Detecting higher-level similarity patterns in programs

Abstract

Cloning in software systems is known to create problems during software maintenance. Several techniques have been proposed to detect the same or similar code fragments in software, so-called simple clones. While the knowledge of simple clones is useful, detecting design-level similarities in software could ease maintenance even further, and also help us identify reuse opportunities. We observed that recurring patterns of simple clones -so-called structural clones -often indicate the presence of interesting design-level similarities. An example would be patterns of collaborating classes or components. Finding structural clones that signify potentially useful design information requires efficient techniques to analyze the bulk of simple clone data and making non-trivial inferences based on the abstracted information.In this paper, we describe a practical solution to the problem of detecting some basic, but useful, types of design-level similarities such as groups of highly similar classes or files. First, we detect simple clones by applying conventional token-based techniques. Then we find the patterns of co-occurring clones in different files using the Frequent Itemset Mining (FIM) technique. Finally, we perform file clustering to detect those clusters of highly similar files that are likely to contribute to a design-level similarity pattern. The novelty of our approach is application of data mining techniques to detect design level similarities. Experiments confirmed that our method finds many useful structural clones and scales up to big programs. The paper describes our method for structural clone detection, a prototype tool called Clone Miner that implements the method and experimental results.

Detecting code clones in binary executables

“…Tools such as CP-Miner [21] and CCFinder [18] are token-based and usually more accurate and scalable, but tend to be sensitive to minor code changes. There are also tools based on abstract syntax trees (ASTs) [7,8,17,26]. However, all the above tools are for source code, while ours is the first practical clone detection algorithm for binaries.…”

Mining specifications of malicious behavior

“…In contrast, we mine specifications of malicious behavior, with no a priori definition of "malicious," by comparing malicious and benign programs. Clone-detection techniques compare programs [3,11,13,30], but they target similarities, not distinctions, between and within programs. Programdifferencing techniques have goals similar to ours, but are limited to distinctions at the statement level or at the structural level [2,9,10,17].…”

Mining specifications of malicious behavior

“…This approach supports the requirement that the specification of malicious behavior must capture aspects that are specific to the malware and absent from any benign programs. The software-engineering research community has put a lot of effort in analyzing commonalities and differences between programs and many techniques for clone detection [3,11,13,30] and program differencing [2,9,10,17] have been proposed. The differencing techniques are closest to our goal of mining specifications of malicious behavior, but they fall short because they generally require access to source code and because they produce differences between low-level elements of the program (e.g., individual statements) or between structural elements (e.g., type hierarchy, procedures).…”