This document presents a method for detecting when client code imitates library APIs. It uses data dependency graphs (DDGs) to represent code and defines the concepts of traces, subtraces, and trace subsumption. The algorithm generates DDGs for the library and client code with different method call inlinings. It detects an imitation if the client DDG trace subsumes the library DDG trace. The method was evaluated on open source projects, achieving 82% precision for imported libraries and 75% precision for static libraries.

1. Graph-based Detection of
Library API Imitations
Chengnian Sun, Siau-Cheng Khoo, Shao Jie Zhang
National University of Singapore
1 October 6, 2011

2. Motivation – Software Libraries
 Common practice to employ 3rd-party software libraries
 Providing certain functionalities / hiding implementation details
  Improving productivity
 Well tested
  Enhancing program quality
 Application Programming Interfaces (APIs)
 Exported by libraries
 Ways for programmers to interact with libraries
2 October 6, 2011

3. Motivation – Problem
 APIs are not always effectively used by programmers
 Imitation: client code re-implements the behavior of library
APIs
 Reasons
 Unfamiliar with the library,
 Library evolution
 Cost
 Waste unnecessary resources, time and energy
 Error-prone, software maintenance issue
3 October 6, 2011

4. Motivation – Example from JBoss
4 October 6, 2011

5. Motivation – Example from JBoss
Imitation (1): method.getInterceptors() == null ||
method.getInterceptors().length < 1
5 October 6, 2011

6. Motivation – Example from JBoss
Imitation (1): method.getInterceptors() == null ||
method.getInterceptors().length < 1
API: return (interceptors != null && interceptors.length > 0)
6 October 6, 2011

7. Motivation – Example from JBoss
Imitation (1): method.getInterceptors() == null ||
method.getInterceptors().length < 1
Refactor to: !method.hasAdvices()
7 October 6, 2011

8. Motivation – Example from JBoss
Imitation (1): method.getInterceptors() == null ||
method.getInterceptors().length < 1
Refactor to: !method.hasAdvices()
8 October 6, 2011

9. Motivation
 A library API imitation can be
 Not exactly the same
 Inter-procedural
9 October 6, 2011

10. Motivation
 A library API imitation can be
 Not exactly the same
 Inter-procedural
 Goal: to accurately detect such imitations
10 October 6, 2011

11. Detection of Library API Imitations
 Motivation
 Definitions
 Data Dependency Graph
 Trace & Subtrace
 Trace Subsumption
 Potential Imitation
 Algorithms
 Pre- & Post-processing
 Case Studies
 Conclusion
11 October 6, 2011

12. Definitions – Overview
 Employing Data Dependency Graphs (DDG) to represent
code
 Semantic representation
 Capturing data flows within a method
 Carrying a portion of control flow information
 A library DDG is trace-subsumed by a client DDG 
potential API imitation
 Relaxation of sub-graph isomorphism
 More efficient
 Minor-difference tolerant
12 October 6, 2011

13. Definitions – Data Dependency Graph
 DDG – a graphical representation of a method
 Vertices: basic statements (three address form)
 Edges v  u: direction represents data dependency
 vertex u is data dependent on vertex v
 a variable var
 defined at v
 used at u
 and there is an execution path P from v to u, and along P, the
var is not redefined.
13 October 6, 2011

14. Definitions – Trace & Subtrace
 A trace in a data dependency graph
 A path of vertices, <v1, v2, …, vm>
 The first vertex is an entry of the graph
14 October 6, 2011

15. Definitions – Trace & Subtrace
 A trace in a data dependency graph T1 = <C, D, E>
 A path of vertices, <v1, v2, …, vm> T2 = <A, B, C, D, E, F>
 The first vertex is an entry of the graph
 Given two traces T1 = <v1, v2, …, vm> and T2 = <u1, u2, …, un>,T1
is a subtrace of T2 (T1 ≤ T2) if there exists an integer i,
 0≤i≤n–m
 match(v1, u1 + i), match(v2, u2 + i), …, match(vm, um + i)
 Subtrace is a generalization of substring relation.
15 October 6, 2011

16. Definitions – Trace & Subtrace
 A trace in a data dependency graph T1 = <C, D, E>
 A path of vertices, <v1, v2, …, vm> T2 = <A, B, C, D, E, F>
i=2
 The first vertex is an entry of the graph
 Given two traces T1 = <v1, v2, …, vm> and T2 = <u1, u2, …, un>,T1
is a subtrace of T2 (T1 ≤ T2) if there exists an integer i,
 0≤i≤n–m
 match(v1, u1 + i), match(v2, u2 + i), …, match(vm, um + i)
 Subtrace is a generalization of substring relation.
16 October 6, 2011

17. Definitions – Trace Subsumption
 A data dependency graph Glib
 A data dependency graph Gclt
 Gclt trace subsumes Glib , if and only if
 for each trace there exists at least one trace
such that is a subtrace of
17 October 6, 2011

18. Definitions – Potential Imitation
 A client method Clt potentially imitates a library
method Lib, if
 A DDG Gclt of Clt, resulting from inlining zero or some
method calls into Clt
 A DDG Glib of Lib, resulting from inlining zero or some
method calls into Lib
 Gclt trace subsumes Glib
18 October 6, 2011

19. Detection of Library API Imitations
 Motivation
 Definitions
 Algorithms
 Overall Algorithm
 Trace Subsumption Checking
 Pre- & Post-processing
 Case Studies
 Conclusion
19 October 6, 2011

20. Algorithms – Overall Algorithm
 Input
 A library API Lib
 A client method Clt
 A set S of all method calls in both Lib and Clt
 Output true if Clt potentially imitates Lib
 Body
for each sub-set s of S {
Lib’ = a copy of Lib with calls in s inlined
Clt’ = a copy of Clt with calls in s inlined
if the DDG of Clt’ trace subsumes the DDG of Lib’
return true
}
return false;
20 October 6, 2011

21. Algorithms – Trace Subsumption
 Input
 A DDG of a library API Glib
 A DDG of a client method Gclt
 Output
 true if Gclt trace subsumes Glib
 Depth-first Search,
 Step-by-step checking
21 October 6, 2011

22. Algorithms – An Example
Stack:
Current:
22 October 6, 2011

23. Algorithms – An Example
Locating all vertices in client matching each entry of the library Stack: (A, {A, A})
Current:
23 October 6, 2011

24. Algorithms – An Example
Locating client vertices matching library A’s successor D Stack:
Current: (A, {A, A})
24 October 6, 2011

25. Algorithms – An Example
Locating client vertices matching library A’s successor D Stack: (D, {D})
Current: (A, {A, A})
25 October 6, 2011

26. Algorithms – An Example
Locating client vertices matching library A’s successor B Stack: (D, {D})
Current: (A, {A, A})
26 October 6, 2011

27. Algorithms – An Example
Locating client vertices matching library A’s successor B Stack: (B, {B})
(D, {D})
Current: (A, {A, A})
27 October 6, 2011

28. Algorithms – An Example
Locating client vertices matching B’s successor {} in library Stack: (D, {D})
Current: (B, {B})
28 October 6, 2011

29. Algorithms – An Example
Locating client vertices matching library D’s successor M Stack:
Current: (D, {D})
29 October 6, 2011

30. Detection of Library API Imitations
 Motivation
 Definitions
 Algorithms
 Pre-processing & Post-validation
 Case Studies
 Conclusion
30 October 6, 2011

31. Pre-processing Libraries
 Remove nullness checks
If (a ==) {
return Constant;
} else {
a.XXX();
}
 Remove assertions
if (…)
throw Exception();
…….
 Remove exception handlers
try {
} catch (…) {}
31 October 6, 2011

32. Post-validating Reported Imitations
 Reject the following two cases
 Unmatched Inlined Vertices in Client
 Matching All References to Library Locals
32 October 6, 2011

33. Detection of Library API Imitations
 Motivation
 Definitions
 Algorithms
 Pre-processing & Post-validation
 Case Studies
 Conclusion
33 October 6, 2011

34. Case Studies
 Evaluation measure
 Subjects – 10 open-source Java projects
 Testbed:
 Intel Core 2 Quad CPU 3.00GHz and 8GB memory
34 October 6, 2011

35. Case Studies – Two Experiments
 Detecting Imitations of Imported Libraries
 Testing all method pairs (lib, clt), where the declaring class of
lib is already imported in the client class
 Precision = 313 / 383 = 82%
 Runtime = 314 seconds
35 October 6, 2011

36. Case Studies – Two Experiments
 Detecting Imitations of Imported Libraries
 Testing all method pairs (lib, clt), where the declaring class of
lib is already imported in the client class
 Precision = 313 / 383 = 82%
 Runtime = 314 seconds
 Detecting Imitations of Static Libraries
 Testing all method pairs (lib, clt), where lib is a public static
method
 Precision = 116 / 155 = 75%
 Runtime = 396 seconds
36 October 6, 2011

37. Case Studies – Example of Static API
37 October 6, 2011

38. Conclusion
 A common practice to employ 3rd party software libraries
 Client code re-implements behavior of existing APIs
 An algorithm based on data dependency graphs to detect
complex imitations
 Average precision 82% & 75%
38 October 6, 2011

39. Thank you.
Q&A
39 October 6, 2011