## 5 Case Study: Applying CVMan to Analyze Clones in Ubuntu
### Experiment with the Ubuntu System  
Our experiments were conducted on a server equipped with two Intel Xeon E5-2630V3 CPUs (16 cores in total) running at 2.40 GHz, 16 GB memory, and with 4 TB hard drives. The server ran the CVMan prototype system.  
The Programs That Are Analyzed in the Experiments: Ubuntu Repository  
Ubuntu is a Linux distribution based on Debian and composed mostly of free and open-source software. Ubuntu is stored in four repositories: _main, restricted, universe,_ and _multiverse._ The main repository contains free and open-source software (with the source code) supported by the Ubuntu team. The restricted repository contains proprietary drivers for various devices. The universe repository contains free and open-source software maintained by the community with source code). It is worth mentioning that the Ubuntu team does not guarantee to provide prompt security updates for Ubuntu in the universe repository but will provide them when security updates are made available by the community.  
The multiverse repository contains software that is not free. We studied the default software in the main and universe repositories of Ubuntu release for the desktop AMD64 architecture because it is perhaps the most widely used. Specifically, we selected the \(n=8\) Ubuntu releases between 2018 and 2021. We downloaded the Ubuntu source images and manifest files from the Ubuntu release website at [[http://old-releases.ubuntu.com/releases](http://old-releases.ubuntu.com/releases)]([http://old-releases.ubuntu.com/releases](http://old-releases.ubuntu.com/releases)) (accessed on 1 May 2022). The source images contain the source code, and the manifest file is the default package name and version included in an Ubuntu release.  
According to the package information in the manifest file, we used a crawler to obtain the program names corresponding to the packages and to extract the source code of programs from the source images. We used command dpkg-source -x package to extract the source code of programs. Then, we cleaned the source code of the programs: (i) discarding the programs that did not include any files with the suffixes.c, C,.cpp,.cpp,.h,.hpp, or.c++; (ii) discarding the files that did not have the suffixes.c, C,.cpp,.cpp,.h,.hpp, and.c++; and (iii) removing whitespaces and comments. Table 1 presents the basic information about the \(n=8\) versions of Ubuntu, including the number of C/C++ programs and the number of lines of C/C++ code in each version. In total, the dataset consists of 5760 programs, including more than 800 million LoCs.  
We detected clone relations in eight Ubuntu versions. If we take Ubuntu 18.04 as an example, there are 704 C/C++ programs, and the SCG has 337,837 nodes (i.e., fragments) and 4,761,650 edges. Since the experiment deals with Ubuntu, the experiment automatically collected vulnerabilities from: (i) the Ubuntu Security Notices (USN) [50], which tracks vulnerabilities in all Ubuntu releases; (ii) the Ubuntu CVE Tracker [51], which lists the notices when a security issue is fixed in an official Ubuntu program. and (iii) the National Vulnerability Database (NVD), which contains vulnerability reports.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Version** & **\# C/C++ Programs** & **\# Lines of C/C++ Code** \\ \hline
18.04 & 704 & 100,985,002 \\
18.10 & 708 & 98,274,202 \\
19.04 & 714 & 103,083,366 \\
19.10 & 714 & 101,017,066 \\
20.04 & 721 & 109,634,409 \\
20.10 & 727 & 109,208,168 \\
21.04 & 735 & 113,759,907 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Basic information about the \(n=8\) Ubuntu versions.