Source code clone detection is to excavate code fragments with similar functionalities, which has been more and more important in software engineering. Many approaches have been proposed for detecting code clones, in which token-based methods are the most scalable but cannot handle semantic clones because of the lack of consideration of program semantics. To address the issue, researchers conduct program analysis to distill the program semantics into a graph representation and detect clones by matching the graphs. However, such approaches suffer from low scalability since graph matching is typically time-consuming. In this paper, we propose SCDetector to combine the scalability of token-based methods with accuracy of graph-based methods for software functional clone detection. Given a function source code, we first extract the control flow graph by static analysis. Instead of traditional heavyweight graph matching, we treat the graph as a social network and apply social-network-centrality analysis to dig out the centrality of each basic block. Then we assign the centrality to each token in a basic block and sum the centrality of the same token in different basic blocks. By this a graph is turned into certain tokens with graph semantics (i.e., centrality), called semantic tokens. In final, these semantic tokens are fed into a Siamese architecture neural network to train a model, and uses it to detect code clones. We evaluate SCDetector on two large datasets of functionally similar code. Experimental results indicate that our system is superior to state-of-the-art methods and the time cost of SCDetector is more than 14 times less than the state-of-the-art approach in detecting semantic clones.

Yueming Wu

Huazhong University of Science and Technology

Deqing Zou

Huazhong University of Science and Technology

Shihan Dou

Huazhong University of Science and Technology

Siru Yang

Huazhong University of Science and Technology

Wei Yang

University of Texas at Dallas, USA

United States

Feng Cheng

Huazhong University of Science and Technology

Hong Liang

Huazhong University of Science and Technology

Hai Jin

Huazhong University of Science and Technology

Developers are concerned with the comparison of similar APIs in terms of their commonalities and (often subtle) differences. Our empirical study of Stack Overflow questions and API documentation confirms that API comparison questions can often be answered by knowledge contained in API reference documentation. Our study also identifies eight types of API statements that are useful for API comparison. Based on these findings, we propose a knowledge graph based approach APIComp that automatically extracts API knowledge from API reference documentation to support the comparison of a pair of API classes or methods from different aspects. Our approach includes an offline phase for constructing an API knowledge graph, and an online phase for generating an API comparison result for a given pair of API elements. Our evaluation shows that the quality of different kinds of extracted knowledge in the API knowledge graph is generally high. Furthermore, the comparison results generated by APIComp are significantly better than those generated by a baseline approach based on heuristic rules and text similarity, and our generated API comparison results are useful for helping developers in API selection tasks.

Yang Liu

Fudan University, China

Mingwei Liu

Fudan University, China

China

Xin Peng

Fudan University, China

China

Christoph Treude

University of Adelaide, Australia

Australia

Zhenchang Xing

Australian National University, Australia

Australia

Xiaoxin Zhang

Fudan University, China

Just-In-Time (JIT) defect prediction is a classification model that is trained using historical data to predict bug-introducing changes. However, recent studies raised concerns related to the explainability of the predictions of many software analytics applications (i.e., practitioners do not understand why commits are risky and how to improve them). In addition, the adoption of Just-In-Time defect prediction is still limited due to a lack of integration into CI/CD pipelines and modern software development platforms (e.g., GitHub). In this paper, we present an explainable Just-In-Time defect prediction framework to automatically generate feedback to developers by providing the riskiness of each commit, explaining why such commit is risky, and suggesting risk mitigation plans. The proposed framework is integrated into the GitHub CI/CD pipeline as a GitHub application to continuously monitor and analyse a stream of commits in many GitHub repositories. Finally, we discuss the usage scenarios and their implications to practitioners. The VDO demonstration is available at https://youtu.be/HJBzULrS6hE.

Chaiyakarn Khanan

Mahidol University

Worawit Luewichana

Mahidol University

Krissakorn Pruktharathikoon

Mahidol University

Jirayus Jiarpakdee

Monash University, Australia

Chakkrit (Kla) Tantithamthavorn

Monash University, Australia

Australia

Morakot Choetkiertikul

Mahidol University, Thailand

Thailand

Chaiyong Rakhitwetsagul

Mahidol University, Thailand

Thailand

Thanwadee Sunetnanta

Mahidol University