Software Analytics: Towards Software Mining that Matters Tao Xie University of Illinois at Urbana-Champaign

Should I test\review my? ©A. Hassan

Software analytics is to enable software practitioners to perform data exploration and analysis in order to obtain insightful and actionable information for data- driven tasks around software and services. [MALETS’11 Zhang et al.]

Software Intelligence & Analytics for Software Development

use Data Exploration and Analysis  Mining Software Repositories (MSR) for Software Practitioners  Beyond Software Developers obtain Insightful and Actionable info  Need get real as well Analytic Techniques Producing Impact on Practice

Look through your software data ©A. Hassan

Mine through the data! An international effort to make software repositories actionable Promise Data Repository ©A. Hassan

Mining Software Repositories (MSR) Transforms static record- keeping repositories to active repositories Makes repository data actionable by uncovering hidden patterns and trends 11 Mailinglist BugzillaCrashes Field logsCVS/SVN ©A. Hassan

12 Field Logs Source Control CVS/SVN Bugzilla Mailing lists Crash Repos Historical Repositories Runtime Repos Code Repos Sourceforge GoogleCode ©A. Hassan

BugzillaCVS/SVNMailinglistCrashes MSR researchers analyze and cross-link repositories fixed bug discussions Buggy change & Fixing change Field crashes Estimate fix effort Mark duplicates Suggest experts and fix! New Bug Report ©A. Hassan

use Data Exploration and Analysis  Mining Software Repositories (MSR) for Software Practitioners  Beyond Software Developers obtain Insightful and Actionable info  Need get real as well Analytic Techniques Producing Impact on Practice

We continue to help practitioners (esp. developers) ©A. Hassan

Detection and Management of Code Clones ©A. Hassan

Support Logs Source Code ©A. Hassan

use Data Exploration and Analysis  Mining Software Repositories (MSR) for Software Practitioners  Beyond Software Developers obtain Insightful and Actionable info  Need get real as well Analytic Techniques Case Studies

Predicting Bugs Studies have shown that most complexity metrics correlate well with LOC! –Graves et al on commercial systems –Herraiz et al on open source systems Noteworthy findings: –Previous bugs are good predictors of future bugs –The more a file changes, the more likely it will have bugs in it –Recent changes affect more the bug potential of a file over older changes (weighted time damp models) –Number of developers is of little help in predicting bugs –Hard to generalize bug predictors across projects unless in similar domains [Nagappan, Ball et al. 2006] 23

Using Imports in Eclipse to Predict Bugs 24 import org.eclipse.jdt.internal.compiler.lookup.*; import org.eclipse.jdt.internal.compiler.*; import org.eclipse.jdt.internal.compiler.ast.*; import org.eclipse.jdt.internal.compiler.util.*;... import org.eclipse.pde.core.*; import org.eclipse.jface.wizard.*; import org.eclipse.ui.*; 14% of all files that import ui packages, had to be fixed later on. 71% of files that import compiler packages, had to be fixed later on. [Schröter et al. 06]

25 Percentage of bug-introducing changes for eclipse Don’t program on Fridays ;-) [Zimmermann et al. 05]

26 Failure is a 4-letter Word [PROMISE’11 Zeller et al.]

27 Actionable Alone is not Enough! [PROMISE’11 Zeller et al.]

Who produces more buggy code? ©A. Hassan

use Data Exploration and Analysis  Mining Software Repositories (MSR) for Software Practitioners  Beyond Software Developers obtain Insightful and Actionable info  Need get real as well Analytic Techniques Producing Impact on Practice

Analytic Techniques in SE Association rules and frequent patterns Classification Clustering Text mining/Natural language processing Visualization More details are at 30

31 Basic mining algorithms Solution-Driven  Problem-Driven Advanced mining algorithms New/adapted mining algorithms Where can I apply X miner?What patterns do we really need? E.g., frequent partial order mining [ESEC/FSE 07] E.g., association rule, frequent itemset mining… E.g., [ICSE 09], [ASE 09]

32 Code repositories 1 2 N … 12 mining patterns searchingmining patterns Code search engine e.g., Open source code on the web Eclipse, Linux, … Traditional approaches Our new approaches Often lack sufficient relevant data points (Eg. API call sites)‏ Code repositories Mining  Searching + Mining

 Existing approaches produce high % of false positives  One major observation:  Programmers often write code in different ways for achieving the same task  Some ways are more frequent than others Frequent ways Infrequent ways Mined Patterns mine patterns detect violations S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

34 Example: java.util.Iterator.next() PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } Code Sample 1 PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } Code Sample 2 Java.util.Iterator.next() throws NoSuchElementException when invoked on a list without any elements S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

35 Example: java.util.Iterator.next() PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } Code Sample 1 PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } Code Sample code examples Sample 1 (1218 / 1243) Sample 2 (6/1243) Mined Pattern from existing approaches: “boolean check on return of Iterator.hasNext before Iterator.next” S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

Example: java.util.Iterator.next()  Require more general patterns (alternative patterns): P 1 or P 2 P 1 : boolean check on return of Iterator.hasNext before Iterator.next P 2 : boolean check on return of ArrayList.size before Iterator.next  Cannot be mined by existing approaches, since alternative P 2 is infrequent PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } PrintEntries1(ArrayList entries) { … Iterator it = entries.iterator(); if(it.hasNext()) { string last = (string) it.next(); } … } Code Sample 1 PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } PrintEntries2(ArrayList entries) { … if(entries.size() > 0) { Iterator it = entries.iterator(); string last = (string) it.next(); } … } Code Sample 2 S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

37 Our Solution: ImMiner Algorithm  Mines alternative patterns of the form P 1 or P 2  Based on the observation that infrequent alternatives such as P 2 are frequent among code examples that do not support P code examples Sample 1 (1218 / 1243) Sample 2 (6/1243) P 2 is frequent among code examples not supporting P 1 P 2 is infrequent among entire 1243 code examples [ASE 09] S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

38 Alternative Patterns  ImMiner mines three kinds of alternative patterns of the general form “P 1 or P 2 ” Balanced: all alternatives (both P 1 and P 2 ) are frequent Imbalanced: some alternatives (P 1 ) are frequent and others are infrequent (P 2 ). Represented as “P 1 or P ^ 2 ” Single: only one alternative S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

ImMiner Algorithm  Uses frequent-itemset mining [Burdick et al. ICDE 01] iteratively  An input database with the following APIs for Iterator.next() Input databaseMapping of IDs to APIs S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

ImMiner Algorithm: Frequent Alternatives Input database Frequent itemset mining (min_sup 0.5) Frequent item: 1 P 1 : boolean-check on the return of Iterator.hasNext() before Iterator.next() S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

41 ImMiner: Infrequent Alternatives of P 1 Positive database (PSD) Negative database (NSD)  Split input database into two databases: Positive and Negative  Mine patterns that are frequent in NSD and are infrequent in PSD  Reason: Only such patterns serve as alternatives for P 1  Alternative Pattern : P 2 “const check on the return of ArrayList.size() before Iterator.next()”  Alattin applies ImMiner algorithm to detect neglected conditions S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

Neglected Conditions  Neglected conditions refer to  Missing conditions that check the arguments or receiver of the API call before the API call  Missing conditions that check the return or receiver of the API call after the API call  One primary reason for many fatal issues  security or buffer-overflow vulnerabilities [Chang et al. ISSTA 07] S.Thummalapenta and T. Xie. Alattin: Mining Alternative Patterns for Detecting Neglected Conditions. ASE 2009.

use Data Exploration and Analysis  Mining Software Repositories (MSR) for Software Practitioners  Beyond Software Developers obtain Insightful and Actionable info  Need get real as well Analytic Techniques Producing Impact on Practice

Machine Learning that Matters [ICML’12 Wagsta ff ]

Hyper-Focus on Benchmark Data Sets Hyper-Focus on Abstract Metrics Lack of Follow-Through [ICML’12 Wagsta ff ]

Meaningful Evaluation Methods Involvement of the World Outside ML Eyes on the Prize [ICML’12 Wagsta ff ]

MSRA Software Analytics Group Utilize data-driven approach to help create highly performing, user friendly, and efficiently developed and operated software and services. Software Development Process Software Systems Software Users Information Visualization Analysis Algorithms Large-scale Computing Research TopicsTechnology Pillars Vertical Horizontal Contact: Dongmei Zhang

Software Analytics in Practice

Adoption Challenges for Software Analytics Must show value before data quality improves Correlation vs. Causation

ICSE Papers: Industry vs. Academia Source© Carlo Ghezzi OSDI % vs. xSE ?% Developers, Programmers, Architects Among All Attendees ICSM 11 KeynoteICSE 09 Keynote MSR 12 KeynoteMSR 11 Keynote SCAM 12 Keynote

"Are Automated Debugging [Research] Techniques Actually Helping Programmers?" 50 years of automated debugging research –N papers  only 5 evaluated with actual programmers “ ” [ISSTA11 Parnin&Orso]

Are Regression Testing [Research] Techniques Actually Helping Industry? Likely most studied testing problems –N papers “ ” [STVR11 Yoo&Harman]

Are [Some] Failure-Proneness Prediction [Research] Techniques Actually Helping? Empirical software engineering (on prediction) –N papers [PROMISE11 Zeller et al.] “ ”

A Researcher's Observation in HCI Research Community “The reviewers simply do not value the difficulty of building real systems and how hard controlled studies are to run on real systems for real tasks. This is in contrast with how easy it is to build new interaction techniques and then to run tight, controlled studies on these new techniques with small, artificial tasks” “I give up on CHI/UIST” by James Landay Source©J. Landay

“This attitude is a joke and it offers researchers no incentive to do systems work. Why should they? Why should we put 3-4 person years into every CHI publication? Instead we can do 8 weeks of work on an idea piece or create a new interaction technique and test it tightly in 8-12 weeks and get a full CHI paper.” A Researcher's Observation in HCI Research Community “I give up on CHI/UIST” by James Landay Source©J. Landay

A Researcher's Observation in HCI Research Community “When will this community wake up and understand that they are going to run out any work on creating new systems (rather than small pieces of systems) and cede that important endeavor to industry?” “We are our own worst enemies. I think we have been blinded by the perception that "true scientific" research is only found in controlled experiments and nice statistics.” Does our research community have similar issues?? “I give up on CHI/UIST” by James Landay Source©J. Landay

MS Academic Search: “Pointer Analysis”

“Pointer Analysis: Haven’t We Solved This Problem Yet?” [Hind PASTE’01] 58 “During the past 21 years, over 75 papers and 9 Ph.D. theses have been published on pointer analysis. Given the tones of work on this topic one may wonder, “Haven't we solved this problem yet?'' With input from many researchers in the field, this paper describes issues related to pointer analysis and remaining open problems.” Michael Hind. Pointer analysis: haven't we solved this problem yet?. In Proc. ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (PASTE 2001) Source©M. Hind

“Pointer Analysis: Haven’t We Solved This Problem Yet?” [Hind PASTE’01] 59 Section 4.3 Designing an Analysis for a Client’s Needs “ Barbara Ryder expands on this topic: “… We can all write an unbounded number of papers that compare different pointer analysis approximations in the abstract. However, this does not accomplish the key goal, which is to design and engineer pointer analyses that are useful for solving real software problems for realistic programs.” Michael Hind. Pointer analysis: haven't we solved this problem yet?. In Proc. ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (PASTE 2001) Source©M. Hind&B. Ryder

MS Academic Search: “Clone Detection” Typically focus/evaluate on intermediate steps (e.g., clone detection) instead of ultimate tasks (e.g., bug detection or refactoring), even when the field already grows mature with n years of efforts on intermediate steps

Some Success Stories of Applying Clone Detection [Focus on Ultimate Tasks] 61 Zhenmin Li, Shan Lu, Suvda Myagmar, and Yuanyuan Zhou. CP-Miner: a tool for finding copy-paste and related bugs in operating system code. In Proc. OSDI MSRA XIAO Yingnong Dang, Dongmei Zhang, Song Ge, Chengyun Chu, Yingjun Qiu, and Tao Xie. XIAO: Tuning Code Clones at Hands of Engineers in Practice. In Proc. ACSAC 2012,

Suggested Actions  Tech Adoption Get research problems from real practice Get feedback from real practice Collaborate across disciplines Collaborate with industry

Software Analytics  Data Exploration and Analysis  For Software Practitioners  Obtain Insightful and Actionable info  With Analytic Techniques Producing Impact on Practice

Acknowledgments Microsoft Research Asia Software Analytics Group Ahmed Hassan, Lin Tan, Jian Pei Many other colleagues 64

Q&A

Software Analytics  Data Exploration and Analysis  For Software Practitioners  Obtain Insightful and Actionable info  With Analytic Techniques Producing Impact on Practice