Reviewerly/exHarmony huggingface dataset:
Pre-trained Model Based Feature Envy Detection

Code smells slow down software system development and makes them harder to maintain. Existing research aims to develop automatic detection algorithms to reduce the labor and time costs within the detection process. Deep learning techniques have recently been demonstrated to enhance the performance of recognizing code smells even more than metric-based heuristic detection algorithms. As large-scale pre-trained models for Programming Languages (PL), such as CodeT5, have lately achieved the top results in a variety of downstream tasks, some researchers begin to explore the use of pre-trained models to extract the contextual semantics of code to detect code smells. However, little research has employed contextual code semantics relationship between code snippets obtained by pre-trained models to identify code smells. In this paper, we investigate the use of the pre-trained model CodeT5 to extract semantic relationships between code snippets to detect feature envy, which is one of the most common code smells. In addition, to investigate the performance of these semantic relationships extracted by pre-trained models of different architectures on detecting feature envy, we compare CodeT5 with two other pre-trained models CodeBERT and CodeGPT. We have performed our experimental evaluation on ten open-source projects, our approach improves F-measure by 29.32% on feature envy detection and 16.57% on moving destination recommendation. Using semantic relations extracted by several pre-trained models to detect feature envy outperforms the state-of-the-art. This shows that using this semantic relation to detect feature envy is promising. To enable future research on feature envy detection, we have made all the code and datasets utilized in this article open source.
Investigating the Resolution of Vulnerable Dependencies with Dependabot Security Updates

Modern software development practices increasingly rely on third-party libraries due to the inherent benefits of reuse. However, libraries may contain security vulnerabilities that can propagate to the dependent applications. To counter this, maintainers of dependent projects should monitor their dependencies and security reports to ensure that only patched releases of the upstream applications are in use. As manual maintenance of dependencies has shown to be ineffective, several automated tools (aka bots) have been proposed to assist developers in rapidly identifying and resolving vulnerable dependencies. In this work, we focus on Dependabot, a popular bot providing security and version updates, and study developers’ receptivity to its security updates in engineered and actively maintained JavaScript projects. Moreover, we carry out a fine-grained analysis of the lifecycle of every vulnerability to manifest how they are dealt with in the presence of Dependabot. Our findings show that the task of fixing vulnerable dependencies is, to a large extent, delegated to Dependabot and that developers merge the majority of security updates within several days. On the other hand, when developers do not merge a security update, they usually address the identified vulnerability manually. This approach, however, often takes up to several months which in turn could expose the projects to security issues.
EGAD: A moldable tool for GitHub Action analysis

GitHub Actions (GA) enjoy increasing popularity in many software development projects as a means to automate repetitive software engineering tasks by enabling programmable event-driven workflows. Researchers typically analyze GA at the raw data level using batch tools to mine and analyze actions, jobs, and steps within GA workflows. Although this approach is widely applicable, it ignores the specific context of the GA workflow domain. Consequently, researchers do not reason directly about the domain abstractions.We present our preliminary steps in building EGAD (Explorable GitHub Action Domain Model), a moldable domain-specific tool to depict and analyze detailed GA workflow data. EGAD consists of an explorable domain model of GA workflows augmented with custom, domain-specific views, and live narratives. We illustrate EGAD in action using it to explore "sticky commits" in GitHub repositories.
Predicting NFT Classification with GNN: A Recommender System for Web3 Assets

The development of effective recommender systems for Web3 assets, such as the Non-Fungible Token (NFT), requires concentration along with the growth of popularity and heterogeneity in many potential applications such as Web3 gaming and NFT rental markets, the requirements of predicting rNFT classification desire a practical solution. In this paper, we make use of the referable NFT (rNFT <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> In this work, rNFT mainly refers to the EIP-5521 protocol and corresponding formed network/topology [1], while NFT is used in the context of a single node, node sets, or products that align with the EIP-5521 protocol.) standard [2], indexed EIP-5521, to construct an rNFT classification framework leveraging Graph Neural Network (GNN), an emerging branch of Deep Learning (DL), which learns on the inherent topology of graph-based data. In particular, we first transform the rNFT backward and onward reference relationship to a Direct Acyclic Graph (DAG) and model appropriate node and edge features from rNFT metadata and associated token transactions. Next, a multi-layer GraphSage model is designed to include the collected features for the learning process. In this way, the model takes into account graph topology together with features to classify both the existing and incoming NFT nodes in a supervised way. We also give comprehensive elaboration on the architecture of the new GNN-based recommender system with discussions in regard to its characteristics and challenges. Furthermore, we expect to conduct extensive experiments, by presenting an initial plan, to show the feasibility and efficacy of our system.
Towards strengthening software library interfaces with granular and interactive type migrations

The interface boundaries of software projects are a crucial perimeter from both a design and security point of view. Design decisions of libraries will inadvertently affect client code which can neither legally nor technically change the library's contract. Mistakes allowed by the interface design, such as argument selection defects, can only be caught with existing tools once made. This is made worse in C++, as functions may take parameters which types are implicitly convertible to one another. Instead, I proposed a proactive step to detect and improve when a library interface exhibits properties that may lead to inadvertent misuse. Actionable fixes for the reports are possible through an interactive type refactoring method. Existing refactorings for type migration required the new types and the migration process to be well-defined in advance; otherwise, the code might be changed to a non-compilable state. This paper summarises my thesis proposal in which the problem of weak function interfaces is detected and solved by the Fictive Types method, which first “colours” the software project with new type information, deferring the complete rewrite once the required interface of the new type is fully explored.
The Internet of Energy Systems: Blockchain and Smart Contracts meet Federated Learning

The Internet of Energy (IoE) is a distributed paradigm that integrates smart networks and Internet technology. In contrast to traditional centralized energy systems, distributed Energy Internet systems with multiple components and communication requirements necessitate innovative technologies for decentralization, reliability, efficiency and security. Novel blockchain architectures, smart contracts, and distributed federated learning technologies offer new opportunities for decentralized Energy Internet services. In this paper, we classify state-of-the-art solutions utilizing blockchain, smart contracts, and federated learning for the IoE domains. In this context, four representative system models are identified and discussed. These models demonstrate various ways in which blockchain, smart contracts, and federated learning can be integrated to support the main domains of IoE, namely distributed energy trading and sharing, smart microgrid energy networks, and electric and connected vehicle management.
PCR-Chain: Partial Code Reuse Assisted by Hierarchical Chaining of Prompts on Frozen Copilot

API documentation, technical blogs and programming Q&A sites contain a large amount of partial code that can be reused in programming tasks. However, due to unresolved simple names and last-mile syntax errors, such partial code is frequently not compilable. To facilitate partial code reuse, we develop PCR-Chain for resolving FQNs and fixing last-mile syntax errors in partial code based on a giant pre-trained code model (e.g., Copilot). Methodologically, PCR-Chain is backed up by the underlying global-level prompt architecture (which combines three design ideas: hierarchical task breakdown, prompt composition including sequential and conditional structures, and a mix of prompt-based AI and non-AI units) and the local-level prompt design. Technically, we propose PCR-Chain, which employs in-context learning rather than supervised fine-tuning with gradient updates on downstream task data. This approach enables the frozen, giant pre-trained code model to learn the desired behavior for a specific task through behavior-describing prompts and imitate it to complete the task. Experimental results show that PCR-Chain automatically resolves the FQNs and fixes last-mile syntax errors in 50 partial code samples collected from Stack Overflow with high success rates, without requiring any program analysis. The correct execution of the unit, module, and PCR-Chain demonstrates the effectiveness of the prompt design, prompt composition, and prompt architecture. Website:https://github.com/SE-qinghuang/PCR-ChainDemoVideo: https://youtu.be/6HGRNc2JE
Large Language Models and Simple, Stupid Bugs

With the advent of powerful neural language models, AI-based systems to assist developers in coding tasks are becoming widely available; Copilot is one such system. Copilot uses Codex, a large language model (LLM), to complete code conditioned on a preceding "prompt". Codex, however, is trained on public GitHub repositories, viz., on code that may include bugs and vulnerabilities. Previous studies [1], [2] show Codex reproduces vulnerabilities seen in training. In this study, we examine how prone Codex is to generate an interesting bug category, single statement bugs, commonly referred to as simple, stupid bugs or SStuBs in the MSR community. We find that Codex and similar LLMs do help avoid some SStuBs, but do produce known, verbatim SStuBs as much as 2x as likely than known, verbatim correct code. We explore the consequences of the Codex generated SStuBs and propose avoidance strategies that suggest the possibility of reducing the production of known, verbatim SStubs, and increase the possibility of producing known, verbatim fixes.
Quantum Software Testing: A Brief Introduction

Quantum software testing concentrates on testing quantum programs to discover quantum faults in the programs cost-effectively. Given the foundations in quantum mechanics, the way quantum computations are performed is significantly different than classical computing. Therefore, quantum software testing also differs from classical software testing. There has been quite an interest in building quantum software testing techniques since 2019 in the software engineering (SE) community. Thus, we aim to introduce quantum software testing to the SE community. In particular, we will present the basic foundations of quantum computing and quantum programming as circuits, followed by the current state of the art on quantum software testing. Next, we will present some basic quantum software testing techniques and finally give the research directions that deserve attention from the SE community.
How does quality deviate in stable releases by backporting?

Software goes through continuous evolution in its life cycle to sustain bugs and adopt enhanced features. However, many industrial users show reluctance to upgrade to the latest version, considering the stability and intuitive solace of the release they are using. This boosts the need to derive change patches from state-of-the-art versions to older software versions. This phenomenon is frequently supported by 'Backporting' in the industrial setting as the intent for backward patch propagation stood principally to sustain older releases, and the contribution does not count up to the upstream repository. However, it is yet unknown whether backport can act as a credible threat for stable releases. In this study, we aim to empirically quest backports to reveal the evolution trend of code entities through maintenance and pinpoint how they pull stable releases into the weak spectrum. The breakdown shows code entities often encounter gradual transformation in size, complexity and coupling due to consecutive commits on them. However, the numerics of outlier quality degradations are not insignificant at all in this context which calls for further investigation into why and when they may occur. Moreover, we observed that vulnerable change transmission often materializes with quality degradation. Understanding these issues and consequences is crucial for effectively supporting the backporting process for stable release maintenance.
Seldonian Toolkit: Building Software with Safe and Fair Machine Learning

We present the Seldonian Toolkit, which enables software engineers to integrate provably safe and fair machine learning algorithms into their systems. Software systems that use data and machine learning are routinely deployed in a wide range of settings from medical applications, autonomous vehicles, the criminal justice system, and hiring processes. These systems, however, can produce unsafe and unfair behavior, such as suggesting potentially fatal medical treatments, making racist or sexist predictions, or facilitating radicalization and polarization. To reduce these undesirable behaviors, software engineers need the ability to easily integrate their machine-learning-based systems with domain-specific safety and fairness requirements defined by domain experts, such as doctors and hiring managers. The Seldonian Toolkit provides special machine learning algorithms that enable software engineers to incorporate such expert-defined requirements of safety and fairness into their systems, while provably guaranteeing those requirements will be satisfied. A video demonstrating the Seldonian Toolkit is available at https://youtu.be/wHR-hDm9jX4/
A Comprehensive and Quantitative Evaluation Method for Blockchain Protocols

As blockchain protocols exhibit diverse characteristics and performances, it is crucial to decide whether to develop a custom blockchain protocol, select an existing platform, or identify a promising protocol before initiating a blockchain-based service or starting a new business. To assist the general public and business operators in assessing the desirability of each blockchain protocol, various services provide evaluation and ranking services for blockchain projects. However, most of these services rely on qualitative evaluation based on reports provided by the blockchain development team. Therefore, we propose a quantitative evaluation method for blockchain protocols that compares and analyzes the technological status, future development direction, and technological differences of Layer 1 and Layer 2 protocols. Our approach incorporates indicators that are distinct from other services and indicators specific to layer 2 solutions, facilitating a more comprehensive analysis of blockchain protocols. This allows for objective evaluation of protocol performance and mutual comparison between protocols.
A Web-Based Tool for Using Storyboard of Android Apps

The development team usually makes painstaking efforts to review and analyze many existing apps with similar purposes such as competitive analysis, design recommendation, code generation, and app testing. To assist different roles in doing these tasks, in our prior work, two advanced approaches (i.e., StoryDroid and StoryDistiller) have been proposed to automatically generate the storyboards for Android apps with rich features such as UI pages, UI components, layout code, and logic code. These approaches both aim at exploring and parsing as many app pages as possible but lack some consideration of the presentation and interpretability of the results for different users such as PMs, designers, and developers. To improve usability and scalability, this paper presents a web-based offline tool, named StoryDroid+, which provides an operation-friendly platform for using storyboards and helps different stakeholders (e.g., designers, package managers, developers) explore and understand apps from different perspectives through rich visual pages. The tool and datasets are available at: https://github.com/tjusenchen/StoryDroid and the demonstration video can be found at: https://youtu.be/prszxRdkdYU.
Enriching Source Code with Contextual Data for Code Completion Models: An Empirical Study

Transformer-based pre-trained models have recently achieved great results in solving many software engineering tasks including automatic code completion which is a staple in a developer's toolkit.While many have striven to improve the codeunderstanding abilities of such models, the opposite -making the code easier to understand -has not been properly investigated.In this study, we aim to answer whether making code easier to understand through using contextual data improves the performance of pre-trained code language models for the task of code completion.We consider type annotations and comments as two common forms of additional contextual information that often help developers understand code better.For the experiments, we study code completion in two granularity levels; token and line completion and take three recent and large-scale language models for source code: UniXcoder, CodeGPT, and InCoder with five evaluation metrics.Finally, we perform the Wilcoxon Signed Rank test to gauge significance and measure the effect size.Contrary to our expectations, all models perform better if type annotations are removed (albeit the effect sizes are small).For comments, we find that the models perform better in the presence of multi-line comments (again with small effect sizes).Based on our observations, we recommend making proper design choices when training, fine-tuning, or simply selecting such models given the intended data and application.Better evaluations and multimodal techniques can also be further investigated to improve the practicality and accuracy of auto-completions.
Actionsremaker: Reproducing GITHUB Actions

Mining Continuous Integration and Continuous Delivery (CI/CD) has enabled new research opportunities for the software engineering (SE) research community. However, it remains a challenge to reproduce CI/CD build processes, which is crucial for several areas of research within SE such as fault localization and repair. In this paper, we present Actionsremaker, a reproducer for GITHUB Actions builds. We describe the challenges on reproducing GITHUB Actions builds and the design of Actionsremaker. Evaluation of Actionsremaker demonstrates its ability to reproduce fail- pass pairs: of 180 pairs from 67 repositories, 130 (72.2 %) from 43 repositories are reproducible. We also discuss reasons for unreproducibility. Actionsremaker is publicly available at https://github.com/bugswarm/actions-remaker, and a demo of the tool can be found at https://youtu.be/flbISqoxeAk.
Managing Write Access without Token Fees in Leaderless DAG-based Ledgers

A significant portion of research on distributed ledgers has focused on circumventing the limitations of leader-based blockchains mainly in terms of scalability, decentralization and power consumption. Leaderless architectures based on directed acyclic graphs (DAGs) avoid many of these limitations altogether, but their increased flexibility and performance comes at the cost of increased design complexity, so their potential has remained largely unexplored. Management of write access to these ledgers presents a major challenge because ledger updates may be made in parallel, hence transactions cannot simply be serialised and prioritised according to token fees paid to validators. In this work, we propose an access control scheme for leaderless DAG-based ledgers which is based on consuming credits rather than paying fees in the base token. We outline a general model for this new approach and provide some simulation results showing promising performance boosts.
Tools Do Not Create: Human Authorship in the Use of Generative Artificial Intelligence

Download This Paper Open PDF in Browser Add Paper to My Library Share: Permalink Using these links will ensure access to this page indefinitely Copy URL Copy DOI
Concrete Security from Worst-Case to Average-Case Lattice Reductions

A famous reduction by Regev shows that random instances of the Learning With Errors (LWE) problem are asymptotically at least as hard as a worst-case lattice problem. As such, by assuming that standard lattice problems are hard to solve, the asymptotic security of cryptosystems based on the LWE problem is guaranteed. However, it has not been clear to which extent, if any, this reduction provides support for the security of present concrete parametrizations. In this work we therefore use Regev’s reduction to parametrize a cryptosystem, providing a reference as to what parameters are required to actually claim security from this reduction. This requires us to account for the concrete performance of this reduction, allowing the first parametrization of a cryptosystem that is provably secure based only on a conservative hardness estimate for a standard lattice problem. Even though we attempt to optimize the reduction, our system still requires significantly larger parameters than typical LWE-based cryptosystems, highlighting the significant gap between parameters that are used in practice and those for which worst-case reductions actually are applicable.
The Curious Case of the Half-Half Bitcoin ECDSA Nonces

We report on a new class of ECDSA signature vulnerability observed in the wild on the Bitcoin blockchain that results from a signature nonce generated by concatenating half of the bits of the message hash together with half of the bits of the secret signing key. We give a lattice-based attack for efficiently recovering the secret key from a single signature of this form. We then search the entire Bitcoin blockchain for such signatures, and identify and track the activities of an apparently custom ECDSA/Bitcoin implementation that has been used to empty hundreds of compromised Bitcoin addresses for many years.
Universal Hashing Based on Field Multiplication and (Near-)MDS Matrices

In this paper we propose a new construction for building universal hash functions, a specific instance called multi-265, and provide proofs for their universality. Our construction follows the key-then-hash parallel paradigm. In a first step it adds a variable length input message to a secret key and splits the result in blocks. Then it applies a fixed-length public function to each block and adds their results to form the output. The innovation presented in this work lies in the public function: we introduce the multiply-transform-multiply-construction that makes use of field multiplication and linear transformations. We prove upper bounds for the universality of key-then-hash parallel hash functions making use of a public function with our construction provided the linear transformation are maximum-distance-separable (MDS). We additionally propose a concrete instantiation of our construction multi-265, where the underlying public function uses a near-MDS linear transformation and prove it to be $$2^{-154}$$ -universal. We also make the reference code for multi-265 available.