VADER-SC: A Model Agnostic Tool for Large Scale, AI Driven Automated Source Code Summarization

Source code summarization is the task of creating readable summaries that describe the functionality of software. Source code summarization is a critical component of documentation generation, for example as Javadocs formed from short paragraphs attached to each method in a Java program. At present, a majority of source code summarization is manual, in that the paragraphs are written by human experts. However, new automated technologies are becoming feasible. These automated techniques have been shown to be effective in select situations, though a key weakness is that they do not explain the source code's context. That is, they can describe the behavior of a Java method, but not why the method exists or what role it plays in the software. In this paper, we propose a source code summarization technique that writes English descriptions of Java methods by analyzing how those methods are invoked. We then performed two user studies to evaluate our approach. First, we compared our generated summaries to summaries written manually by experts. Then, we compared our summaries to summaries written by a state-of-the-art automatic summarization tool. We found that while our approach does not reach the quality of human-written summaries, we do improve over the state-of-the-art summarization tool in several dimensions by a statistically-significant margin.

A programmer performing a change task to a system can benefit from accurate comments on the source code. As part of good programming practice described by Kernighan and Pike in the book The Practice of Programming , comments should "aid the understanding of a program by briefly pointing out salient details or by providing a larger-scale view of the proceedings." In this paper, we explore the widely varying uses of comments in source code. We find that programmers not only use comments for describing the actual source code, but also use comments for many other purposes, such as "talking" to colleagues through the source code using a comment "Joan, please fix this method." This kind of comments can complicate the mining of project information because such team communication is often perceived to reside in separate archives, such as emails or newsgroup postings, rather than in the source code. Nevertheless, these and other types of comments can be very useful inputs for mining project information.

Context: Software development teams constantly opt for faster, lower quality solutions to solve current problems without planning for the future. This situation will have a negative long-term impact and is called technical debt. Similar to a financial debt, technical debts require interest payments and must be managed and detected so that the team can evaluate the best way to deal with them. One way to detect technical debts is through classification of source code comments. Developers often insert comments warning of the need to improve their own code in the future. This is known as Self-Admitted Technical Debt (SATD). Objective: Combine Word2vec for word embedding with a Long short-term memory (LSTM) neural network model to identify SATDs from comments in source code and compare with other studies and LSTM without word embedding. Method: We plan and execute an experimental process with model’s effectiveness data validation. Results: In general, the classification improves when all SATD types were grouped in a single label. In relation to other studies, the LSTM model with Word2vec achieved better recall and f-measure. The LSTM model without word embedding achieves greater recall, but perform worse in precision and f-measure. Conclusion: We found evidence that LSTM models combined with word embedding are promising for the development a more effective SATD classifier.

Source code summarization aims at generating concise and clear natural language descriptions for programming languages. Well-written code summaries are beneficial for programmers to participate in the software development and maintenance process. To learn the semantic representations of source code, recent efforts focus on incorporating the syntax structure of code into neural networks such as Transformer. Such Transformer-based approaches can better capture the long-range dependencies than other neural networks including Recurrent Neural Networks (RNNs), however, most of them do not consider the structural relative correlations between tokens, e.g., relative positions in Abstract Syntax Trees (ASTs), which is beneficial for code semantics learning. To model the structural dependency, we propose a StruCtural RelatIve Position guided Transformer, named SCRIPT. SCRIPT first obtains the structural relative positions between tokens via parsing the ASTs of source code, and then passes them into two types of Transformer encoders. One Transformer directly adjusts the input according to the structural relative distance; and the other Transformer encodes the structural relative positions during computing the self-attention scores. Finally, we stack these two types of Transformer encoders to learn representations of source code. Experimental results show that the proposed SCRIPT outperforms the state-of-the-art methods by at least 1.6%, 1.4% and 2.8% with respect to BLEU, ROUGE-L and METEOR on benchmark datasets, respectively. We further show that how the proposed SCRIPT captures the structural relative dependencies.

Automatic source code summarization system aims to generate a valuable natural language description for a program, which can facilitate software development and maintenance, code categorization, and retrieval. However, previous sequence-based research did not consider the long-distance dependence and highly structured characteristics of source code simultaneously. In this article, we present a Transformer-based Graph-Augmented Source Code Summarization (GA-SCS), which can effectively incorporate inherent structural and textual features of source code to generate an effective code description. Specifically, we develop a graph-based structure feature extraction scheme leveraging abstract syntax tree and graph attention networks to mine global syntactic information. And then, to take full advantage of the lexical and syntactic information of code snippets, we extend the original attention to a syntax-informed self-attention mechanism in our encoder. In the training process, we also adopt a reinforcement learning strategy to enhance the readability and informativity of generated code summaries. We utilize the Java dataset and Python dataset to evaluate the performance of different models. Experimental results demonstrate that our GA-SCS model outperforms all competitive methods on BLEU, METEOR, ROUGE, and human evaluations.

The increasing use of digital technologies in public health management has significantly expanded the processing of sensitive personal data, requiring legal mechanisms capable of ensuring the protection of privacy and fundamental rights. In this context, the Brazilian General Data Protection Law establishes regulatory parameters governing the processing of personal information by public and private institutions, including those operating in the healthcare sector. This study aims to analyze the legal challenges related to the application of the General Data Protection Law in the processing of sensitive data within the public health system of Manaus, Amazonas. The research is characterized as a qualitative and descriptive literature review, based on recent scientific articles and academic studies addressing personal data protection, information governance and public sector responsibility in health data processing. The results indicate that the implementation of the legislation faces challenges related to technological infrastructure, the absence of consolidated institutional information security policies and the need for training of public agents responsible for data processing. It is observed that the effectiveness of data protection regulations depends on the integration between legal norms, administrative practices and governance mechanisms capable of ensuring transparency, security and accountability in the use of personal information. The study concludes that strengthening institutional strategies aimed at protecting sensitive data represents an essential element for the consolidation of safer public health services aligned with the protection of fundamental rights, particularly within the Amazonian context.

Background/IntroductionTo promote transparency for both the public and researchers [1, 2], our objective was to implement all HDRUK Transparency Standards within the Grampian Data Safe Haven (DaSH) [3] website [4]. Particularly, we aimed to clarify sensitive data processing within our Trusted Research Environment (TRE) and improve accessibility of ethics and governance permissions procedures to facilitate public-benefit research. MethodsUtilising Knowledge Translation [5] and Implementation Science [6] methods, we identified relevant audiences to engage with the website to develop and evaluate digital content. A holistic approach to navigation, content creation and visuality was implemented to improve user experience for diverse audiences [7], leveraging plain language strategies [8] for understanding and transparency. ResultsWe addressed Standard 1 by publishing the DaSH Project Initiation Document and clear information on data processing. For Standards 3, 4 and 5, we enhanced user experience through streamlined navigation, dropdowns, signposting, and clear language, ensuring information remains appropriate for diverse audiences. Additionally, we established a quarterly review/update cycle. For Standard 6, we documented our Governance and Security structures alongside ISO27001 certification, a Data Use Register, and an Impact list of DaSH-supported research publications. Our most significant contribution was toward Standard 2, creating detailed permissions pathways guidance documents, including visual aids and permissions application checklists. To our knowledge, we are the first UK TRE to fully document and publish all available permissions pathways [9]. ConclusionsFirst, implementing the six HDRUK Transparency Standards simultaneously enables holistic improvements to openness, maximising the benefits of their complementary recommendations. Second, publishing project lifecycle information clarifies TRE and researcher responsibilities, especially during data extraction, pseudonymisation, and linkage stages [10], fostering trust and confidence in sensitive data use and processing. Third, by documenting ethics and governance pathways available in visual, text, and downloadable formats, we have demonstrably improved ethical and research literacy for both researchers and the public. By clearly articulating an easy-to-follow process for each permissions pathway, this initiative has been identified by our audience as the most impactful improvement in making sensitive data research transparent and accessible. OtherThere were three main lessons learnt. (1) A four-month timescale for website redesign incorporating new content, and multi-audience feedback, could prove overly ambitious without a strong procurement team, dedicated staff, and established audience connections. (2) Content management systems may be a significantly limiting component, impacting both visual appeal and the audiences’ preferred access (e.g. mobile). Implementing certain recommendations (e.g. Data Use Register; Database register), can lead to potentially dense pages and visually cluttered tabular information that are difficult to navigate. (3) Publishing audit findings or information about breaches presents a communication challenge. The potential exists for misinterpretations of legal, technical, or classification terms, which could erode public trust, even with transparency as the aim.

— In application development lifecycle, specifically in test-driven development, refactoring plays a crucial role in sustaining ease. However, in-spite of bringing ease, refactoring does not ensure the desired behaviour of code after it is applied. Because refactoring tends to worsen the alignments between source code and its corresponding units. One significant solution to the aforementioned issue is the technique called unit testing. As unit testing enable the developers to confidently apply refactoring while avoiding undesired code behaviour. Unit testing provides effective preventive measures for avoiding bugs by providing immediate feedback, thus assisting to mitigate the fear of change. In this work, we present a tool called GreenRefPlus which efficiently enables the developers to maintain the veracity of code after the process of refactoring is applied. The proposed tool provides automatic recovery for the unit tests after the code is refactored. In this work, we consider Java as our target programming language and we focus on five various types of refactoring, which include Rename Method, Extract Method, Move Method, Parameter Addition and Parameter Removal. Our experiments indicate that the proposed tool GreenRefPlus enables us to consistently refactor the code and apply unit tests. The results presented in our work reveal that the proposed tool assists developers in saving approximately 43% of the total time required to manually recover from broken unit tests.

Since 2020, the SARS-CoV-2 virus has infected billions of people and spread to 185 countries. The virus spreads by making new copies of its genome inside human cells and exploits the cells’ machinery to synthesise viral proteins it needs to infect further cells. Each time the virus copies its genetic material there’s a chance that the replication process introduces an error to the genetic sequence. Over time, these mutations accumulate which can give rise to new variants with different properties. These new variants, originating from a common ancestor, may spread faster or be able to evade immune systems that have learnt to recognise previous variants. To understand where new variants of SARS-CoV-2 come from and how related they are to each other, scientists build family trees called ‘phylogenetic trees’ based on similarities in the genetic sequences of different variants of the virus. Looking at these trees researchers can track how a variant spreads geographically, and also attempt to identify new worrying variants that might lead to a new wave of infections. The scale of the COVID-19 pandemic together with the global effort by clinicians and researchers to sequence SARS-CoV-2 genetic material means a library of over 13 million SARS-CoV-2 genomes now exists, making it the largest such collection for any organism. Although phylogenetic trees of viruses have been studied for a long time, exploring the SARS-CoV-2 library presents technical and practical challenges due to its sheer size. Sanderson has developed an open-source web tool called Taxonium that allows users to explore phylogenetic trees with millions of sequences. With help from collaborators at the University of California, Santa Cruz, Sanderson built a website called Cov2Tree, that uses the Taxonium platform to allow immediate access to an expansive tree of all publicly available SARS-CoV-2 sequences. Cov2Tree enables users to visualise all SARS-CoV-2 genomes in a birds-eye view akin to a ‘Google Earth for virus sequences’ where anyone can zoom in on a related family of viruses down to the level of individual sequences. This can be used to compare variants and follow geographic spread. Using Taxonium, scientists can explore how virus sequences are related to each other. They can also see the individual mutations that have occurred at each branch of the tree, and can search for sequences based on mutation, geographical location, or other factors. Interestingly, a trend appearing in the SARS-CoV-2 phylogenetic tree is the emergence of identical mutations at different branches of the tree without a common origin. These mutations may be a result of convergent evolution, a phenomenon that occurs when a mutation appears independently in different variants as it confers an advantage to the virus making such mutations more likely to persist. This means that scientists may be able to expect certain mutations to appear in more distantly related variants if they have appeared independently in several different variants already. Overall, Taxonium is an important tool for monitoring SARS-CoV-2 genomes, but it also has broader applications. The tool can be used to browse phylogenetic trees of other viruses and organisms. Furthermore, the Taxonium website offers a way to browse a tree of life, with images and links to Wikipedia. The SARS-CoV-2 library might be the largest now, but in the future even bigger datasets will likely be available, highlighting the importance of tools like Taxonium.

The contextual information associated to the work of a developer can be used to identify the source code artifacts that are more relevant at a specific point in time. This information is essential to reduce the effort spent by developers when searching for needed source code artifacts. We propose a context model that represents the focus of attention of the developer at each moment. This context model adapts automatically to changes in the focus of attention of the developer by detecting context transitions. We have developed a prototype that was submitted to an experiment with a group of developers. The results collected show that the use of our context model to rank, elicit and filter relevant source code elements for the developer is very promising.KeywordsContext ModelingContext CaptureContext TransitionsSoftware DevelopmentIDE

Period-tracking software applications or ‘menstruapps’ have witnessed a surge in popularity in recent years. At the same time, many of them are a part of the adtech industry, using business models that create revenue by selling users’ personal and intimate data. This exploratory article brings menstruapps into a feminist legal debate. It investigates the supranational European legal standards on intimate and sensitive data processing, particularly the General Data Protection Regulation (GDPR). Scrutinising explicit consent according to GDPR Article 9, this paper, through empirical examples, claims that current legal standards are not enforced. The standards are, furthermore, theoretically insufficient to fully safeguard data subjects’ integrity and autonomy. Instead of abandoning the concept, the article reimagines consent, using a contextual and communicative model where power relations are taken into consideration, building on the feminist concept of freedom to negotiate.

This paper proposes a new identity, and its underlying meta-data, model. The approach enables secure spanning of identity meta-data across many boundaries such as health-care, financial and educational institutions, including all others that store and process sensitive personal data. It introduces the new concepts of Compound Personal Record (CPR) and Compound Identifiable Data (CID) ontology, which aim to move toward own your own data model. The CID model ensures authenticity of identity meta-data; high availability via unified Cloud-hosted XML data structure; and privacy through encryption, obfuscation and anonymity applied to Ontology-based XML distributed content. Additionally CID via XML ontologies is enabled for identity federation. The paper also suggests that access over sensitive data should be strictly governed through an access control model with granular policy enforcement on the service side. This includes the involvement of relevant access control model entities, which are enabled to authorize an ad-hoc break-glass data access, which should give high accountability for data access attempts.

With the advent of the Internet of Things (IoT), billions of devices are expected to continuously collect and process sensitive data (e.g., location, personal health). Due to limited computational capacity available on IoT devices, the current de facto model for building IoT applications is to send the gathered data to the cloud for computation. While private cloud infrastructures for handling large amounts of data streams are expensive to build, using low cost public (untrusted) cloud infrastructures for processing continuous queries including on sensitive data leads to concerns over data confidentiality. This paper presents STYX, a novel programming abstraction and managed runtime system, that ensures confidentiality of IoT applications whilst leveraging the public cloud for continuous query processing. The key idea is to intelligently utilize partially homomorphic encryption to perform as many computationally intensive operations as possible in the untrusted cloud. STYX provides a simple abstraction to the IoT developer to hide the complexities of (1) applying complex cryptographic primitives, (2) reasoning about performance of such primitives, (3) deciding which computations can be executed in an untrusted tier, and (4) optimizing cloud resource usage. An empirical evaluation with benchmarks and case studies shows the feasibility of our approach.

A wireless body area network (WBAN) is a wireless network of wearable computing devices and intelligent physiological sensors. The intelligent physiological sensors collect and process sensitive data from the patient body. The security, reliability, and trustworthiness of sensitive data collected and processed by intelligent physiological sensors are critical due to its unique application domain. Moreover, consistent and reliable data gathering along with its transmission also plays a vital role in WBANs. Trust management (in BANs) has been found as a useful tool to improve cooperation among sensor nodes, security as well as reliability. The paper recommends a novel and efficient, lightweight trust assessment scheme (ETAS) suitable for health application domains and does not rely purely on any encryption technique. The primary purpose is to develop an exciting comprehensive, novel trust estimation framework for BANs to enhance reliability, dependability, security by isolating compromised (hotspot) nodes with great resource efficiency. ETAS incorporates several exclusive (unique) features like efficient trust evaluator, secure and attack resistant, along with competent trust aggregator function to achieve comprehensive trust score. The trust evaluator function is a multi-trust (communication trust, data trust, and energy trust) strategy to deal with severe internal security threats such as badmouthing attack, ballot-stuffing attack, sybil attack, traitor attack, etc. with less resource consumption. Moreover, ETAS incorporates both the success rate and misbehavior component during trust evaluation. The success rate record the number of successful/unsuccessful interactions among sensor nodes in terms of packet send/receive. The misbehavior component keeps records of current and past misbehavior of sensor nodes for effective decision making. Moreover, ETAS focus on the frequency of interaction among biomedical sensor nodes within a specified period to analyze their behavior for efficient trust decisions. Furthermore, ETAS incorporates temperature, data trust as well as the trust score of biomedical sensors to identify hotspot nodes in BSN. ETAS offers full flexibility to adjust the trust threshold, trust domain, reward, and punishment term according to system and application requirements. ETAS's efficiency is validated through several outcomes (MATLAB R2019a) along with theoretical analysis in terms of energy consumption, attack detection, mitigation, trust computation cost, and packet delivery ratio.

Legacy programs are normally monolithic (that is, all code runs in a single process and is not partitioned), and a bug in a program may result in the entire program being vulnerable and therefore untrusted. Program partitioning can be used to separate a program into multiple partitions, so as to isolate sensitive data or privileged operations. Manual program partitioning requires programmers to rewrite the entire source code, which is cumbersome, error-prone, and not generic. Automatic program partitioning tools can separate programs according to the dependency graph constructed based on data or programs. However, programmers still need to manually implement remote service interfaces for inter-partition communication. Therefore, in this paper, we propose AutoSlicer, whose purpose is to partition a program more automatically, so that the programmer is only required to annotate sensitive data. AutoSlicer constructs accurate data dependency graphs (DDGs) by enabling execution flow graphs, and the DDG-based partitioning algorithm can compute partition information based on sensitive annotations. In addition, the code refactoring toolchain can automatically transform the source code into sensitive and insensitive partitions that can be deployed on the remote procedure call framework. The experimental evaluation shows that AutoSlicer can effectively improve the accuracy (13%-27%) of program partitioning by enabling EFG, and separate real-world programs with a relatively smaller performance overhead (0.26%-9.42%).