCad in its incremental mode to efficiently check the system for near-miss clones of C functions in the entire Debian source base in a few minutes on a 2 Gb home computer. The same technique can be used to check systems for cross-clones with any large source collection.

The NiCad Clone Detector is a scalable, flexible clone detection tool designed to implement the NiCad (Automated Detection of Near-Miss Intentional Clones) hybrid clone detection method in a convenient, easy-to-use command-line tool that can easily be embedded in IDEs and other environments. It takes as input a source directory or directories to be checked for clones and a configuration file specifying the normalization and filtering to be done, and provides output results in both XML form for easy analysis and HTML form for convenient browsing. NiCad handles a range of languages and normalizations, and is designed to be easily extensible using a component-based plugin architecture. It is scalable to very large systems and has been used to analyze, for example, all 47 releases of FreeBSD (60 million lines) as a single system.

Software clones are identical or similar pieces of code. They are often the result of copy--and--paste activities as ad-hoc code reuse by programmers. Software clones research is of high relevance for the industry. Many researchers have reported high rates of code cloning in both industrial and open-source systems.

The optimal number of latent topics required to model the most accurate latent substructure for a source code corpus is an open question in source code analysis. Most estimates about the number of latent topics that exist in a software corpus are based on the assumption that the data is similar to natural language, but there is little empirical evidence to support this. In order to help determine the appropriate number of topics needed to accurately represent the source code, we generate a series of Latent Dirichlet Allocation models with varying topic counts. We use a heuristic to evaluate the ability of the model to identify related source code blocks, and demonstrate the consequences of choosing too few or too many latent topics.

Abstract The new hybrid clone detection tool NICAD combines the strengths and overcomes the limitations of both text‐based and AST‐based clone detection techniques and exploits novel applications of a source transformation system to yield highly accurate identification of cloned code in software systems. In this paper, we present an in‐depth study of near‐miss function clones in open source software using NICAD. We examine more than 20 open source C, Java and C# systems, including the entire Linux Kernel, Apache httpd, J2SDK‐Swing and db4o and compare their use of cloned code in several different dimensions, including language, clone size, clone similarity, clone location and clone density both by proportion of cloned functions and lines of cloned code. We manually verify all detected clones and provide a complete catalogue of different clones in an online repository in a variety of formats. These validated results can be used as a cloning reference for these systems and as a benchmark for evaluating other clone detection tools. Copyright © 2009 John Wiley & Sons, Ltd.

Languages and systems to support generative and transformational solutions have been around a long time. Systems such as XVCL, DMS, ASF+SDF, Stratego and TXL have proven mature, efficient and effective in a wide range of applications. Even so, adoption remains a serious issue - almost all successful production applications of these systems in practice either involve help from the original authors or years of experience to get rolling. While work on accessibility is active, with efforts such as ETXL, Stratego XT, Rascal and Colm, the fundamental big step remains - it's not obvious how to apply a general purpose transformational system to any given generation or transformation problem, and the real power is in the paradigms of use, not the languages themselves.

In this paper, we introduce a technique for applying independent component analysis to vector space representations of software code fragments such as methods or blocks. The distance between these points can be determined, and used as a measure of the similarity between the original source code fragments they represent. It can be reasoned that if the initial matrix representation contains enough information about the syntactic structure of the source code, the vector space representation will be sufficient to predict the similarity of fragments to one another, and can provide the likelihood that the code is a clone.

Abstract Models are considered an essential step in capturing different system behaviours and simplifying the analysis required to check or improve the quality of software. Verification and testing of web software requires effective modelling techniques that address the specific challenges of web applications. In this study we survey 24 different modelling methods used in web site verification and testing. Based on a short catalogue of desirable properties of web applications that require analysis, two different views of the methods are presented: a general categorization by modelling level, and a detailed comparison based on property coverage. Copyright © 2008 John Wiley & Sons, Ltd.

The increasing complexity of software systems and growing demand for regulations compliance require effective methods and tools to support requirements analysts activities. Internationalization of information systems due to both economics and Web based architectures call for the application of regulations written in different languages. Thus far existing approaches for extracting rights and obligations have concentrated on English documents. In this paper, we describe the results of the application of Cerno, a lightweight framework for semantic annotation, to legal documents written in Italian. In addition, we investigate critical issues for semantic annotation tools in a different cultural and environmental context. Results obtained, while preliminary, allow us to quantify the effort needed to port tools based on Cerno and give some insight on directions of future development of a multilingual system to support semantic annotation of regulations not only in different domains, but also written in different languages.

Over the last decade many techniques for software clone detection have been proposed. In this paper, we provide a comprehensive survey of the capabilities of currently available clone detection techniques. We begin with an overall survey based on criteria that capture the main features of detection techniques. We then propose a set of hypothetical editing scenarios for different clone types, and evaluate the techniques based on their estimated potential to accurately detect clones that may be created by those scenarios.

This paper examines the effectiveness of a new language- specific parser-based but lightweight clone detection approach. Exploiting a novel application of a source transformation system, the method accurately finds near-miss clones using an efficient text line comparison technique. The transformation system assists the method in three ways. First, using agile parsing it provides user-specified flexible pretty- printing to remove noise, standardize formatting and break program statements into parts such that potential changes can be detected as simple linewise text differences. Second, it provides efficient flexible extraction of potential clones to be compared using island grammars and agile parsing to select granularities and enumerate potential clones. Third, using transformation rules it provides flexible code normalization to allow for local editing differences between similar code segments and filtering out of uninteresting parts of potential clones. In this paper we introduce the theory and practice of the framework and demonstrate its use in finding function clones in C code. Early experiments indicate that the method is capable of finding near-miss clones with high precision and recall, and with reasonable performance.

Security, privacy and governance are increasingly the focus of government regulations in the U.S., Europe and elsewhere. This trendhas created a "regulation compliance problem", whereby companiesand developers are required to ensure that their software complies with relevant regulations, either through design or reengineering. We previously proposed a methodology for extracting stakeholder requirements, called rights and obligations, from regulations. In this paper, we examine the challenges of developing tool support for this process. We apply the Cerno framework for textual semantic annotation to propose a tool for semi-automatic semantic annotation of concepts that constitute sources of requirements

A common and difficult maintenance activity is the integration of existing software components or tools into a consistent and interoperable whole. One area in which this has proven particularly difficult is in the domain of software analysis and re-engineering tools, which have a relatively poor record of interoperability. This paper outlines our experience in facilitating interoperability between three such tools using OASIS, a service-sharing methodology that employs a domain ontology and specially constructed, noninvasive tool adapters

The TXL transformation framework has been widely used in practical source transformation tasks in industry and academia for many years. At the core of the framework is the TXL language, a functional programming language specifically designed for expressing source transformation tasks. TXL programs are self-contained, specifying and implementing all aspects of parsing, pattern matching, transformation rules, application strategies and unparsing in a single uniform notation with no dependence on other tools or technologies. Programs are directly interpreted by the TXL processor without any compile or build step, making it particularly well suited to rapid turnaround, test-driven development. In this paper we provide a practical introduction to using TXL in rapidly developing source transformations from concrete examples, and review experience in applying TXL to a number of practical large scale applications in source code analysis, renovation and migration.

Document recognition involves many kinds of hypotheses: segmentation hypotheses, classification hypotheses, spatial relationship hypotheses, and so on. Many recognition strategies generate valid hypotheses, which are eventually rejected, but current evaluation methods consider only accepted hypotheses. As a result, we have no way to measure errors associated with rejecting valid hypotheses. We propose describing hypothesis generation in more detail, by collecting the complete set of generated hypotheses and computing the recall and precision of this set: we call these the 'historical recall' and 'historical precision.' Using table cell detection examples, we demonstrate how historical recall and precision along with the complete set of generated hypotheses assist in the evaluation, debugging, and design of recognition strategies.

The table recognition literature contains many strategies specified informally as a sequence of operations, obscuring both models of table structure and the effects of individual decisions. Decision making is more transparent in formal model based approaches (e.g. grammar based) but these approaches are less flexible than informal ones. We propose an intermediate level of formalization, defining strategies as a sequence of basic graph transformations that correspond to recognition operations (e.g. classification, segmentation). Transformations are parameterized by logical types and decision functions, which together define structure models and executable strategies for interpreting input graphs. We provide an overview of our first attempt at this intermediate level of formalization, the Recognition Strategy Language (RSL). As a proof of concept, we reimplement two informally specified table recognition strategies from the literature in RSL. The RSL implementations capture descriptions of the formerly implicit table structure models, and automatically capture all decision making.

A common and difficult maintenance activity is the integration of existing software components or tools into a consistent and interoperable whole. One area in which this has proven particularly difficult is in the domain of software analysis and reengineering tools, which have a very poor record of interoperability. This paper outlines our experience in facilitating tool integration using a service-sharing methodology that employs a domain ontology and specially constructed, external tool adapters. A proof of concept implementation among three tools allowed us to explore service-sharing as a viable means for facilitating interoperability among these tools.

Today, many formal analysis tools are not only used to provide certainty but are also used to debug software systems - a role that has traditional been reserved for testing tools. We are interested in exploring the complementary relationship as well as tradeoffs between testing and formal analysis with respect to debugging and more specifically bug detection. In this paper we present an approach to the assessment of testing and formal analysis tools using metrics to measure the quantity and efficiency of each technique at finding bugs. We also present an assessment framework that has been constructed to allow for symmetrical comparison and evaluation of tests versus properties. We are currently beginning to conduct experiments and this paper presents a discussion of possible outcomes of our proposed empirical study.

We describe a robust and efficient system for recognizing typeset and handwritten mathematical notation. From a list of symbols with bounding boxes the system analyzes an expression in three successive passes. The Layout Pass constructs a Baseline Structure Tree (BST) describing the two-dimensional arrangement of input symbols. Reading order and operator dominance are used to allow efficient recognition of symbol layout even when symbols deviate greatly from their ideal positions. Next, the Lexical Pass produces a Lexed BST from the initial BST by grouping tokens comprised of multiple input symbols; these include decimal numbers, function names, and symbols comprised of nonoverlapping primitives such as "=". The Lexical Pass also labels vertical structures such as fractions and accents. The Lexed BST is translated into L/sup A/T/sub E/X. Additional processing, necessary for producing output for symbolic algebra systems, is carried out in the Expression Analysis Pass. The Lexed BST is translated into an Operator Tree, which describes the order and scope of operations in the input expression. The tree manipulations used in each pass are represented compactly using tree transformations. The compiler-like architecture of the system allows robust handling of unexpected input, increases the scalability of the system, and provides the groundwork for handling dialects of mathematical notation.

The structure of mathematics notation is particularly difficult to recognize in handwritten notation because irregular symbol placements are common. We present an efficient and robust method of parsing handwritten and typeset mathematics notation without backtracking. The system is designed to be easily adaptable to various dialects of mathematics notation. The following strategies are used: (1) separate the analysis of layout, syntax, and semantics, (2) recursively apply search functions and image partitioning to recognize dominant and nested baselines, and (3) use tree transformations to express computations in a compact, efficiently executable form.

The year 2000 problem posed a difficult problem for many IT shops world wide. The most difficult part of the problem was not the actual changes to ensure compliance, but finding and classifying the data fields that represent dates. This is a problem well suited to design recovery. The paper presents an overview of LS/2000, a system that used design recovery to analyze source code for year 2000 risks and guide a source transformation that was able to automatically remediate over 99% of the year 2000 risks in over three billion lines of production IT source.

In order to understand, analyze and modify software, we commonly examine and manipulate its architecture. For example, we may want to examine the architecture at different levels of abstraction. We can view such manipulations as architectural transformations, and more specifically, as graph transformations. We evaluate relational algebra as a way of specifying and automating the architectural transformations. Specifically, we examine Grok, a relational calculator that is part of the PBS toolkit. We show that relational algebra is practical in that we are able to specify many of the transformations commonly occurring during software maintenance and, using a tool like Grok, we are able to manipulate, quite efficiently, large software graphs; this is a "win". However, this approach is not well suited to express some types of transforms involving patterns of edges and nodes; this is a "loss". By means of a set of examples, the paper makes clear when the approach wins and when it loses.

Introduces a general, extensible diagrammatic syntax for expressing software architectures based on typed nodes and connections and formalized using set theory. The syntax provides a notion of abstraction corresponding to the concept of a subsystem, and exploits this notion in a general mechanism for pattern matching over architectures. We demonstrate these ideas using a small example architecture language with a limited number of types of nodes and connectors, and a small taxonomy of architectures characterized as sets of patterns in the language.>

Abstract This paper describes a new systematic approach to code generation. The approach is based on an orthogonal model, in which implementation of language‐level operators (‘operators’) and addressing operators (‘operands’) is achieved by two independent subtasks. Each of these phases is specified using a set of decision trees that encode the set of possible implementation templates for each language feature and the set of constraints under which each can be applied. Code selection in each phase is achieved by interpreting these trees using a single comprehensive selection algorithm. The method easily extends to machine independence across a large class of target computers by abstracting the implementation templates into machine‐independent implementation strategies. The selection algorithm is then modified to select between implementation strategies based on a machine capability ‘menu’ that describes each target machine in terms of the subset of implementation strategies for which it has corresponding instruction sequences. The method has been used to implement a prototype machine‐independent code generator for the Concurrent Euclid programming language whose generated code density is consistently within four per cent of production machine‐dependent code generators across its entire target class of five modern computers.

TuringTool is a source program viewing and editing system specifically designed to support the software maintenance task. TuringTool bases all of its views of the program on a single comprehensive viewing paradigm borrowed from program development environments: source text elision. It is shown how this paradigm can be used to represent several kinds of views appropriate to the maintenance of large source programs, including structural views and nonstructural views appropriate to the maintenance task and how it can be extended to allow dynamic creation of complex programmer-specified views using simple set theoretic operators to combine the effects of several views into one. The system exploits the highly structured nature of the Turing programming language to allow seamless viewing of programs consisting of many separately compiled source modules as one uniform source.>

This paper presents the design of an interpreter structure for modern programming languages such as Turing and Modula II that is modular and highly orthogonal while providing maximal flexibility and efficiency in implementation. At the outermost level, the structure consists of a front end, responsible for interaction with the user, and a back end, responsible for execution. The two are linked by a single database consisting of the tokenized statements of the user program. Interfaces between the major modules of each part are defined in such a way as to maximize reusability, and each interface can service a range of plug-compatible modules implementing radically different semantics. The design accommodates a wide spectrum of interpreter types ranging from batch-oriented compiler-simulators to statement-by-statement interactive execution, and provides for a range of program editing tools from simple line editors through to modern language-directed programming environments. It has served as the basis for several interpretive systems including the production Turing interpreter, the Turing Programming Environment, and the Turing Tool software maintenance tool.

Abstract Aliasing of variables occurs when two or more identifiers accessible in the same scope refer to the same storage location. When aliasing is present, the meaning of assignments becomes obscure because assignment to one variable identifier may change the value of others. Some of the more obscure kinds of variable aliasing can be the cause of particularly insidious bugs in computer programs. Axiomatic proof systems, such as that used for the Euclid language, assume that no aliasing is present so that the meaning of assignment is clear. For this reason, Euclid requires that no aliasing be present in Euclid programs and requires the compiler to implement checks to ensure this. This paper discusses the features of Euclid that aid in the detection of aliasing. It enumerates the kinds of aliasing that can be present in Euclid programs and gives efficient one‐pass algorithms for compile‐time detection of potential aliases. Aliasing is related to interference between concurrent processes, and a similar algorithm for detection of inter‐process interference in Concurrent Euclid programs is presented.

S/SL (Syntax/Semantic Language) is a language that was developed for implementing compilers.A subset called SL (Syntax Language) has the same recognition power as do LR(k) parsers.Complete S/SL includes invocation of semantic operations implemented in another language such as PASCAL.S/SL implies a top-down programming methodology.First, a data-free algorithm is developed in S/SL.The algorithm invokes operations on "semantic mechanisms."A semantic mechanism is an abstract object, specified, from the point of view of the S/SL, only by the effect of operations upon the object.Later, the mechanisms are implemented apart from the S/SL program.The separation of the algorithm from the data and the division of data into mechanisms reduce the effort needed to understand and maintain the resulting software.S/SL has been used to construct compilers for SPECKLE (a PL/I subset), PT (a PASCAL subset), Toronto EUCLID, and Concurrent EUCLID.It has been used to implement scanners, parsers, semantic analyzers, and code generators.S/SL programs are implemented by translating them into tables of integers.A "table walker" program executes the S/SL program by interpreting this table.The translation of S/SL programs into tables is performed by a program called the S/SL processor.This processor serves a function analogous to that served by an LR(k) parser generator.The implementation of S/SL is simple and portable.It is available in a small subset of PASCAL that can easily be transliterated into other high-level languages.