bluuebunny/crossref_metadata_2025 huggingface dataset:
Locking-Free Kriging-Based Curved Beam Elements with the Discrete Strain Gap Technique
Authors: Wong F. T. , Gunawan Junius
Published: July 2024

Kriging-based finite element method (K-FEM) is an enhancement of the FEM using Kriging interpolation in place of the conventional polynomial interpolation. This paper presents the development of the K-FEM for analysis of curved beams based on a deep arc theory, which accounts for membrane and shear deformation. The discrete strain gap technique is employed to circumvent shear locking and membrane locking. The numerical tests show that the Kriging-based elements are free from any locking, are able to provide highly accurate solutions with a regular course mesh discretization, and have excellent convergence characteristics, especially for circular beams.
On the irrationality of certain 2-adic zeta values
Authors: Lai Li
Published: July 2024

Let [Formula: see text] denote the Kubota–Leopoldt 2-adic zeta function. We prove that, for every nonnegative integer s, there exists an odd integer j in the interval [Formula: see text] such that [Formula: see text] is irrational. In particular, at least one of [Formula: see text] is irrational. Our approach is inspired by the recent work of Sprang. We construct explicit rational functions. The Volkenborn integrals of these rational functions’ (higher-order) derivatives produce good linear combinations of 1 and 2-adic Hurwitz zeta values. The most difficult step is proving that certain Volkenborn integrals are nonzero, which is resolved by carefully manipulating the binomial coefficients.
Effect of Gamma Irradiation on the Optical and Electrical Properties of PVA/CdS Nanocomposites
Authors: Nuriyev M. A. , Gasimova A. I. , Nuruyev I. M. , Shukurova A. A.
Published: July 2024

PVA/CdS nanocomposites were obtained by forming cadmium sulfide (CdS) nanoparticles by the layered chemisorption method of anions and cations from a solution of appropriate salts in the pores of polyvinyl alcohol (PVA). A comparative analysis of optical and electrical properties of pristine and gamma-irradiated PVA/CdS nanocomposites was performed. It has been shown that the observed changes in the optical and electrical properties of gamma-irradiated PVA/CdS nanocomposites are the result of a change in the ratio between the construction and destruction processes occurring in the matrix and at the polymer-filler interphase boundary. We believe that the reason why the value of the forbidden zone determined from the optical properties of the original and irradiated PVA/CdS nanocomposites shifts from 6[Formula: see text]eV for PVA to 2.6[Formula: see text]eV with the increase in the number of formation cycles in nanocomposites is the change in the size of CdS nanoparticles. The reason for the changes in the value of the [Formula: see text] parameter of nanocomposites with the increase of the dose of gamma radiation is the change in the relationship between the interaction between components and the construction-destruction processes at the polymer-filler interphase boundary, as can be seen from the dependences of [Formula: see text]. The reason for the changes in the electrical properties of PVA/CdS nanocomposites is the change in the mobility of the macromolecular chains of the matrix due to the changes that occur at the interphase boundary after gamma irradiation. The results of the study show that the optical and electrical properties of nanocomposites can be controlled by choosing the number of forming cycles and the value of the gamma radiation dose.
NN-VVC: A Hybrid Learned-Conventional Video Codec Targeting Humans and Machines
Authors: Ahonen Jukka I. , Le Nam , Zhang Honglei , Hallapuro Antti , Cricri Francesco , Tavakoli Hamed Rezazadegan , Hannuksela Miska M. , Rahtu Esa
Published: July 2024

Advancements in artificial intelligence have significantly increased the use of images and videos in machine analysis algorithms, predominantly neural networks. However, the traditional methods of compressing, storing and transmitting media have been optimized for human viewers rather than machines. Current research in coding images and videos for machine analysis has evolved in two distinct paths. The first is characterized by End-to-End (E2E) learned codes, which show promising results in image coding but have yet to match the performance of leading Conventional Video Codecs (CVC) and suffer from a lack of interoperability. The second path optimizes CVC, such as the Versatile Video Coding (VVC) standard, for machine-oriented reconstruction. Although CVC-based approaches enjoy widespread hardware and software compatibility and interoperability, they often fall short in machine task performance, especially at lower bitrates. This paper proposes a novel hybrid codec for machines named NN-VVC, which combines the advantages of an E2E-learned image codec and a CVC to achieve high performance in both image and video coding for machines. Our experiments show that the proposed system achieved up to − 43.20% and − 26.8% Bjøntegaard Delta rate reduction over VVC for image and video data, respectively, when evaluated on multiple different datasets and machine vision tasks according to the common test conditions designed by the VCM study group in MPEG standardization activities. Furthermore, to improve reconstruction quality, we introduce a human-focused branch into our codec, enhancing the visual appeal of reconstructions intended for human supervision of the machine-oriented main branch.
A Method for Determining the Fundamental Site Period and the Average Shear Wave Velocity
Authors: Bozdogan Kanat Burak , Keskin Erdinc
Published: July 2024

The soil–structure interaction plays a crucial role in determining the displacement and internal forces of multi-story buildings subjected to strong ground motion. One of the critical dynamic characteristics influencing soil–structure interaction is the fundamental site period and the average shear wave velocity associated with it. This study introduces an original equation to determine these parameters. In addition, for the first time in the literature, the version of the Rayleigh method used for finding the fundamental periods of buildings is used to find the fundamental site period. The soil is modeled as an equivalent shear beam to obtain the proposed equation. The peak displacement is obtained by acting the soil mass as an external load on the equivalent shear beam. For single-layer soil, the fundamental site period is proportional to the square root of the peak displacement of the equivalent shear beam. The least squares method generalizes the proposed relation for single-layer soils to multi-layer soil profiles. Modified Finite element Transfer matrix method is used for calibration in the least squares method. The equations used in the literature and earthquake codes for determining the fundamental site period and average shear velocity are tested on various examples, and it is shown that the method proposed in this study, along with the Rayleigh method, gives better results than these equations. The performances of these two methods and the five commonly used equations are tested and compared on different soil profiles. Transfer functions, Finite Element Method (SAP200) and Modified Finite Element Transfer Matrix Method are used for verification. For all soil profiles, the results obtained from the transfer function, Finite Element Method (SAP200) and Modified Finite Element Transfer Matrix Method are found to be in agreement. The true percent relative error found in the results obtained with the proposed method is 4.47%.
Efficient exploration of electronic and dielectric properties using advanced first-principles analysis grounded in modern theory of polarization: Application to PbTiO3
Authors: Belboukhari Aimad , Saghir Souad Ait , Bakak Abderrahim , El-Jallal Said , Bentaleb Khaled Ait , Koumina My Abdelaziz , Mezzane Daoud , Gagou Yaovi
Published: July 2024

Electronic and dielectric properties are essential for understanding many functional materials, predicting their behavior and optimizing their performance across different shapes, geometries and scales. Several approaches were developed and explored to investigate more or less deeply the appropriate properties. One of the most appealing, accurate and efficient approach is first principle simulations based on modern theory of polarization. Especially with the increased availability of powerful computational resources and techniques. Building upon these advancements, our contribution aims to elucidate an efficient methodology for studying electronic and dielectric properties by applying the Berry phase and Maximally Localized Wannier functions methods. Our exploration will initially focus on a systematic study of the electronic, chemical bonding, ferroelectric and piezoelectric properties of the well-known prototypical bulk system PbTiO3. Subsequently, we will extend our study to examine slab properties as surface termination and slab thickness effect on electronic properties, utilizing the robust Wannier-justified Tight Binding model.
Investigation of the preparation and performance of Ag-modified ZnO nanowall ultraviolet detector
Authors: Wang Xiaoyang , Dong Juntang , Shang Shiguang , Xin Shiheng , Li Shiping , Shao Tingting , Yang Yanning , Zhang Fuchun , Ni Zeheng
Published: July 2024

In this paper, silver (Ag) nanoparticle-modified zinc oxide (ZnO) nanowall photoconductive ultraviolet photodetector was prepared by using magnetron sputtering technology, electron beam evaporation method and hydrothermal method. The results showed that ZnO nanowalls exhibited a hexagonal wurtzite structure. ZnO nanowalls grew uniformly perpendicular to the substrate, and metallic Ag nanoparticles were uniformly attached to the surface of ZnO nanowalls, effectively improving the ZnO nanowall absorption capability in the ultraviolet light region. The dark current of the Ag-modified ZnO nanowall UV detector deposited by sputtering for 40[Formula: see text]s was 0.042[Formula: see text]mA, revealing a decrease of 44%. Under the irradiation of ultraviolet light with a wavelength of 325[Formula: see text]nm, the photocurrent reached 3.088[Formula: see text]mA, which increased by four times. The responsivity increased from 27.29 to 101.07[Formula: see text]mA/W, and the sensitivity increased from 8.07 to 73.52. In addition to the good repeatability and stability, the response time was reduced by 64%, and the recovery time was decreased by 50%.
Investigation of High-Entropy Alloys with Rare Element Additions Undergoing Phase Transformation at Cryogenic Temperatures
Authors: Alfitouri Abdulkarim Omar , Çuğ Harun , Cicek Bunyamin , Erden Mehmet Akif , Güngüneş Hakan , Ahmed Salih Birhanu , Elkilani Rajab
Published: July 2024

This study investigates the impact of rare elements on high-entropy alloys (HEAs) and provides significant insights. By integrating varying proportions of Al-Nd and Al-Ce compounds into a CoCrFeNi-based alloy, shifts were detected in the microstructure and phase composition of grains. As the proportion of rare elements rose, their localization within the grain phase structure intensified, leading to overall coarsening. The heat transfer characteristics of HEA alloys containing rare elements exhibited variability, with notable phase transitions occurring at cryogenic temperatures based on the alloying constituents. Among the tested alloys, Ce10 and Ce20 alloys demonstrated the highest heat transfer rates (800[Formula: see text][Formula: see text]). Notably, an escalation in the rare element ratio added to the alloy resulted in a significant augmentation in hardness, nearly doubling the original level.
Fabrication and Electrochemical Analysis of NiCo2O4@Ni-MOF Nanoarchitectonics Composites on Ni-Foam Substrate for Supercapacitor Electrodes
Authors: Jung Ye Seul , Chung Sungwook , Jung Yongju , Kim Seok
Published: July 2024

To produce the free-standing electrodes, a binder-free direct growth method was employed for electrode fabrication. A NiCo2O4@Ni-MOF (metal–organic framework) composite was synthesized using a one-pot hydrothermal method. Initially, a NiCo2O4 nanowire array was cultivated on Ni foam, serving as a connecting bridge to ensure robust adherence of the Ni-MOF to the substrate. The structures of NiCo2O4 nanowire arrays exhibit the capacity for numerous redox reactions. Hybridizing MOF with transition metal oxide (TMO) nanoarchitectures can significantly alleviate the small specific surface area and aggregation tendency of TMOs. The highest energy storage capacity was obtained when the ratio of nickel to terephthalic acid (TPA) was 4:1. NiCo2O4@Ni-MOF (Ni:[Formula: see text]:1) exhibited a high storage capacitance of 1700[Formula: see text]F/g. The integration of MOF with TMO nanoarchitectonics as materials for supercapacitor electrodes can enhance porous structure and facilitate diffusion during both charging and discharging processes.
JIT-Smart: A Multi-task Learning Framework for Just-in-Time Defect Prediction and Localization
Authors: Chen Xiangping , Xu Furen , Huang Yuan , Zhang Neng , Zheng Zibin
Published: July 2024

Just-in-time defect prediction (JIT-DP) is used to predict the defect-proneness of a commit and just-in-time defect localization (JIT-DL) is used to locate the exact buggy positions (defective lines) in a commit. Recently, various JIT-DP and JIT-DL techniques have been proposed, while most of them use a post-mortem way (e.g., code entropy, attention weight, LIME) to achieve the JIT-DL goal based on the prediction results in JIT-DP. These methods do not utilize the label information of the defective code lines during model building. In this paper, we propose a unified model JIT-Smart, which makes the training process of just-in-time defect prediction and localization tasks a mutually reinforcing multi-task learning process. Specifically, we design a novel defect localization network (DLN), which explicitly introduces the label information of defective code lines for supervised learning in JIT-DL with considering the class imbalance issue. To further investigate the accuracy and cost-effectiveness of JIT-Smart, we compare JIT-Smart with 7 state-of-the-art baselines under 5 commit-level and 5 line-level evaluation metrics in JIT-DP and JIT-DL. The results demonstrate that JIT-Smart is statistically better than all the state-of-the-art baselines in JIT-DP and JIT-DL. In JIT-DP, at the median value, JIT-Smart achieves F1-Score of 0.475, AUC of 0.886, Recall@20%Effort of 0.823, Effort@20%Recall of 0.01 and Popt of 0.942 and improves the baselines by 19.89%-702.74%, 1.23%-31.34%, 9.44%-33.16%, 21.6%-53.82% and 1.94%-34.89%, respectively . In JIT-DL, at the median value, JIT-Smart achieves Top-5 Accuracy of 0.539 and Top-10 Accuracy of 0.396, Recall@20%Effort

line

of 0.726, Effort@20%Recall

line

of 0.087 and IFA

line

of 0.098 and improves the baselines by 101.83%-178.35%, 101.01%-277.31%, 257.88%-404.63%, 71.91%-74.31% and 99.11%-99.41%, respectively. Statistical analysis shows that our JIT-Smart performs more stably than the best-performing model. Besides, JIT-Smart also achieves the best performance compared with the state-of-the-art baselines in cross-project evaluation.
Bin2Summary: Beyond Function Name Prediction in Stripped Binaries with Functionality-Specific Code Embeddings
Authors: Song Zirui , Chen Jiongyi , Zhang Kehuan
Published: July 2024

Nowadays, closed-source software only with stripped binaries still dominates the ecosystem, which brings obstacles to understanding the functionalities of the software and further conducting the security analysis. With such an urgent need, research has traditionally focused on predicting function names, which can only provide fragmented and abbreviated information about functionality. To advance the state-of-the-art, this paper presents Bin2Summary to automatically summarize the functionality of the function in stripped binaries with natural language sentences. Specifically, the proposed framework includes a functionality-specific code embedding module to facilitate fine-grained similarity detection and an attention-based seq2seq model to generate summaries in natural language. Based on 16 widely-used projects (e.g., Coreutils), we have evaluated Bin2Summary with 38,167 functions, which are filtered from 162,406 functions, and all of them have a high-quality comment. Bin2Summary achieves 0.728 in precision and 0.729 in recall on our datasets, and the functionality-specific embedding module can improve the existing assembly language model by up to 109.5% and 109.9% in precision and recall. Meanwhile, the experiments demonstrated that Bin2Summary has outstanding transferability in analyzing the cross-architecture (i.e., in x64 and x86) and cross-environment (i.e., in Cygwin and MSYS2) binaries. Finally, the case study illustrates how Bin2Summary outperforms the existing works in providing functionality summaries with abundant semantics beyond function names.
LILAC: Log Parsing using LLMs with Adaptive Parsing Cache
Authors: Jiang Zhihan , Liu Jinyang , Chen Zhuangbin , Li Yichen , Huang Junjie , Huo Yintong , He Pinjia , Gu Jiazhen , Lyu Michael R.
Published: July 2024

Log parsing transforms log messages into structured formats, serving as the prerequisite step for various log analysis tasks. Although a variety of log parsing approaches have been proposed, their performance on complicated log data remains compromised due to the use of human-crafted rules or learning-based models with limited training data. The recent emergence of powerful large language models (LLMs) demonstrates their vast pre-trained knowledge related to code and logging, making it promising to apply LLMs for log parsing. However, their lack of specialized log parsing capabilities currently hinders their parsing accuracy. Moreover, the inherent inconsistent answers, as well as the substantial overhead, prevent the practical adoption of LLM-based log parsing.

To address these challenges, we propose LILAC, the first practical Log parsIng framework using LLMs with Adaptive parsing Cache. To facilitate accurate and robust log parsing, LILAC leverages the in-context learning (ICL) capability of the LLM by performing a hierarchical candidate sampling algorithm and selecting high-quality demonstrations. Furthermore, LILAC incorporates a novel component, an adaptive parsing cache, to store and refine the templates generated by the LLM. It helps mitigate LLM's inefficiency issue by enabling rapid retrieval of previously processed log templates. In this process, LILAC adaptively updates the templates within the parsing cache to ensure the consistency of parsed results. The extensive evaluation on public large-scale datasets shows that LILAC outperforms state-of-the-art methods by 69.5% in terms of the average F1 score of template accuracy. In addition, LILAC reduces the query times to LLMs by several orders of magnitude, achieving a comparable efficiency to the fastest baseline.
ProveNFix: Temporal Property-Guided Program Repair
Authors: Song Yahui , Gao Xiang , Li Wenhua , Chin Wei-Ngan , Roychoudhury Abhik
Published: July 2024

Model checking has been used traditionally for finding violations of temporal properties. Recently, testing or fuzzing approaches have also been applied to software systems to find temporal property violations. However, model checking suffers from state explosion, while fuzzing can only partially cover program paths. Moreover, once a violation is found, the fix for the temporal error is usually manual. In this work, we develop the first compositional static analyzer for temporal properties, and the analyzer supports a proof-based repair strategy to fix temporal bugs automatically. To enable a more flexible specification style for temporal properties, on top of the classic pre/post-conditions, we allow users to write a future-condition to modularly express the expected behaviors after the function call. Instead of requiring users to write specifications for each procedure, our approach automatically infers the procedure’s specification according to user-supplied specifications for a small number of primitive APIs. We further devise a term rewriting system to check the actual behaviors against its inferred specification. Our method supports the analysis of 1) memory usage bugs, 2) unchecked return values, 3) resource leaks, etc., with annotated specifications for 17 primitive APIs, and detects 515 vulnerabilities from over 1 million lines of code ranging from ten real-world C projects. Intuitively, the benefit of our approach is that a small set of properties can be specified once and used to analyze/repair a large number of programs. Experimental results show that our tool, ProveNFix, detects 72.2% more true alarms than the latest release of the Infer static analyzer. Moreover, we show the effectiveness of our repair strategy when compared to other state-of-the-art systems — fixing 5% more memory leaks than SAVER, 40% more resource leaks than FootPatch, and with a 90% fix rate for null pointer dereferences.
SmartAxe: Detecting Cross-Chain Vulnerabilities in Bridge Smart Contracts via Fine-Grained Static Analysis
Authors: Liao Zeqin , Nan Yuhong , Liang Henglong , Hao Sicheng , Zhai Juan , Wu Jiajing , Zheng Zibin
Published: July 2024

With the increasing popularity of blockchain, different blockchain platforms coexist in the ecosystem (e.g., Ethereum, BNB, EOSIO, etc.), which prompts the high demand for cross-chain communication. Cross-chain bridge is a specific type of decentralized application for asset exchange across different blockchain platforms. Securing the smart contracts of cross-chain bridges is in urgent need, as there are a number of recent security incidents with heavy financial losses caused by vulnerabilities in bridge smart contracts, as we call them Cross-Chain Vulnerabilities (CCVs). However, automatically identifying CCVs in smart contracts poses several unique challenges. Particularly, it is non-trivial to (1) identify application-specific access control constraints needed for cross-bridge asset exchange, and (2) identify inconsistent cross-chain semantics between the two sides of the bridge.

In this paper, we propose SmartAxe, a new framework to identify vulnerabilities in cross-chain bridge smart contracts. Particularly, to locate vulnerable functions that have access control incompleteness, SmartAxe models the heterogeneous implementations of access control and finds necessary security checks in smart contracts through probabilistic pattern inference. Besides, SmartAxe constructs cross-chain control-flow graph (xCFG) and data-flow graph (xDFG), which help to find semantic inconsistency during cross-chain data communication. To evaluate SmartAxe, we collect and label a dataset of 88 CCVs from real-attacks cross-chain bridge contracts. Evaluation results show that SmartAxe achieves a precision of 84.95% and a recall of 89.77%. In addition, SmartAxe successfully identifies 232 new/unknown CCVs from 129 real-world cross-chain bridge applications (i.e., from 1,703 smart contracts). These identified CCVs affect a total amount of digital assets worth 1,885,250 USD
Predictive Program Slicing via Execution Knowledge-Guided Dynamic Dependence Learning
Authors: Yadavally Aashish , Li Yi , Nguyen Tien N.
Published: July 2024

Program slicing, the process of extracting program statements that influence values at a designated location (known as the slicing criterion), is helpful in both manual and automated debugging. However, such slicing techniques prove ineffective in scenarios where executing specific inputs is prohibitively expensive, or even impossible, as with partial code. In this paper, we introduce ND-Slicer, a predictive slicing methodology that caters to specific executions based on a particular input, overcoming the need for actual execution. We enable such a process by leveraging execution-aware pre-training to learn the dynamic program dependencies, including both dynamic data and control dependencies between variables in the slicing criterion and the remaining program statements. Such knowledge forms the cornerstone for constructing a predictive backward slice. Our empirical evaluation revealed a high accuracy in predicting program slices, achieving an exact-match accuracy of 81.3% and a ROUGE-LCS F1-score of 95.4% on Python programs. As an extrinsic evaluation, we illustrate ND-Slicer’s usefulness in crash detection, with it locating faults with an accuracy of 63.9%. Furthermore, we include an in-depth qualitative evaluation, assessing ND-Slicer’s understanding of branched structures such as if-else blocks and loops, as well as the control flow in inter-procedural calls.
PBE-Based Selective Abstraction and Refinement for Efficient Property Falsification of Embedded Software
Authors: Kim Yoel , Choi Yunja
Published: July 2024

Comprehensive verification/falsification of embedded software is challenging and often impossible mainly due to the typical characteristics of embedded software, such as the use of global variables, reactive behaviors, and its (soft or hard) real-time requirements, to name but a few. Abstraction is one of the major solutions to this problem, but existing proven abstraction techniques are not effective in this domain as they are uniformly applied to the entire program and often require a large number of refinements to find true alarms. This work proposes a domain-specific solution for efficient property falsification based on the observation that embedded software typically consists of a number of user-defined auxiliary functions, many of which may be loosely coupled with the main control logic. Our approach selectively abstracts auxiliary functions using function summaries synthesized by Programming-By-Example (PBE), which reduces falsification complexity as well as the number of refinements. The drawbacks of using PBE-based function summaries, which are neither sound nor complete, for abstraction are counteracted by symbolic alarm filtering and novel PBE-based refinements for function summaries. We demonstrate that the proposed approach has comparable performance to the state-of-the-art model checkers on SV-COMP benchmark programs and outperforms them on a set of typical embedded software in terms of both falsification efficiency and scalability.
Evaluating Directed Fuzzers: Are We Heading in the Right Direction?
Authors: Kim Tae Eun , Choi Jaeseung , Im Seongjae , Heo Kihong , Cha Sang Kil
Published: July 2024

Directed fuzzing recently has gained significant attention due to its ability to reconstruct proof-of-concept (PoC) test cases for target code such as buggy lines or functions. Surprisingly, however, there has been no in-depth study on the way to properly evaluate directed fuzzers despite much progress in the field. In this paper, we present the first systematic study on the evaluation of directed fuzzers. In particular, we analyze common pitfalls in evaluating directed fuzzers with extensive experiments on five state-of-the-art tools, which amount to 30 CPU-years of computational effort, in order to confirm that different choices made at each step of the evaluation process can significantly impact the results. For example, we find that a small change in the crash triage logic can substantially affect the measured performance of a directed fuzzer, while the majority of the papers we studied do not fully disclose their crash triage scripts. We argue that disclosing the whole evaluation process is essential for reproducing research and facilitating future work in the field of directed fuzzing. In addition, our study reveals that several common evaluation practices in the current directed fuzzing literature can mislead the overall assessments. Thus, we identify such mistakes in previous papers and propose guidelines for evaluating directed fuzzers.
DiffCoder: Enhancing Large Language Model on API Invocation via Analogical Code Exercises
Authors: Zan Daoguang , Yu Ailun , Shen Bo , Chen Bei , Li Wei , Gong Yongshun , Chen Xiaolin , Yao Yafen , Luo Weihua , Guan Bei , Liu Yan , Wang Yongji , Wang Qianxiang , Cui Lizhen
Published: July 2024

The task of code generation aims to generate code solutions based on given programming problems. Recently, code large language models (code LLMs) have shed new light on this task, owing to their formidable code generation capabilities. While these models are powerful, they seldom focus on further improving the accuracy of library-oriented API invocation. Nonetheless, programmers frequently invoke APIs in routine coding tasks. In this paper, we aim to enhance the proficiency of existing code LLMs regarding API invocation by mimicking analogical learning, which is a critical learning strategy for humans to learn through differences among multiple instances. Motivated by this, we propose a simple yet effective approach, namely DiffCoder, which excels in API invocation by effectively training on the differences (diffs) between analogical code exercises. To assess the API invocation capabilities of code LLMs, we conduct experiments on seven existing benchmarks that focus on mono-library API invocation. Additionally, we construct a new benchmark, namely PanNumEval, to evaluate the performance of multi-library API invocation. Extensive experiments on eight benchmarks demonstrate the impressive performance of DiffCoder. Furthermore, we develop a VSCode plugin for DiffCoder, and the results from twelve invited participants further verify the practicality of DiffCoder.
CodeArt: Better Code Models by Attention Regularization When Symbols Are Lacking
Authors: Su Zian , Xu Xiangzhe , Huang Ziyang , Zhang Zhuo , Ye Yapeng , Huang Jianjun , Zhang Xiangyu
Published: July 2024

Transformer based code models have impressive performance in many software engineering tasks. However, their effectiveness degrades when symbols are missing or not informative. The reason is that the model may not learn to pay attention to the right correlations/contexts without the help of symbols. We propose a new method to pre-train general code models when symbols are lacking. We observe that in such cases, programs degenerate to something written in a very primitive language. We hence propose to use program analysis to extract contexts a priori (instead of relying on symbols and masked language modeling as in vanilla models). We then leverage a novel attention masking method to only allow the model attending to these contexts, e.g., bi-directional program dependence transitive closures and token co-occurrences. In the meantime, the inherent self-attention mechanism is utilized to learn which of the allowed attentions are more important compared to others. To realize the idea, we enhance the vanilla tokenization and model architecture of a BERT model,

construct and utilize attention masks, and introduce a new pre-training algorithm. We pre-train this BERT-like model from scratch, using a dataset of 26 million stripped binary functions with explicit program dependence information extracted by our tool. We apply the model in three downstream tasks: binary similarity, type inference, and malware family classification. Our pre-trained model can improve the SOTAs in these tasks from 53% to 64%, 49% to 60%, and 74% to 94%, respectively. It also substantially outperforms other general pre-training techniques of code understanding models.
CORE: Resolving Code Quality Issues using LLMs
Authors: Wadhwa Nalin , Pradhan Jui , Sonwane Atharv , Sahu Surya Prakash , Natarajan Nagarajan , Kanade Aditya , Parthasarathy Suresh , Rajamani Sriram
Published: July 2024

As software projects progress, quality of code assumes paramount importance as it affects reliability, maintainability and security of software. For this reason, static analysis tools are used in developer workflows to flag code quality issues. However, developers need to spend extra efforts to revise their code to improve code quality based on the tool findings. In this work, we investigate the use of (instruction-following) large language models (LLMs) to assist developers in revising code to resolve code quality issues. We present a tool, CORE (short for COde REvisions), architected using a pair of LLMs organized as a duo comprised of a proposer and a ranker. Providers of static analysis tools recommend ways to mitigate the tool warnings and developers follow them to revise their code. The proposer LLM of CORE takes the same set of recommendations and applies them to generate candidate code revisions. The candidates which pass the static quality checks are retained. However, the LLM may introduce subtle, unintended functionality changes which may go un-detected by the static analysis. The ranker LLM evaluates the changes made by the proposer using a rubric that closely follows the acceptance criteria that a developer would enforce. CORE uses the scores assigned by the ranker LLM to rank the candidate revisions before presenting them to the developer. We conduct a variety of experiments on two public benchmarks to show the ability of CORE: (1) to generate code revisions acceptable to both static analysis tools and human reviewers (the latter evaluated with user study on a subset of the Python benchmark), (2) to reduce human review efforts by detecting and eliminating revisions with unintended changes, (3) to readily work across multiple languages (Python and Java), static analysis tools (CodeQL and SonarQube) and quality checks (52 and 10 checks, respectively), and (4) to achieve fix rate comparable to a rule-based automated program repair tool but with much smaller engineering efforts (on the Java benchmark). CORE could revise 59.2% Python files (across 52 quality checks) so that they pass scrutiny by both a tool and a human reviewer. The ranker LLM reduced false positives by 25.8% in these cases. CORE produced revisions that passed the static analysis tool in 76.8% Java files (across 10 quality checks) comparable to 78.3% of a specialized program repair tool, with significantly much less engineering efforts. We release code, data, and supplementary material publicly at http://aka.ms/COREMSRI.
AROMA: Automatic Reproduction of Maven Artifacts
Authors: Keshani Mehdi , Velican Tudor-Gabriel , Bot Gideon , Proksch Sebastian
Published: July 2024

Modern software engineering establishes software supply chains and relies on tools and libraries to improve productivity. However, reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. The SolarWinds attack serves as a popular example in which the injection of malicious code into a library affected thousands of customers and caused a loss of billions of dollars. Reproducible builds present a mitigation strategy, as they can confirm the origin and consistency of reused components. A large reproducibility community has formed for Debian, but the reproducibility of the Maven ecosystem, the backbone of the Java supply chain, remains understudied in comparison. Reproducible Central is an initiative that curates a list of reproducible Maven libraries, but the list is limited and challenging to maintain due to manual efforts. Our research aims to support these efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of Maven packages. Overall, our approach achieves an accuracy of up to 99.5% when compared field-by-field to the existing manual approach. In some instances, we even detected flaws in the manually maintained list, such as broken repository links. We reveal that automatic reproducibility is feasible for 23.4% of the Maven packages using AROMA, and 8% of these packages are fully reproducible. We demonstrate our ability to successfully reproduce new packages and have contributed some of them to the Reproducible Central repository. Additionally, we highlight actionable insights, outline future work in this area, and make our dataset and tools available to the public.
Effective Teaching through Code Reviews: Patterns and Anti-patterns
Authors: Sarma Anita , Chen Nina
Published: July 2024

Code reviews are an ubiquitous and essential part of the software development process. They also offer a unique, at-scale opportunity for teaching developers in the context of their day-to-day development activities versus something more removed and formal, like a class. Yet there is little research on effective teaching through code reviews: focusing on learning for the author and not just changes to the code. We address this gap through a case study at Google: interviews with 14 developers revealed 12 patterns and 15 anti-patterns in code reviews that impact learning. For instance, explanatory rationale, sample solutions backed by standards, and a constructive tone facilitates learning, whereas harsh comments, excessive shallow critiques, and non-pragmatic reviewing that ignores authors' constraints hinders learning. We validated our qualitative findings through member checking, interviews with reviewers, a literature review, and a survey of 324 developers. This comprehensive study provides an empirical evidence of how social dynamics in code reviews impact learning. Based on our findings, we provide practical recommendations on how to frame constructive reviews to create a supportive learning environment.
Static Application Security Testing (SAST) Tools for Smart Contracts: How Far Are We?
Authors: Li Kaixuan , Xue Yue , Chen Sen , Liu Han , Sun Kairan , Hu Ming , Wang Haijun , Liu Yang , Chen Yixiang
Published: July 2024

In recent years, the importance of smart contract security has been heightened by the increasing number of attacks against them. To address this issue, a multitude of static application security testing (SAST) tools have been proposed for detecting vulnerabilities in smart contracts. However, objectively comparing these tools to determine their effectiveness remains challenging. Existing studies often fall short due to the taxonomies and benchmarks only covering a coarse and potentially outdated set of vulnerability types, which leads to evaluations that are not entirely comprehensive and may display bias.

In this paper, we fill this gap by proposing an up-to-date and fine-grained taxonomy that includes 45 unique vulnerability types for smart contracts. Taking it as a baseline, we develop an extensive benchmark that covers 40 distinct types and includes a diverse range of code characteristics, vulnerability patterns, and application scenarios. Based on them, we evaluated 8 SAST tools using this benchmark, which comprises 788 smart contract files and 10,394 vulnerabilities.

Our results reveal that the existing SAST tools fail to detect around 50% of vulnerabilities in our benchmark and suffer from high false positives, with precision not surpassing 10%. We also discover that by combining the results of multiple tools, the false negative rate can be reduced effectively, at the expense of flagging 36.77 percentage points more functions. Nevertheless, many vulnerabilities, especially those beyond Access Control and Reentrancy vulnerabilities, remain undetected. We finally highlight the valuable insights from our study, hoping to provide guidance on tool development, enhancement, evaluation, and selection for developers, researchers, and practitioners.
Semi-supervised Crowdsourced Test Report Clustering via Screenshot-Text Binding Rules
Authors: Yu Shengcheng , Fang Chunrong , Zhang Quanjun , Du Mingzhe , Liu Jia , Chen Zhenyu
Published: July 2024

Due to the openness of the crowdsourced testing paradigm, crowdworkers submit massive spotty duplicate test reports, which hinders developers from effectively reviewing the reports and detecting bugs. Test report clustering is widely used to alleviate this problem and improve the effectiveness of crowdsourced testing. Existing clustering methods basically rely on the analysis of textual descriptions. A few methods are independently supplemented by analyzing screenshots in test reports as pixel sets, leaving out the semantics of app screenshots from the widget perspective. Further, ignoring the semantic relationships between screenshots and textual descriptions may lead to the imprecise analysis of test reports, which in turn negatively affects the clustering effectiveness.

This paper proposes a semi-supervised crowdsourced test report clustering approach, namely SemCluster. SemCluster respectively extracts features from app screenshots and textual descriptions and forms the structure feature, the content feature, the bug feature, and reproduction steps. The clustering is principally conducted on the basis of the four features. Further, in order to avoid bias of specific individual features, SemCluster exploits the semantic relationships between app screenshots and textual descriptions to form the semantic binding rules as guidance for clustering crowdsourced test reports. Experiment results show that SemCluster outperforms state-of-the-art approaches on six widely used metrics by 10.49% -- 200.67%, illustrating the excellent effectiveness.
Evaluating and Improving ChatGPT for Unit Test Generation
Authors: Yuan Zhiqiang , Liu Mingwei , Ding Shiji , Wang Kaixin , Chen Yixuan , Peng Xin , Lou Yiling
Published: July 2024

Unit testing plays an essential role in detecting bugs in functionally-discrete program units (e.g., methods). Manually writing high-quality unit tests is time-consuming and laborious. Although the traditional techniques are able to generate tests with reasonable coverage, they are shown to exhibit low readability and still cannot be directly adopted by developers in practice. Recent work has shown the large potential of large language models (LLMs) in unit test generation. By being pre-trained on a massive developer-written code corpus, the models are capable of generating more human-like and meaningful test code.

In this work, we perform the first empirical study to evaluate the capability of ChatGPT (i.e., one of the most representative LLMs with outstanding performance in code generation and comprehension) in unit test generation. In particular, we conduct both a quantitative analysis and a user study to systematically investigate the quality of its generated tests in terms of correctness, sufficiency, readability, and usability. We find that the tests generated by ChatGPT still suffer from correctness issues, including diverse compilation errors and execution failures (mostly caused by incorrect assertions); but the passing tests generated by ChatGPT almost resemble manually-written tests by achieving comparable coverage, readability, and even sometimes developers' preference. Our findings indicate that generating unit tests with ChatGPT could be very promising if the correctness of its generated tests could be further improved.

Inspired by our findings above, we further propose ChatTester, a novel ChatGPT-based unit test generation approach, which leverages ChatGPT itself to improve the quality of its generated tests. ChatTester incorporates an initial test generator and an iterative test refiner. Our evaluation demonstrates the effectiveness of ChatTester by generating 34.3% more compilable tests and 18.7% more tests with correct assertions than the default ChatGPT. In addition to ChatGPT, we further investigate the generalization capabilities of ChatTester by applying it to two recent open-source LLMs (i.e., CodeLLama-Instruct and CodeFuse) and our results show that ChatTester can also improve the quality of tests generated by these LLMs.
Demystifying Invariant Effectiveness for Securing Smart Contracts
Authors: Chen Zhiyang , Liu Ye , Beillahi Sidi Mohamed , Li Yi , Long Fan
Published: July 2024

Smart contract transactions associated with security attacks often exhibit distinct behavioral patterns compared with historical benign transactions before the attacking events. While many runtime monitoring and guarding mechanisms have been proposed to validate invariants and stop anomalous transactions on the fly, the empirical effectiveness of the invariants used remains largely unexplored. In this paper, we studied 23 prevalent invariants of 8 categories, which are either deployed in high-profile protocols or endorsed by leading auditing firms and security experts. Using these well-established invariants as templates, we developed a tool Trace2Inv which dynamically generates new invariants customized for a given contract based on its historical transaction data. We evaluated Trace2Inv on 42 smart contracts that fell victim to 27 distinct exploits on the Ethereum blockchain. Our findings reveal that the most effective invariant guard alone can successfully block 18 of the 27 identified exploits with minimal gas overhead. Our analysis also shows that most of the invariants remain effective even when the experienced attackers attempt to bypass them. Additionally, we studied the possibility of combining multiple invariant guards, resulting in blocking up to 23 of the 27 benchmark exploits and achieving false positive rates as low as 0.28%. Trace2Inv significantly outperforms state-of-the-art works on smart contract invariant mining and transaction attack detection in accuracy. Trace2Inv also surprisingly found two previously unreported exploit transactions.
Beyond Code Generation: An Observational Study of ChatGPT Usage in Software Engineering Practice
Authors: Khojah Ranim , Mohamad Mazen , Leitner Philipp , de Oliveira Neto Francisco Gomes
Published: July 2024

Large Language Models (LLMs) are frequently discussed in academia and the general public as support tools for virtually any use case that relies on the production of text, including software engineering. Currently, there is much debate, but little empirical evidence, regarding the practical usefulness of LLM-based tools such as ChatGPT for engineers in industry. We conduct an observational study of 24 professional software engineers who have been using ChatGPT over a period of one week in their jobs, and qualitatively analyse their dialogues with the chatbot as well as their overall experience (as captured by an exit survey). We find that rather than expecting ChatGPT to generate ready-to-use software artifacts (e.g., code), practitioners more often use ChatGPT to receive guidance on how to solve their tasks or learn about a topic in more abstract terms. We also propose a theoretical framework for how the (i) purpose of the interaction, (ii) internal factors (e.g., the user's personality), and (iii) external factors (e.g., company policy) together shape the experience (in terms of perceived usefulness and trust). We envision that our framework can be used by future research to further the academic discussion on LLM usage by software engineering practitioners, and to serve as a reference point for the design of future empirical LLM research in this domain.