Clone detection: Why, what and how?

This report documents the program and the outcomes of Dagstuhl Seminar 12071 ``Software Clone Management Towards Industrial Application''. Software clones are identical or similar pieces of code or design. A lot of research has been devoted to software clones. Unlike previous research, this seminar put a particular emphasis on industrial application of software clone management methods and tools and aimed at gathering concrete usage scenarios of clone management in industry, which will help to identify new industrially relevant aspects in order to shape the future research. Talks were presented by industrial participants and working groups were formed to discuss issues in clone detection, presentation, and refactoring. In addition we developed a unified conceptual model to capture clone information required to support a common notion of clone data and for interoperability to foster exchange of data among researchers and tools in practice. The main focus of current research is clones in source code -- therefore, we also looked into ways of extending our research to other types of software artifacts. Last but not least, we discussed how clone management activities may be integrated into the process of software development.

Code clone is one of the factors that makes software maintenance more difficult. Once a developer find a defect in a code fragment, he/she has to inspect the all of the code clones of the code fragment. In this study, we investigated the effectiveness of query-based use of a vector-based clone detection tool for supporting simultaneous fixing of buggy clones in source code and compared it with the query-based use of a token-based clone detection tool CCFinder.

Increasing clone maintenance support by unifying clone detection and refactoring activities

The ecosystem of open source software (OSS) has been growing considerably in size. In addition, code clones - code fragments that are copied and pasted within or between software systems - are also proliferating. Although code cloning may expedite the process of software development, it often critically affects the security of software because vulnerabilities and bugs can easily be propagated through code clones. These vulnerable code clones are increasing in conjunction with the growth of OSS, potentially contaminating many systems. Although researchers have attempted to detect code clones for decades, most of these attempts fail to scale to the size of the ever-growing OSS code base. The lack of scalability prevents software developers from readily managing code clones and associated vulnerabilities. Moreover, most existing clone detection techniques focus overly on merely detecting clones and this impairs their ability to accurately find "vulnerable" clones. In this paper, we propose VUDDY, an approach for the scalable detection of vulnerable code clones, which is capable of detecting security vulnerabilities in large software programs efficiently and accurately. Its extreme scalability is achieved by leveraging function-level granularity and a length-filtering technique that reduces the number of signature comparisons. This efficient design enables VUDDY to preprocess a billion lines of code in 14 hour and 17 minutes, after which it requires a few seconds to identify code clones. In addition, we designed a security-aware abstraction technique that renders VUDDY resilient to common modifications in cloned code, while preserving the vulnerable conditions even after the abstraction is applied. This extends the scope of VUDDY to identifying variants of known vulnerabilities, with high accuracy. In this study, we describe its principles and evaluate its efficacy and effectiveness by comparing it with existing mechanisms and presenting the vulnerabilities it detected. VUDDY outperformed four state-of-the-art code clone detection techniques in terms of both scalability and accuracy, and proved its effectiveness by detecting zero-day vulnerabilities in widely used software systems, such as Apache HTTPD and Ubuntu OS Distribution.

Dynamic web pages composed of inter-woven (tangled) source code written in multiple programming languages (e.g., HTML, PHP, JavaScript, CSS) makes it difficult to analyze and manage clones in web applications. Despite more than a decade of research on software clones, there are not many studies towards the investigation of code clones in web applications. In this paper, we present an in-depth study on the patterns (i.e., forking and templating) of exact and near-miss code clones in two industrial dynamic web applications having distinct architecture. The findings of our study confirm the believed patterns for cloning and suggest that specialized techniques and tool support are necessary for effectively managing clones in the tangled source code of dynamic web applications.

Software clone detection, aiming at identifying out code fragments with similar functionalities, has played an important role in software maintenance and evolution. Many clone detection approaches have been proposed. However, most of them represent source codes with hand-crafted features using lexical or syntactical information, or unsupervised deep features, which makes it difficult to detect the functional clone pairs, i.e., pieces of codes with similar functionality but differing in both syntactical and lexical level. In this paper, we address the software functional clone detection problem by learning supervised deep features. We formulate the clone detection as a supervised learning to hash problem and propose an end-to-end deep feature learning framework called CDLH for functional clone detection. Such framework learns hash codes by exploiting the lexical and syntactical information for fast computation of functional similarity between code fragments. Experiments on software clone detection benchmarks indicate that the CDLH approach is effective and outperforms the state-of-the-art approaches in software functional clone detection.

Clone code is the code fragment that is identical or similar in syntax or semantics, which has great impact on software development and maintenance. According to the large amount of clone code in software and its complex changes, researchers have proposed many methods to eliminate the harmful clone code, in which refactoring is an effective measure. In this paper, concepts of clone code and refactoring are introduced firstly. And then the main methods of current clone code refactoring are compared and analyzed, so the related tools of clone code refactoring can be elaborated and their advantages and disadvantages are summarized. At last, the shortcomings and limitations of the clone code refactoring are discussed.

Copy-and-paste of code is a common practice in software development, especially with the availability of myriad open-source projects. Reusing existing code fragments may accelerate the development process and ensure better quality of software if high-quality code fragments are reused. Therefore, code cloning might not be avoided even though it can increase software maintenance cost as bugs can be propagated inadvertently by code cloning and go beyond the boundary of a system. Generally speaking, reusable code clones are highly popular, have fewer bugs, and can stand the test of time thus exist in the system for a long term. Current code reuse studies primarily leverage API usage and method clone structures to provide coding recommendations. However, the existing approaches focus on the functional utility of code snippets without considering the quality aspects, such as fault resiliency, when analyzing code reuse. Without clone quality in mind, the virtues of code cloning are severely diminished. To help developers determine if the code clones are reusable or not, we leverage Machine Learning classifiers and Large Language Models (LLMs) to automatically identify reusable code clones from three perspectives: clone prevalence (i.e., the number of clone siblings), clone fault-resiliency (i.e., the percentage of non-buggy commits versus buggy commits), and clone longevity (i.e., the clone genealogy length). Our approach achieves a median AUC of 0.73, with an F1-score of 0.89, based on experiments conducted on 60 open-source projects, consisting of 30 Java and 30 C projects, which collectively encompass 538,598 commits. The results show that CountFollowers (i.e., number of people following the contributors that wrote the clones), SimilarityClonePaths (i.e., the Jaccard similarity coefficient among clone paths), and CountContributors (i.e., number of distinct contributors that access the clone group) provide the most explanatory power that contributes to correctly classifying reusable code clones. Hence, practitioners can utilize our classifiers and insights from our findings to make more reliable use of code clones and prioritize the use of high-quality clones in their clone management activities.

Pengembangan perangkat lunak adalah tugas kompleks dan membutuhkan adaptasi untuk mengakomodasi kebutuhan pengguna. Untuk membuat konsep dan perubahan perangkat lunak, dalam pemeliharaan, sekarang telah dikembangkan lebih mudah dalam pengembangan perangkat lunak, pola model-view-controller, yang merupakan arsitektur yang dapat membantu memfasilitasi dalam pengembangan dan pemeliharaan perangkat luna. Hal ini, karena dalam arsitektur model tiga-lapis, yaitu: tampilan dan pengontrolan dalam pembangunan dilakukan secara independen, sehingga dapat memberikan dahan dalam pengembangan dan pemeliharaan. Selain itu, arsitektur ini juga dapat melihat hal-hal yang sederhana dan menarik bagi pengguna. Software sistem on-line test adalah perangkat lunak yang memerlukan interaksi dengan pengguna, dan pemeliharaan perangkat adaptif. Karena sistem ujian on-line memerlukan pengembangan perangkat lunak untuk mengakomodasi kebutuhan ini berkembang dengan cepat. Makalah ini untuk menganalisis Model-View-Controller dan mencoba pembangunan, untuk menerapkannya dalam pengembangan perangkat lunak sistem pengujian on-line.

Code clones are prevalent in software systems due to many factors in software development. Detecting code clones and managing consistency between them along code evolution can be very useful for reducing clone-related bugs and maintenance costs. Despite some early attempts at detecting code clones and managing the consistency between them, the state-of-the-art tool can only handle simple code clones whose structures are identical or quite similar. However, existing empirical studies show that clones can have quite different structures with their evolution, which can easily go beyond the capability of the state-of-the-art tool. In this paper, we propose CCSync, a novel, rule-directed approach, which paves the structure differences between the code clones and synchronizes them even when code clones become quite different in their structures. The key steps of this approach are, given two code clones, to (1) extract a synchronization rule from the relationship between the clones, and (2) once one code fragment is updated, propagate the modifications to the other following the synchronization rule. We have implemented a tool for CCSync and evaluated its effectiveness on five Java projects. Our results shows that there are many code clones suitable for synchronization, and our tool achieves precisions of up to 92% and recalls of up to 84%. In particular, more than 76% of our generated revisions are identical with manual revisions.

Over the past few years, several software clone detection techniques have been developed. The software clones are the consequence of copied/pasted activity in software development which eventuates at different level of abstraction and may have different inception in a software system. This paper presents an efficient approach for the detection of type-1 software clones. The proposed detect type-1 software clones with high precision, recall, portability, and scalability. The type-1 clones generated by using mutation operator-based editing taxonomy.

Code clones mostly have been proven harmful for the development and maintenance of software systems, leading to code deterioration and an increase in bugs as the system evolves. Modern software systems are composed of several components, incorporating multiple technologies in their development. In such systems, it is common to replicate (parts of) functionality across the different components, potentially in a different programming language. Effect of these duplicates is more acute, as their identification becomes more challenging. This paper presents LICCA, a tool for the identification of duplicate code fragments across multiple languages. LICCA is integrated with the SSQSA platform and relies on its high-level representation of code in which it is possible to extract syntactic and semantic characteristics of code fragments positing full cross-language clone detection. LICCA is on a technology development level. We demonstrate its potential by adopting a set of cloning scenarios, extended and rewritten in five characteristic languages: Java, C, JavaScript, Modula-2 and Scheme.

The control software of large scale industrial systems such as machines and plants in the domain of automated Production Systems (aPS) is oftentimes developed using the method clone and own. However, cloning is one of the reason for high maintenance cost in software lifecycle and thus, the need for clone detection is arising. In large scale control software, clone detection is a tedious work, which cannot be performed manually. In order to alleviate the problem of huge number of clones in control software, structural clone detection can be performed. Detecting structural clones can help in better understanding of large scale and complex software, detecting commonly-used design patterns, and software evolution. In this work, the software structure is represented as a call graph depicting software artefacts and their direct dependencies. These call graphs are compared based on graph mining approach to detect similarities between two software structures. The proposed method is adapted and applied to two industrial use cases with different size and complexity. The obtained similar fragments in the software structures are evaluated and verified through manual analysis. The results show that the proposed method is promising approach to capture the similarities between two software structures.

Code cloning has been a typical practice during software development, by which code fragments are reused with or without changes by copying and pasting. It has been a questionable issue whether cloning has a destructive impact or not on software development and the quality of the delivered software. This paper empirically investigates the relationship between code clones and fault density of object-oriented classes. More than 3000 classes from five open source software systems were analyzed. The results suggest that classes that have clones were less fault dense on average than the classes that do not have clones. However, there was no association between intra/inter-class clone fragments within a class and its fault density. The results also indicate that among the groups of classes that have only one type of clones, the group of classes with Type III clones was the least fault dense. Minor, although statistically significant, correlations were observed between many code clone metrics and class fault density. Furthermore, the fault density predictive powers of these metrics were found to be almost the same. However, no improvement in the accuracy of fault density prediction models was observed when these metrics were used as inputs.

So far, a lot of techniques have been developed on the detection of code clones (i.e., duplicated code) in large-scale source code. Currently, the code clone research community is gradually shifting its focus of attention from the detection to the management (e.g., clone refactoring). During clone management, developers need to understand how and why code clones are scattered in source code, and then decide how to handle those code clones. In this paper, we present a clone analysis tool with tag cloud visualization. This tool is aimed at helping to understand why code clone are concentrated in a part of a software system by generating tag clouds from a collection of identifier names in source code.