Identifying bug signatures using discriminative graph mining

Abstract

Bug localization has attracted a lot of attention recently. Most existing methods focus on pinpointing a single statement or function call which is very likely to contain bugs. Although such methods could be very accurate, it is usually very hard for developers to understand the context of the bug, given each bug location in isolation. In this study, we propose to model software executions with graphs at two levels of granularity: methods and basic blocks. An individual node represents a method or basic block and an edge represents a method call, method return or transition (at the method or basic block granularity). Given a set of graphs of correct and faulty executions, we propose to extract the most discriminative subgraphs which contrast the program flow of correct and faulty executions. The extracted subgraphs not only pinpoint the bug, but also provide an informative context for understanding and fixing the bug. Different from traditional graph mining which mines a very large set of frequent subgraphs, we formulate subgraph mining as an optimization problem and directly generate the most discriminative subgraph with a recently proposed graph mining algorithm LEAP. We further extend it to generate a ranked list of top-k discriminative subgraphs representing distinct locations which may contain bugs. Experimental results and case studies show that our proposed method is both effective and efficient to mine discriminative subgraphs for bug localization and context identification.

Comprehensive evaluation of association measures for fault localization

“…The 20 association measures that we consider are: ϕ-coefficient [23] [19], support [5], confidence [5], Clark and Boswell's Laplace accuracy [12], conviction [9], interest [9], cosine [45], Piatetsky-Shapiro's Leverage [35], certainty factor [40], added value [45], collective strength [4], Jaccard [21], Klosgen [28], and information gain [10], [37].…”

Software-Defect Localisation by Mining Dataflow-Enabled Call Graphs

“…Localising Call-Graph-Affecting Bugs. In the past years, a number of callgraph-based techniques for defect localisation have been proposed [3,5,7,8,18]. Their basic idea is to mine for patterns in the call graph which are characteristic for failing executions.…”

“…Existing techniques focus on structure-affecting bugs [3,5,7,18] and callfrequency-affecting bugs [7,8]. The graphs in [3,5,18] incorporate temporal information, the ones in [7,8] do not.…”

“…In the past years, a number of studies has investigated defect localisation with graph-mining techniques [3,5,7,8,18]. They build on the analysis of dynamic call graphs (see [6] for an overview).…”

“…They can only localise defects which affect the call graph of a programme execution (simplified, the controlflow). While this is an important class of defects, Cheng et al [3] point out that the current techniques are agnostic regarding defects that influence the dataflow. We refer to such defects as dataflow-affecting bugs.…”