Mining Edge-Weighted Call Graphs to Localise Software Bugs

Abstract

An important problem in software engineering is the automated discovery of noncrashing occasional bugs. In this work we address this problem and show that mining of weighted call graphs of program executions is a promising technique. We mine weighted graphs with a combination of structural and numerical techniques. More specifically, we propose a novel reduction technique for call graphs which introduces edge weights. Then we present an analysis technique for such weighted call graphs based on graph mining and on traditional feature selection schemes. The technique generalises previous graph mining approaches as it allows for an analysis of weights. Our evaluation shows that our approach finds bugs which previous approaches cannot detect so far. Our technique also doubles the precision of finding bugs which existing techniques can already localise in principle.

Software-Defect Localisation by Mining Dataflow-Enabled Call Graphs

“…Localising Call-Graph-Affecting Bugs. In the past years, a number of callgraph-based techniques for defect localisation have been proposed [3,5,7,8,18]. Their basic idea is to mine for patterns in the call graph which are characteristic for failing executions.…”

“…Existing techniques focus on structure-affecting bugs [3,5,7,18] and callfrequency-affecting bugs [7,8]. The graphs in [3,5,18] incorporate temporal information, the ones in [7,8] do not.…”

“…The graphs in [3,5,18] incorporate temporal information, the ones in [7,8] do not. In [6,7] we explain that the increased graph size when temporal information is incorporated leads to scalability issues when it comes to the mining.…”

“…In the past years, a number of studies has investigated defect localisation with graph-mining techniques [3,5,7,8,18]. They build on the analysis of dynamic call graphs (see [6] for an overview).…”

“…The rationale for defect localisation is that patterns occurring more frequently in graphs of failing executions contain methods which are more likely to be defective. Techniques that incorporate the analysis of call frequencies have proven to be more accurate and discover more types of defects than techniques without this feature [7]. See Figure 1 for a simple call graph representing a programme execution -each node stands for a method, edges represent method calls, and edge weights represent method-call frequencies.…”