Code cloning risk assessment method and device, equipment and medium

Abstract

The invention relates to a code cloning risk assessment method and device, equipment and a medium. The method comprises the following steps: acquiring project information and clone pedigree data, extracting risk clone characteristics from the project information, constructing a clone risk assessment framework, and performing assessment by adopting the clone risk assessment framework according to the project information and the clone pedigree data to obtain a clone risk level corresponding to each code clone pair; and according to the clone risk level and the risk clone characteristics, training a pre-constructed XGBoost model, so that the XGBoost model can evaluate the code clone risk level. By adopting the method, code cloning risk prediction can be realized without depending on historical information.

Description

Technical Field

[0001] The present application relates to the technical field of code cloning, and in particular to a code cloning risk assessment method, device, equipment and medium. Background Art

[0002] In the software development process, code cloning is a common phenomenon, which refers to the reuse of the same code snippets in different parts or different projects. However, the quality and security of cloned code are often difficult to evaluate directly. The risks are often not discovered until the cloned code has caused software errors, resulting in higher software maintenance costs. Therefore, how to distinguish risky code clones that may cause harm to software has become an important issue in the current software development field.

[0003] Existing technical solutions mainly focus on the study of the correlation between code cloning and software errors. These studies are often conducted after the cloning damage occurs, analyzing the correlation between the error repair and the factors of code cloning in the project. However, the results of these studies can only provide programmers with a reference to guide the identification of risky clones. Programmers still need to rely on their own understanding of the project and programming experience to distinguish.

[0004] For example, the existing technology uses Bayesian networks to predict the need for code clone consistency maintenance. They extracted all cloning operations and factors that may be related to the need for consistency maintenance from the evolution of the software system, and constructed a Bayesian network for training. This method can accurately indicate whether cloned code needs consistency maintenance and which cloned code needs consistency maintenance.

[0005] There is also a traditional technology that proposes a model for evaluating the degree of harm of clones. This model extracts information such as modifications, bug fixes, and consistency maintenance made by code clones in the past from the clone's evolutionary history, detects delayed consistency changes (changes of the same type and content submitted in different commit operations), and uses four quantitative indicators to measure the degree to which clones will damage software quality or bring potential dangers, and divides them into four harm levels. This work divides harmful clones through clone evolutionary history information, and the division of their harm levels can distinguish harmful clones to a certain extent.

[0006] However, these existing technical solutions have certain limitations. They only focus on the consistency of code cloning risks or hazards, and cannot fully predict the risks of code cloning. Although the proposed model for evaluating the degree of cloning harm can distinguish harmful clones to a certain extent, the method of evaluating clone harm is based on the evolutionary history of clones, in which cloned code may have already caused harm, and programmers still need to bear the cost of error repair. Summary of the invention

[0007] Based on this, it is necessary to provide a code cloning risk assessment method, device, equipment and medium to address the above technical issues.

[0008] A code cloning risk assessment method, the method comprising:

[0009] Acquire project information and clone pedigree data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features;

[0010] Constructing a cloning risk assessment framework; the cloning risk assessment framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index;

[0011] The clone risk assessment framework is used to assess the clone risk level corresponding to each code clone pair according to the project information and clone lineage data;

[0012] According to the clone risk level and risk clone features, a pre-built XGBoost model is trained so that the XGBoost model can evaluate the code clone risk level.

[0013] In one of the embodiments, it also includes: setting multiple star number ranges according to the number of stars from GitHub; randomly crawling open source Java projects in each star number range, and performing function-granular clone lineage extraction on the projects through a clone lineage extraction tool to obtain project information and clone lineage data; and storing the project information and clone lineage data in a database.

[0014] In one of the embodiments, the code features include: whether the function names of the code clone pair are the same, whether the code snippets of the code clone pair are exactly the same, whether one of the two code snippets in the code clone pair is a functional code snippet and the other is a test code snippet, the number of historical changes to the corresponding lines of the clone code pair, and the number of code snippets that are clones of each other in the submitted code.

[0015] In one embodiment, the developer characteristics include: project participation experience information of the code submitter, whether the code submitters of cloned code snippets are the same, and the number of historical collaborative developers of cloned code snippets.

[0016] In one of the embodiments, the project characteristics include: the project where the code clone pair is located.

[0017] In one of the embodiments, it also includes: when the modification number index is 0 or the modification number index is greater than 0 and the modification ratio index is equal to 0, the risk level is 0; when the modification number index and the modification ratio index are greater than 0 and the modification submission behavior time interval index is equal to 0, the risk level is 1; when the modification number index, the modification ratio index, and the submission behavior time interval index are all greater than 0 and the consistent modification delay index is equal to 0, the risk level is 2; when the modification number index, the modification ratio index, the submission behavior time interval index, and the consistent modification delay index are all greater than 0, the risk level is 3.

[0018] In one of the embodiments, the method further includes: using the risk clone feature as an independent variable and the clone risk level as a dependent variable to train a multi-classification XGBoost model.

[0019] A code cloning risk assessment device, the device comprising:

[0020] A data acquisition module, used to acquire project information and clone lineage data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features;

[0021] An evaluation framework construction module is used to construct a cloning risk evaluation framework; the cloning risk evaluation framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index;

[0022] A risk assessment module, configured to adopt the clone risk assessment framework and assess the clone risk level corresponding to each code clone pair according to the project information and clone lineage data;

[0023] The training module is used to train a pre-built XGBoost model according to the clone risk level and risk clone features, so that the XGBoost model can evaluate the code clone risk level.

[0024] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0025] Acquire project information and clone pedigree data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features;

[0026] Constructing a cloning risk assessment framework; the cloning risk assessment framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index;

[0027] The clone risk assessment framework is used to assess the clone risk level corresponding to each code clone pair according to the project information and clone lineage data;

[0028] According to the clone risk level and risk clone features, a pre-built XGBoost model is trained so that the XGBoost model can evaluate the code clone risk level.

[0029] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0030] Acquire project information and clone pedigree data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features;

[0031] Constructing a cloning risk assessment framework; the cloning risk assessment framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index;

[0032] The clone risk assessment framework is used to assess the clone risk level corresponding to each project based on the project information and clone pedigree data;

[0033] According to the clone risk level and risk clone features, a pre-built XGBoost model is trained so that the XGBoost model can evaluate the code clone risk level.

[0034] The above-mentioned code clone risk assessment method, device, equipment and medium first obtain project information and clone pedigree data, thereby extracting risk clone features from the project information, and then constructing a clone risk assessment framework based on the relationship between code modification and code clone risk, thereby performing risk assessment on the project. In this way, no risk event is required and no developer experience is required. Then, based on the clone risk assessment framework, the code clone pair is risk assessed, and based on the assessed risk level and the extracted risk clone features, the XGBoost model is trained so that the XGBoost model can assess the code clone risk level. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a flow chart of a code cloning risk assessment method in one embodiment;

[0036] Figure 2 A schematic diagram of a flow chart of a code cloning risk assessment step in one embodiment;

[0037] Figure 3 A diagram of a cloning risk assessment framework in another embodiment;

[0038] Figure 4 is a structural block diagram of a code cloning risk assessment device in an embodiment;

[0039] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] In one embodiment, Figure 1 As shown, a code cloning risk assessment method is provided, including the following steps:

[0042] Step 102: Obtain project information and clone lineage data, and extract risky clone features from the project information.

[0043] Risky clone features include: code features, developer features, and project features. In this step, clone lineage data is data that describes the evolutionary relationship and history between code clone pairs, and records information about a series of processes from the generation, modification to possible deletion of code clones.

[0044] For example, clone lineage data includes: clone instance identification, timestamp, version information, modification operation record, and clone relationship. The clone instance identification assigns a unique identifier to each clone code fragment. For example, clone code fragment A may be identified as CloneID_1001. The timestamp records the time of key events such as clone generation and modification. For example, if a clone code fragment is first detected on March 1, 2024, this time will be recorded in the timestamp. The version information is associated with the software version where the code clone is located. Assuming that a software is updated from version 1.0 to version 2.0, the version information of the code clone can show the differences and changes between the two versions. The modification operation record records the modification operations made to the clone code in detail, such as adding new functions, fixing vulnerabilities, optimizing performance, etc. For example, "a new verification function is added to clone code fragment B to improve security." Clone relationship: describes the relationship between different clone code fragments, including whether they are cloned from the same original code, or whether one clone is a derivative version of another clone. For example, clone code fragment C is obtained by partially modifying clone code fragment D, and this relationship will be recorded.

[0045] In this step, the method of obtaining project information and clone genealogy data can be automatic extraction through tools or extraction based on code analysis technology. The tools can be ECC, FCG, etc. These tools can automatically identify and analyze clone codes in the code library and generate corresponding genealogy data. It can also be a function of version control systems such as Git. By comparing code files of different versions, the change history and similar parts of the code can be found, thereby inferring code clones and their evolutionary relationships. For example, you can use Git's log function to view the detailed information of each submission, including modified files, added or deleted lines of code, etc., and then analyze the generation and changes of code clones. Again, no specific restrictions are made.

[0046] Step 104, constructing a cloning risk assessment framework.

[0047] The cloning risk assessment framework includes: modification count indicator, modification ratio indicator, modification submission behavior time interval indicator, and consistent modification delay indicator.

[0048] In this embodiment, the modification count index refers to the ratio of the modification count of the clone instance to the number of clone instances, which is used to describe the number of modifications after the clone is born. The modification ratio index refers to the proportion of consistent modifications to the total modifications during the clone evolution process, which is used to describe the number of consistent changes. The modification submission behavior time interval index refers to the average value of all submission behavior time intervals between two consistent changes, which is used to describe the degree of delay between consistent changes. The consistent modification delay index refers to the existence of two different commit events, which have the same type of changes (for example: both add code, both delete code, both change code), and the content of the changes is also the same (for example: the same content of code is added after the modification).

[0049] Step 106 , using a clone risk assessment framework, based on project information and clone lineage data, evaluate and obtain the clone risk level corresponding to each code clone pair.

[0050] Step 108 , training a pre-built XGBoost model according to the cloning risk level and risky clone features, so that the XGBoost model can evaluate the code cloning risk level.

[0051] In the above code clone risk assessment method, project information and clone pedigree data are first obtained to extract risk clone features from the project information. Then, based on the relationship between code modification and code clone risk, a clone risk assessment framework is constructed to assess the risk of the project. In this way, no risk events need to occur and no developer experience is required. Then, based on the clone risk assessment framework, the project is risk assessed. Based on the assessed risk level and the extracted risk clone features, the XGBoost model is trained so that the XGBoost model can assess the code clone risk level.

[0052] In one of the embodiments, the method of obtaining project information and clone lineage data includes: setting multiple star number ranges according to the number of stars from GitHub; randomly crawling open source Java projects in each star number range, and performing function-granular clone lineage extraction on the projects through a clone lineage extraction tool to obtain project information and clone lineage data; and storing the project information and clone lineage data in a database.

[0053] In this embodiment, the number of stars is the number of followers and likes of a project by other developers. By crawling with different numbers of stars, the generalization of project selection can be improved. For example, according to the four ranges of stars of 0-10, 11-100, 101-1000, and greater than 1000, open source Java projects are randomly crawled in each range. Figure 2 As shown, all the acquired project information and clone pedigrees are stored in a database, and subsequently, risk clone-related factor data are acquired and clone risk levels are divided based on the collected data.

[0054] In one of the embodiments, the code features include: whether the function names of the code clone pair are the same, whether the code snippets of the code clone pair are exactly the same, whether one of the two code snippets in the code clone pair is a functional code snippet and the other is a test code snippet, the number of historical changes to the corresponding lines of the clone code pair, and the number of code snippets that are clones of each other in the submitted code.

[0055] Specifically, when the code function names in the clone pair are the same, they are more likely to achieve the same goal. In this way, it is necessary to modify the code at the same time in the subsequent code modification. If they are not modified at the same time, it will bring risks. Therefore, whether the function names of the code clone pair are the same is selected as the code feature.

[0056] Identical code can be considered as duplicate code, and subsequent modifications are more likely to require simultaneous modifications, which can easily lead to risks due to non-simultaneous modifications. Therefore, whether the code snippets of the code clone pair are identical is selected as the code feature.

[0057] If the two code snippets in a clone pair are a function and its corresponding test function, the test function needs to be modified at the same time when the function function is changed. However, since the function function and the test function are located in different locations, it is easy to forget to modify them at the same time, which poses a great risk. Therefore, whether one of the two code snippets in the code clone pair is a function code snippet and the other is a test code snippet is selected as a code feature.

[0058] If the code has been frequently changed in history, it can be considered risky because frequent changes are more likely to cause forgetting that the corresponding cloned code fragment needs to be modified at the same time. Therefore, the number of historical changes to the corresponding line of the cloned code is selected as the code feature.

[0059] If the submitted code and more function fragments are clones of each other, it is more likely to cause risks, because it is easier to forget to modify one of the code fragments. Therefore, the number of code fragments that are clones of each other is selected as the code feature.

[0060] In another embodiment, the developer characteristics include: project participation experience information of the code submitter, whether the code submitters of cloned code snippets are the same, and the number of historical collaborative developers of cloned code snippets.

[0061] Specifically, the project experience of code submitters is selected as the developer characteristics: experienced core developers are more familiar with the project situation, have a clearer understanding of the cloning situation, and are more likely to synchronize the cloned code fragments in future modifications. However, if the developer is inexperienced, he cannot clearly understand the code cloning situation, and is more likely to fail to synchronize the cloned code when modifying the code later, which is more likely to cause risks.

[0062] Whether the code committers of cloned code fragments are the same is selected as the developer feature: developers tend to reuse existing code for software development. If the committers of the cloned code pairs are the same, the committers understand the code logic of their historical development and are less likely to introduce risks when reusing.

[0063] The number of historical co-developers who cloned the code snippet was selected as the developer feature: the more co-developers there are, the less communication between them, and the greater the risk of subsequent problems in the generated code clone.

[0064] In one embodiment, the project characteristics include: the project where the code clone pair is located. The code clone situations in different projects are different, and different project teams have different ways of introducing and handling cloned codes, so it is necessary to distinguish the clone pairs of different projects.

[0065] In one of the embodiments, when the modification number index is 0 or the modification number index is greater than 0 and the modification proportion index is equal to 0, the risk level is 0; when the modification number index and the modification proportion index are greater than 0 and the modification submission behavior time interval index is equal to 0, the risk level is 1; when the modification number index, the modification proportion index, and the submission behavior time interval index are all greater than 0 and the consistent modification delay index is equal to 0, the risk level is 2; when the modification number index, the modification proportion index, the submission behavior time interval index, and the consistent modification delay index are all greater than 0, the risk level is 3.

[0066] Specifically, Figure 3As shown in the figure, CPI (Changes per clone Instance, the ratio of the number of modifications of a clone instance to the number of clone instances). It is used to describe the number of modifications of a clone after its birth. When CPI = 0, the clone code has not changed at all, so it will not cause any harm, and the risk level is recorded as 0. CCR (Consistent Change Ratio, the ratio of consistent modifications to total modifications during clone evolution). It is used to describe the number of consistent changes. In order to adapt to the software environment, developers will inevitably modify clones. However, even if an error is fixed, as long as no consistent change occurs (that is, when CCR = 0), it means that the error fix is ​​not caused by the generation of clone fragments, so the clone is considered to be harmless, and the risk level is recorded as 0. CCL (Consistent Change Latency, the average time interval of all commit behaviors between two consistent changes). It is used to describe the delay between consistent changes. If consistent changes are always completed in the same commit (that is, when CCL = 0), it means that the clone has a large evolutionary coupling, and when changes occur, the consistent changes of the clone pair or the clone class as a whole must be maintained, which has a high maintenance cost. Although there is a risk of consistency defects, since no software errors have been caused yet, the clone code at this time has only a low risk, and the risk level is recorded as 1. Does the clone fragment have a code submission for error repair related to LCC (Late Consistent Changes). Among them, the phenomenon of consistent delayed changes refers to: there are two different submission events, and their change types are the same (for example: both add code, both delete code, and both change code), and the content of the change is also the same (for example: the same content is added after the modification). If there is an error fix in the code submission in LCC, it means that the clone fragment has already caused a software error due to inconsistent behavior during the period when the code submission change was not unified. The clone may still have inconsistent defects in the future, with a high risk of endangering the software, and the risk level is recorded as 3; if there is no error fix, it means that the inconsistent clone pair has not caused a software error for the time being, but the risk of causing errors in the future cannot be ruled out, and the risk level is recorded as 2. According to the above method, the risk level of all clone pairs is evaluated in the range of 0-3, and the corresponding risk levels of all clone pairs are obtained and stored in the database together with the clone lineage data.

[0067] In one of the embodiments, risk clone features are used as independent variables and clone risk levels are used as dependent variables to train a multi-classification XGBoost model.

[0068] Specifically, the range and form of each value of the risk clone-related factors obtained in the data acquisition stage are different. In order to ensure the effect of subsequent model training and weaken the impact of factor deviation, the data needs to be preprocessed. For continuous variables, perform the "+1" and then log transformation operations, and on this basis standardize them to comparable dimensions (mean is 0, variance is 1); for discrete variables, retain the original characteristics of the variables. The processed related factors constitute the feature vector of the clone code pair, which serves as the independent variable of the data set; the risk level of the clone pair serves as the target variable (dependent variable) of the data set. The data set is randomly divided into training set, validation set and test set in a ratio of 8:1:1 for subsequent model training and evaluation.

[0069] In addition, the XGBoost model is selected for training to obtain a multi-classifier that can predict the risk of clone code pairs. The input of the classifier is the risk-related factors of the clone code pairs, and the output is the risk rating of the clone code pairs in the range of 0-3. There are two main reasons for choosing XGBoost: (1) High efficiency. XGBoost uses parallel processing and cache optimization technology during the training process, so that it can maintain a relatively fast speed when processing large-scale data sets and can adapt to large-scale historical development data of open source projects; (2) Multi-classification support. XGBoost natively supports multi-classification problems without additional modification or settings. It can automatically process multi-classification labels to meet the four-classification needs of 0-3 levels in the risk rating of clone code in the present invention. The training set data obtained after preprocessing is used to train the XGBoost model, and the test set data is used to evaluate the performance of the model. According to the performance of the model on the test set, the XGBoost parameters are adjusted to optimize the model performance. The performance of the model is further verified using the validation set to ensure that the model can perform well on different data subsets, and finally a tool is obtained to predict the risk level of the clone code when it is submitted.

[0070] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0071] In one embodiment, Figure 4As shown, a code cloning risk assessment device is provided, including: a data acquisition module 402, an assessment framework construction module 404, a risk assessment module 406 and a training module 408, wherein:

[0072] The data acquisition module 402 is used to acquire project information and clone lineage data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features;

[0073] An evaluation framework construction module 404 is used to construct a cloning risk evaluation framework; the cloning risk evaluation framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index;

[0074] A risk assessment module 406 is used to assess the clone risk level corresponding to each code clone pair based on the project information and clone lineage data using the clone risk assessment framework;

[0075] The training module 408 is used to train a pre-built XGBoost model according to the clone risk level and risk clone features, so that the XGBoost model can evaluate the code clone risk level.

[0076] In one of the embodiments, the data acquisition module 402 is used to set multiple star number ranges according to the number of stars from GitHub; randomly crawl open source Java projects in each star number range, and use the clone lineage extraction tool to extract the clone lineage of the project at the function granularity to obtain project information and clone lineage data; and store the project information and clone lineage data in a database.

[0077] In one of the embodiments, the code features include: whether the function names of the code clone pair are the same, whether the code snippets of the code clone pair are exactly the same, whether one of the two code snippets in the code clone pair is a functional code snippet and the other is a test code snippet, the number of historical changes to the corresponding lines of the clone code pair, and the number of code snippets that are clones of each other in the submitted code.

[0078] In one embodiment, the developer characteristics include: project participation experience information of the code submitter, whether the code submitters of cloned code snippets are the same, and the number of historical collaborative developers of cloned code snippets.

[0079] In one of the embodiments, the project characteristics include: the project where the code clone pair is located.

[0080] In one embodiment, the assessment framework construction module 404 is also used to: when the modification number index is 0 or the modification number index is greater than 0 and the modification ratio index is equal to 0, the risk level is 0; when the modification number index and the modification ratio index are greater than 0 and the modification submission behavior time interval index is equal to 0, the risk level is 1; when the modification number index, the modification ratio index, and the submission behavior time interval index are all greater than 0 and the consistent modification delay index is equal to 0, the risk level is 2; when the modification number index, the modification ratio index, the submission behavior time interval index, and the consistent modification delay index are all greater than 0, the risk level is 3.

[0081] In one embodiment, the training module 408 is further configured to train a multi-classification XGBoost model using the risk clone feature as an independent variable and the clone risk level as a dependent variable.

[0082] For the specific limitations of the code cloning risk assessment device, please refer to the limitations of the code cloning risk assessment method above, which will not be repeated here. The various modules in the above-mentioned code cloning risk assessment device can be implemented in whole or in part through software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0083] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a code cloning risk assessment method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0084] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0085] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method in the above embodiment when executing the computer program.

[0086] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method in the above embodiment are implemented.

[0087] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0088] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0089] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A code cloning risk assessment method, characterized in that: The method comprises: Acquire project information and clone pedigree data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features; Constructing a cloning risk assessment framework; the cloning risk assessment framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index; The clone risk assessment framework is used to assess the clone risk level corresponding to each code clone pair according to the project information and clone lineage data; According to the clone risk level and risk clone features, a pre-built XGBoost model is trained so that the XGBoost model can evaluate the code clone risk level.

2. The method according to claim 1, characterized in that The obtaining of project information and clone lineage data includes: Set multiple star ranges based on the number of stars on GitHub; We randomly crawl open source Java projects in each range of stars, and use the clone lineage extraction tool to extract clone lineages at the function level to obtain project information and clone lineage data. The project information and clone lineage data are stored in a database.

3. The method according to claim 1, characterized in that The code features include: whether the function names of the code clone pairs are the same, whether the code snippets of the code clone pairs are exactly the same, whether one of the two code snippets in the code clone pair is a functional code snippet and the other is a test code snippet, the number of historical changes to the corresponding lines of the clone code pair, and the number of code snippets that are clones of each other in the submitted code.

4. The method according to claim 1, characterized in that The developer characteristics include: project participation experience information of the code submitter, whether the code submitters of cloned code fragments are the same, and the number of historical collaborative developers of cloned code fragments.

5. The method according to claim 1, characterized in that The project features include: the project to which the code clone belongs.

6. The method according to claim 1, characterized in that The construction of a clonal risk assessment framework includes: When the modification count index is 0 or the modification count index is greater than 0 and the modification ratio index is equal to 0, the risk level is 0; When the modification count index and modification ratio index are greater than 0 and the modification submission behavior time interval index is equal to 0, the risk level is 1; When the modification count index, modification ratio index, and submission behavior time interval index are all greater than 0 and the consistent modification delay index is equal to 0, the risk level is 2; When the modification count index, modification ratio index, submission behavior time interval index, and consistent modification delay index are all greater than 0, the risk level is 3.

7. The method according to any one of claims 1 to 6, characterized in that: According to the clone risk level and risk clone characteristics, a pre-built XGBoost model is trained, including: The risk clone feature is used as an independent variable, and the clone risk level is used as a dependent variable to train a multi-classification XGBoost model.

8. A code cloning risk assessment device, characterized in that: The device comprises: A data acquisition module, used to acquire project information and clone lineage data, and extract risk clone features from the project information; the risk clone features include: code features, developer features, and project features; An evaluation framework construction module is used to construct a cloning risk evaluation framework; the cloning risk evaluation framework includes: a modification number index, a modification ratio index, a modification submission behavior time interval index, and a consistent modification delay index; A risk assessment module, configured to adopt the clone risk assessment framework and assess the clone risk level corresponding to each code clone pair according to the project information and clone lineage data; The training module is used to train a pre-built XGBoost model according to the clone risk level and risk clone features, so that the XGBoost model can evaluate the code clone risk level.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images