基于程序结构与语义特征融合的软件缺陷预测

doi:10.3778/j.issn.1002-8331.2110-0289

摘要/Abstract

摘要： 随着软件系统的规模越来越庞大，如何快速高效地预测软件中的程序缺陷成为一个研究热点。最近的研究引入了深度学习模型，使用神经网络提取代码特征构建分类器进行缺陷预测。针对现有的神经网络只在单层面、单粒度上提取代码特征，导致特征不够丰富，造成预测精度不高的问题，提出了一种基于特征融合的软件缺陷预测框架。通过将程序解析为抽象语法树（abstract syntax tree，AST）以及Token序列两种不同的程序表示方式，利用树卷积神经网络以及文本卷积神经网络分别提取代码的结构和语义特征进行特征融合，从而提取到更丰富的代码特征用于缺陷预测。同时改进了AST和Token序列提取方法，降低模型复杂度。选择使用公共存储库PROMISE中的公开数据集作为实验数据集，采用softmax分类器预测得到最终的预测结果。实验结果表明，该框架在实验数据集上可以获得比已有方法更高的F1-score。

关键词: 软件缺陷预测, 特征融合, 树卷积神经网络（TBCNN）, 文本卷积神经网络（TextCNN）

Abstract: With the increasing scale of software system, how to predict the defects quickly and efficiently has become a research hotspot. Recent researches introduce deep learning models that use neural networks to extract code features to build classifiers for defect prediction. Aiming at the problem that the existing neural networks usually extract code features in single ingredient and single granularity, which results features insufficient and prediction imprecise, a software defect prediction framework based on feature fusion is proposed. By parsing the program into two different program representations：AST（abstract syntax tree） and Token sequence, tree-based convolutional neural network and text convolution neural network are used to extract the structural and semantic features of code respectively for feature fusion, so as to extract richer code features for defect prediction. The extraction methods of AST and Token sequences are improved to reduce the complexity of the model. The public dataset in PROMISE is selected as experimental dataset, and softmax is used as a classifier to predict the results. The experimental results show that the framework obtains higher F1-score than the existing methods on the experimental dataset.

Key words: software defect prediction, features fusion, tree-based convolutional neural network（TBCNN）, text convolutional neural networks（TextCNN）

董玉坤, 李浩杰, 位欣欣, 唐道龙. 基于程序结构与语义特征融合的软件缺陷预测[J]. 计算机工程与应用, 2022, 58(16): 84-93.

DONG Yukun, LI Haojie, WEI Xinxin, TANG Daolong. Software Defect Prediction Based on Features Fusion of Program Structure and Semantics[J]. Computer Engineering and Applications, 2022, 58(16): 84-93.

参考文献

[1] MENZIES T，MILTON Z，TURHAN B，et al.Defect prediction from static code features：current results，limitations，new approaches[J].Automated Software Engineering，2010，17（4）：375-407.
[2] JING X Y，YING S，ZHANG Z W，et al.Dictionary learning based software defect prediction[C]//Proceedings of the 36th International Conference on Software Engineering.New York：ACM，2014：414-423.
[3] MING T，LIN T，DARA S，et al.Online defect prediction for imbalanced data[C]//Proceedings of the 37th International Conference on Software Engineering.New York：ACM，2015：99-108.
[4] NAM J，PAN S J，KIM S.Transfer defect learning[C]//Proceedings of the 35th International Conference on Software Engineering.New York：ACM，2013：382-391.
[5] WANG S，LIU T，NAM J，et al.Deep semantic feature learning for software defect prediction[J].IEEE Transactions on Software Engineering，2018，46（12）：1267-1293.
[6] 傅艺绮，董威，尹良泽，等.基于组合机器学习算法的软件缺陷预测模型[J].计算机研究与发展，2017，54（3）：633-641.
FU Y Q，DONG W，YIN L Z，et al.Software defect prediction model based on the combination of machine learning algorithms[J].Journal of Computer Research and Development，2017，54（3）：633-641.
[7] GYIMOTHY T，FERENC R，SIKET I.Empirical validation of object-oriented metrics on open source software for fault prediction[J].IEEE Transactions on Software Engineering，2005，31（10）：897-910.
[8] ZHOU Y，LEUNG H.Empirical analysis of object-oriented design metrics for predicting high and low severity faults[J].IEEE Transactions on Software Engineering，2006，32（10）：771-789.
[9] GREENWALD J，FRANK A，MENZIES T.Data mining static code attributes to learn defect predictors[J].IEEE Transactions on Software Engineering，2007，33（9）：637-640.
[10] SESTILI C D，SNAVELY W S，VANHOUDNOS N M.Towards security defect prediction with AI[J].arXiv：1808.09897，2018.
[11] MOU L，LI G，ZHANG L，et al.Convolutional neural networks over tree structures for programming language processing[C]//Proceedings of the 30th AAAI Conference on Artificial Intelligence，2016：1287-1293.
[12] KIM Y.Convolutional neural networks for sentence classification[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing.Stroudsburg：ACL，2014.
[13] HINDLE A，BARR E T，SU Z，et al.On the naturalness of software[C]//Proceedings of the 34th International Conference on Software Engineering.New York：ACM，2012：837-847.
[14] LI Z，ZOU D，XU S，et al.VulDeePecker：a deep learning-based system for vulnerability detection[C]//Network and Distributed System Security Symposium，2018.
[15] VulDeePecker.Code gadget database[DB/OL].（2020-11-18）[2020-12-10].https：//github.com/CGCL-codes/VulDeePecker.
[16] ZOU D，WANG S，XU S，et al.μVulDeePecker：a deep learning-based system for multiclass vulnerability detection[J].IEEE Transactions on Dependable and Secure Computing，2021，18（5）：2224-2236.
[17] 段旭，吴敬征，罗天悦，等.基于代码属性图及注意力双向LSTM的漏洞挖掘方法[J].软件学报，2020，31（11）：3404-3420.
DUAN X，WU J Z，LUO T Y，et al.Vulnerability mining method based on code property graph and attention BiLSTM[J].Journal of Software，2020，31（11）：3404-3420.
[18] WANG S，LIU T，LIN T.Automatically learning semantic features for defect prediction[C]//Proceedings of the 38th International Conference on Software Engineering.New York：ACM，2016：297-308.
[19] HINTON G E，OSINDERO S，TEH Y W.A fast learning algorithm for deep belief nets[J].Neural Computation，2014，18（7）：1527-1554.
[20] LI J，HE P，ZHU J，et al.Software defect prediction via convolutional neural network[C]//Proceedings of the 2017 IEEE International Conference on Software Quality，Reliability and Security，2017.
[21] DAM H K，PHAM T，NG S W，et al.A deep tree-based model for software defect prediction[J].arXiv：1802.00921，2018.
[22] PAN L，LU J Y，XU L F，et al.An improved CNN model for within-project software defect prediction[J].Applied Sciences，2019，9（10）：2138.
[23] C2nes.javalang，version 0.13.0[CP/OL].（2020-05-28）[2020-10-15].https：//github.com/c2nes/javalang.
[24] RONG X.word2vec parameter learning explained[J].arXiv：1411.2738，2014.
[25] BOTTOU L.Large-scale machine learning with stochastic gradient descent[C]//Proceedings of the 19th International Conference on Computational Statistics.Berlin：Springer，2010：177-186.
[26] KINGMA D P，BA J.Adam：a method for stochastic optimization[J].arXiv：1412.6980，2014.
[27] HE Z，PETERS F，MENZIES T，et al.Learning from open-source projects：an empirical study on defect prediction[C]//Proceedings of the 2013 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement，2013.
[28] 杨朝红，宫云战，肖庆，等.基于软件缺陷模型的测试系统[J].北京邮电大学学报，2008，31（5）：1-4.
YANG Z H，GONG Y Z，XIAO Q.A defect model based testing system[J].Journal of Beijing University of Posts and Telecommunications，2008，31（5）：1-4.
[29] 董玉坤，金大海.基于区域内存模型的C程序静态分析[J].软件学报，2014，25（2）：357-372.
DONG Y K，JING D H.Optimizing static analysis based on defect correlations[J].Journal of Software，2014，25（2）：357-372.
[30] 王淑栋，尹文静.面向顺序存储结构的数据流分析[J].软件学报，2020，31（5）：1276-1293.
WANG S D，YIN W J.Data flow analysis for sequential storage structures[J].Journal of Software，2020，31（5）：1276-1293.
[31] JURECZKO M，MADEYSKI L.Towards identifying software project clusters with regard to defect prediction[C]//Proceedings of the 6th International Conference on Predictive，Timisoara，2010：12-13.
[32] SHUKLA S，RADHAKRISHNAN T，MUTHUKUMARAN K，et al.Multi-objective cross-version defect prediction[J].Soft Computing，2018，22（6）：1959-1980.
[33] XU Z，LI S，LUO X，et al.TSTSS：a two-stage training subset selection framework for cross version defect prediction[J].The Journal of Systems and Software，2019，154：59-78.
[34] FERENC R，TóTH Z，LADáNYI G.et al.A public unified bug dataset for Java and its assessment regarding metrics and bug prediction[J].Software Quality Journal，2020，28（4）：1447-1506.
[35] PETERS M，NEUMANN M，ZETTLEMOYER L，et al.Dissecting contextual word embeddings：architecture and representation[C]//Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing，2018.