Identifying similar code with program dependence graphs

Krinke, Jens

doi:10.1109/wcre.2001.957835

Cited by 419 publications

(313 citation statements)

References 11 publications

Supporting

Mentioning

308

Contrasting

Unclassified

Order By: Relevance

“…However, like trees, graph similarity suffers from a high computational complexity. Algorithms for graph comparison are mostly NP-complete (Liu et al 2006;Crussell et al 2012;Krinke 2001;Chae et al 2013). In clone and plagiarism detection, a few specific types of graphs are used, e.g.…”

Section: Code Similarity Measurementmentioning

confidence: 99%

“…program dependence graphs (PDG), or control flow graphs (CFG). Examples of code similarity analysers using graph-based approaches are the ones invented by Krinke (2001), Komondoor and Horwitz (2001), Chae et al (2013) and Chen et al (2014). Although the tools demonstrate high precision and recall (Krinke 2001), they suffer scalability issues (Bellon et al 2007).…”

Section: Code Similarity Measurementmentioning

confidence: 99%

See 1 more Smart Citation

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

Copying and pasting of source code is a common activity in software engineering. Often, the code is not copied as it is and it may be modified for various purposes; e.g. refactoring, bug fixing, or even software plagiarism. These code modifications could affect the performance of code similarity analysers including code clone and plagiarism detectors to some certain degree. We are interested in two types of code modification in this study: pervasive modifications, i.e. transformations that may have a global effect, and local modifications, i.e. code changes that are contained in a single method or code block. We evaluate 30 code similarity detection techniques and tools using five experimental scenarios for Java source code. These are (1) pervasively modified code, created with tools for source code and bytecode obfuscation, and boiler-plate code, (2) source code normalisation through compilation and decompilation using different decompilers, (3) reuse of optimal configurations over different data sets, (4) tool evaluation using ranked-based measures, and (5) local + global code modifications. Our experimental results show that in the presence of pervasive modifications, some of the general textual similarity measures can offer similar performance to specialised code similarity tools, whilst in the presence of boiler-plate code, highly specialised source code similarity detection techniques and tools outperform textual similarity measures. Our study strongly validates the use of compilation/decompilation as a normalisation technique. Its use reduced false classifications to zero for three of the tools. Moreover, we demonstrate that optimal configurations are very sensitive to a specific data set. After directly applying optimal configurations derived from one data set to another, the tools perform poorly on the new data set. The code similarity analysers are thoroughly evaluated not only based on several well-known pair-based and query-based error measures but also on each specific type of pervasive code modification. This broad, thorough study is the largest in existence and potentially an invaluable guide for future users of similarity detection in source code.

show abstract

Section: Code Similarity Measurementmentioning

confidence: 99%

Section: Code Similarity Measurementmentioning

confidence: 99%

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

show abstract

“…Marcus & Maletic (2001) used information retrieval techniques on source code to detect semantic similarities. Krinke (2001) proposed to use program dependence graphs (PDG) for abstracting source code. Higo et al (2011) extended this to an incremental approach.…”

Section: Related Workmentioning

confidence: 99%

How are functionally similar code clones syntactically different? An empirical study and a benchmark

Wagner

Abdulkhaleq

Bogicevic

et al. 2016

PeerJ Computer Science

View full text Add to dashboard Cite

Background. Today, redundancy in source code, so-called ''clones'' caused by copy &paste can be found reliably using clone detection tools. Redundancy can arise also independently, however, not caused by copy&paste. At present, it is not clear how only functionally similar clones (FSC) differ from clones created by copy&paste. Our aim is to understand and categorise the syntactical differences in FSCs that distinguish them from copy&paste clones in a way that helps clone detection research. Methods. We conducted an experiment using known functionally similar programs in Java and C from coding contests. We analysed syntactic similarity with traditional detection tools and explored whether concolic clone detection can go beyond syntax. We ran all tools on 2,800 programs and manually categorised the differences in a random sample of 70 program pairs. Results. We found no FSCs where complete files were syntactically similar. We could detect a syntactic similarity in a part of the files in <16% of the program pairs. Concolic detection found 1 of the FSCs. The differences between program pairs were in the categories algorithm, data structure, OO design, I/O and libraries. We selected 58 pairs for an openly accessible benchmark representing these categories. Discussion. The majority of differences between functionally similar clones are beyond the capabilities of current clone detection approaches. Yet, our benchmark can help to drive further clone detection research.

show abstract

“…For their information-flow control, they use a program dependence graph, a representation already known in the area of static program analysis [15,3,11]. In a succeeding work, Hammer evaluates his approach with some real-world examples and lists results of his performance measurements [12].…”

Section: Related Workmentioning

confidence: 99%

An Approach to Detecting Inter-Session Data Flow Induced by Object Pooling

Berger

Sohr

2012

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Abstract. Security tools, using static code analysis, are employed to find common bug classes, such as SQL injections and cross-site scripting vulnerabilities. This paper focuses on another bug class that is related to the object-pool pattern, which allows objects to be reused over multiple sessions. We show that the pattern is applied in a wide range of Java Enterprise frameworks and describe the problem of inter-session data flows, which comes along with the pattern. To demonstrate that the problem is relevant, we analyzed different open-source and a proprietary commercial software, with the help of a detection approach we introduce. We were able to show that the problem class occurred in these applications and posed a threat to the confidentiality of the closed-source software.

show abstract

Identifying similar code with program dependence graphs

Cited by 419 publications

References 11 publications

A comparison of code similarity analysers

A comparison of code similarity analysers

How are functionally similar code clones syntactically different? An empirical study and a benchmark

An Approach to Detecting Inter-Session Data Flow Induced by Object Pooling

Contact Info

Product

Resources

About