-
TIPICAL -- Type Inference for Python In Critical Accuracy Level
Authors:
Jonathan Elkobi,
Bernd Gruner,
Tim Sonnekalb,
Clemens-Alexander Brust
Abstract:
Type inference methods based on deep learning are becoming increasingly popular as they aim to compensate for the drawbacks of static and dynamic analysis approaches, such as high uncertainty. However, their practical application is still debatable due to several intrinsic issues such as code from different software domains will involve data types that are unknown to the type inference system. In…
▽ More
Type inference methods based on deep learning are becoming increasingly popular as they aim to compensate for the drawbacks of static and dynamic analysis approaches, such as high uncertainty. However, their practical application is still debatable due to several intrinsic issues such as code from different software domains will involve data types that are unknown to the type inference system. In order to overcome these problems and gain high-confidence predictions, we thus present TIPICAL, a method that combines deep similarity learning with novelty detection. We show that our method can better predict data types in high confidence by successfully filtering out unknown and inaccurate predicted data types and achieving higher F1 scores to the state-of-the-art type inference method Type4Py. Additionally, we investigate how different software domains and data type frequencies may affect the results of our method.
△ Less
Submitted 4 August, 2023;
originally announced August 2023.
-
A Static Analysis Platform for Investigating Security Trends in Repositories
Authors:
Tim Sonnekalb,
Christopher-Tobias Knaust,
Bernd Gruner,
Clemens-Alexander Brust,
Lynn von Kurnatowski,
Andreas Schreiber,
Thomas S. Heinze,
Patrick Mäder
Abstract:
Static analysis tools come in many forms andconfigurations, allowing them to handle various tasks in a (secure) development process: code style linting, bug/vulnerability detection, verification, etc., and adapt to the specific requirements of a software project, thus reducing the number of false positives.The wide range of configuration options poses a hurdle in their use for software developers,…
▽ More
Static analysis tools come in many forms andconfigurations, allowing them to handle various tasks in a (secure) development process: code style linting, bug/vulnerability detection, verification, etc., and adapt to the specific requirements of a software project, thus reducing the number of false positives.The wide range of configuration options poses a hurdle in their use for software developers, as the tools cannot be deployed out-of-the-box. However, static analysis tools only develop their full benefit if they are integrated into the software development workflow and used on regular. Vulnerability management should be integrated via version history to identify hotspots, for example. We present an analysis platform that integrates several static analysis tools that enable Git-based repositories to continuously monitor warnings across their version history. The framework is easily extensible with other tools and programming languages. We provide a visualization component in the form of a dashboard to display security trends and hotspots. Our tool can also be used to create a database of security alerts at a scale well-suited for machine learning applications such as bug or vulnerability detection.
△ Less
Submitted 4 April, 2023;
originally announced April 2023.
-
Generalizability of Code Clone Detection on CodeBERT
Authors:
Tim Sonnekalb,
Bernd Gruner,
Clemens-Alexander Brust,
Patrick Mäder
Abstract:
Transformer networks such as CodeBERT already achieve outstanding results for code clone detection in benchmark datasets, so one could assume that this task has already been solved. However, code clone detection is not a trivial task. Semantic code clones, in particular, are challenging to detect. We show that the generalizability of CodeBERT decreases by evaluating two different subsets of Java c…
▽ More
Transformer networks such as CodeBERT already achieve outstanding results for code clone detection in benchmark datasets, so one could assume that this task has already been solved. However, code clone detection is not a trivial task. Semantic code clones, in particular, are challenging to detect. We show that the generalizability of CodeBERT decreases by evaluating two different subsets of Java code clones from BigCloneBench. We observe a significant drop in F1 score when we evaluate different code snippets and functionality IDs than those used for model building.
△ Less
Submitted 1 September, 2022; v1 submitted 26 August, 2022;
originally announced August 2022.
-
Cross-Domain Evaluation of a Deep Learning-Based Type Inference System
Authors:
Bernd Gruner,
Tim Sonnekalb,
Thomas S. Heinze,
Clemens-Alexander Brust
Abstract:
Optional type annotations allow for enriching dynamic programming languages with static ty** features like better Integrated Development Environment (IDE) support, more precise program analysis, and early detection and prevention of type-related runtime errors. Machine learning-based type inference promises interesting results for automating this task. However, the practical usage of such system…
▽ More
Optional type annotations allow for enriching dynamic programming languages with static ty** features like better Integrated Development Environment (IDE) support, more precise program analysis, and early detection and prevention of type-related runtime errors. Machine learning-based type inference promises interesting results for automating this task. However, the practical usage of such systems depends on their ability to generalize across different domains, as they are often applied outside their training domain. In this work, we investigate Type4Py as a representative of state-of-the-art deep learning-based type inference systems, by conducting extensive cross-domain experiments. Thereby, we address the following problems: class imbalances, out-of-vocabulary words, dataset shifts, and unknown classes. To perform such experiments, we use the datasets ManyTypes4Py and CrossDomainTypes4Py. The latter we introduce in this paper. Our dataset enables the evaluation of type inference systems in different domains of software projects and has over 1,000,000 type annotations mined on the platforms GitHub and Libraries. It consists of data from the two domains web development and scientific calculation. Through our experiments, we detect that the shifts in the dataset and the long-tailed distribution with many rare and unknown data types decrease the performance of the deep learning-based type inference system drastically. In this context, we test unsupervised domain adaptation methods and fine-tuning to overcome these issues. Moreover, we investigate the impact of out-of-vocabulary words.
△ Less
Submitted 28 July, 2023; v1 submitted 19 August, 2022;
originally announced August 2022.
-
ROMEO: Exploring Juliet through the Lens of Assembly Language
Authors:
Clemens-Alexander Brust,
Tim Sonnekalb,
Bernd Gruner
Abstract:
Automatic vulnerability detection on C/C++ source code has benefitted from the introduction of machine learning to the field, with many recent publications targeting this combination. In contrast, assembly language or machine code artifacts receive less attention, although there are compelling reasons to study them. They are more representative of what is executed, more easily incorporated in dyna…
▽ More
Automatic vulnerability detection on C/C++ source code has benefitted from the introduction of machine learning to the field, with many recent publications targeting this combination. In contrast, assembly language or machine code artifacts receive less attention, although there are compelling reasons to study them. They are more representative of what is executed, more easily incorporated in dynamic analysis, and in the case of closed-source code, there is no alternative.
We evaluate the representative capability of assembly language compared to C/C++ source code for vulnerability detection. Furthermore, we investigate the role of call graph context in detecting function-spanning vulnerabilities. Finally, we verify whether compiling a benchmark dataset compromises an experiment's soundness by inadvertently leaking label information.
We propose ROMEO, a publicly available, reproducible and reusable binary vulnerability detection benchmark dataset derived from the synthetic Juliet test suite. Alongside, we introduce a simple text-based assembly language representation that includes context for function-spanning vulnerability detection and semantics to detect high-level vulnerabilities. It is constructed by disassembling the .text segment of the respective binaries.
We evaluate an x86 assembly language representation of the compiled dataset, combined with an off-the-shelf classifier. It compares favorably to state-of-the-art methods, including those operating on the full C/C++ code. Including context information using the call graph improves detection of function-spanning vulnerabilities. There is no label information leaked during the compilation process.
△ Less
Submitted 6 March, 2023; v1 submitted 13 December, 2021;
originally announced December 2021.
-
Domain Adaptation and Active Learning for Fine-Grained Recognition in the Field of Biodiversity
Authors:
Bernd Gruner,
Matthias Körschens,
Björn Barz,
Joachim Denzler
Abstract:
Deep-learning methods offer unsurpassed recognition performance in a wide range of domains, including fine-grained recognition tasks. However, in most problem areas there are insufficient annotated training samples. Therefore, the topic of transfer learning respectively domain adaptation is particularly important. In this work, we investigate to what extent unsupervised domain adaptation can be us…
▽ More
Deep-learning methods offer unsurpassed recognition performance in a wide range of domains, including fine-grained recognition tasks. However, in most problem areas there are insufficient annotated training samples. Therefore, the topic of transfer learning respectively domain adaptation is particularly important. In this work, we investigate to what extent unsupervised domain adaptation can be used for fine-grained recognition in a biodiversity context to learn a real-world classifier based on idealized training data, e.g. preserved butterflies and plants. Moreover, we investigate the influence of different normalization layers, such as Group Normalization in combination with Weight Standardization, on the classifier. We discovered that domain adaptation works very well for fine-grained recognition and that the normalization methods have a great influence on the results. Using domain adaptation and Transferable Normalization, the accuracy of the classifier could be increased by up to 12.35 % compared to the baseline. Furthermore, the domain adaptation system is combined with an active learning component to improve the results. We compare different active learning strategies with each other. Surprisingly, we found that more sophisticated strategies provide better results than the random selection baseline for only one of the two datasets. In this case, the distance and diversity strategy performed best. Finally, we present a problem analysis of the datasets.
△ Less
Submitted 22 October, 2021;
originally announced October 2021.
-
Charging dynamics of dopants in helium nanoplasmas
Authors:
Andreas Heidenreich,
Barbara Grüner,
Dominik Schomas,
Frank Stienkemeier,
Siva Rama Krishnan,
Marcel Mudrich
Abstract:
We present a combined experimental and theoretical study of the charging dynamics of helium nanodroplets doped with atoms of different species and irradiated by intense near-infrared (NIR) laser pulses (<10^15 Wcm-2). In particular, we elucidate the interplay of dopant ionization inducing the ignition of a helium nanoplasma, and the charging of the dopant atoms driven by the ionized helium host. M…
▽ More
We present a combined experimental and theoretical study of the charging dynamics of helium nanodroplets doped with atoms of different species and irradiated by intense near-infrared (NIR) laser pulses (<10^15 Wcm-2). In particular, we elucidate the interplay of dopant ionization inducing the ignition of a helium nanoplasma, and the charging of the dopant atoms driven by the ionized helium host. Most efficient nanoplasma ignition and charging is found when do** helium droplets with xenon atoms, in which case high charge states both of helium (He2+) and of xenon (Xe^21+) are detected. In contrast, only low charge states of helium and dopants are measured when do** with potassium and calcium atoms. Classical molecular dynamics simulations which include focal averaging generally reproduce the experimental results and provide detailed insights into the correlated charging dynamics of guest and host clusters.
△ Less
Submitted 14 December, 2016;
originally announced December 2016.
-
Efficiency of Dopant-Induced Ignition of Helium Nanoplasmas
Authors:
A. Heidenreich,
B. Gruener,
M. Rometsch,
S. R. Krishnan,
F. Stienkemeier,
M. Mudrich
Abstract:
Helium nanodroplets irradiated by intense near-infrared laser pulses ignite and form highly ionized nanoplasmas even at laser intensities where helium is not directly ionized by the optical field, provided the droplets contain a few dopant atoms. We present a combined theoretical and experimental study of the He nanoplasma ignition dynamics for various dopant species. We find that the efficiency o…
▽ More
Helium nanodroplets irradiated by intense near-infrared laser pulses ignite and form highly ionized nanoplasmas even at laser intensities where helium is not directly ionized by the optical field, provided the droplets contain a few dopant atoms. We present a combined theoretical and experimental study of the He nanoplasma ignition dynamics for various dopant species. We find that the efficiency of dopants to ignite a nanoplasma in helium droplets strongly varies and mostly depends on (i) the pick-up process, (ii) the number of free electrons each dopant donates upon ionization, and remarkably, (iii) by the hitherto unexplored effect of the dopant location in or on the droplet.
△ Less
Submitted 29 March, 2016;
originally announced March 2016.
-
Formation and relaxation of RbHe exciplexes on He nanodroplets studied by femtosecond pump and picosecond probe spectroscopy
Authors:
C. Giese,
T. Mullins,
B. Gruener,
M. Weidemueller,
F. Stienkemeier,
M. Mudrich
Abstract:
Vibrationally resolved photoionization spectra of RbHe exciplexes forming on He nanodroplets are recorded using femtosecond pump-probe spectroscopy with amplitude-shaped probe pulses. The time-evolution of the spectra reveals an exciplex formation time ~10ps followed by vibrational relaxation extending up to >1ns. This points to an indirect, time-delayed desorption process of RbHe off the He surfa…
▽ More
Vibrationally resolved photoionization spectra of RbHe exciplexes forming on He nanodroplets are recorded using femtosecond pump-probe spectroscopy with amplitude-shaped probe pulses. The time-evolution of the spectra reveals an exciplex formation time ~10ps followed by vibrational relaxation extending up to >1ns. This points to an indirect, time-delayed desorption process of RbHe off the He surface.
△ Less
Submitted 14 September, 2012;
originally announced September 2012.
-
Imaging spectroscopy of rubidium atoms attached to helium nanodroplets
Authors:
L. Fechner,
B. Gruener,
A. Sieg,
C. Callegari,
F. Ancilotto,
F. Stienkemeier,
M. Mudrich
Abstract:
Highly excited states of rubidium (Rb) atoms attached to helium (He) nanodroplets are studied by two-photon ionization spectroscopy in combination with electron and ion imaging. Photoion spectra and angular distributions are in good agreement with a pseudodiatomic model for the RbHe_N complex. Repulsive interactions in the excited states entail fast dissociation followed by ionization of free Rb a…
▽ More
Highly excited states of rubidium (Rb) atoms attached to helium (He) nanodroplets are studied by two-photon ionization spectroscopy in combination with electron and ion imaging. Photoion spectra and angular distributions are in good agreement with a pseudodiatomic model for the RbHe_N complex. Repulsive interactions in the excited states entail fast dissociation followed by ionization of free Rb atoms as well as of RbHe and RbHe_2 exciplexes. Nonresonant excitation generates Rb atoms in low-lying electronic levels by statistical evaporation-like desorption.
△ Less
Submitted 11 September, 2011;
originally announced September 2011.
-
Vibrational relaxation and dephasing of Rb2 attached to helium nanodroplets
Authors:
Barbara Grüner,
Martin Schlesinger,
Philipp Heister,
Walter T. Strunz,
Frank Stienkemeier,
Marcel Mudrich
Abstract:
The vibrational wave-packet dynamics of diatomic rubidium molecules (Rb2) in triplet states formed on the surface of superfluid helium nanodroplets is investigated both experimentally and theoretically. Detailed comparison of experimental femtosecond pump-probe spectra with dissipative quantum dynamics simulations reveals that vibrational relaxation is the main source of dephasing. The rate consta…
▽ More
The vibrational wave-packet dynamics of diatomic rubidium molecules (Rb2) in triplet states formed on the surface of superfluid helium nanodroplets is investigated both experimentally and theoretically. Detailed comparison of experimental femtosecond pump-probe spectra with dissipative quantum dynamics simulations reveals that vibrational relaxation is the main source of dephasing. The rate constant for vibrational relaxation in the first excited triplet state is found to be constant ~0.5ns^-1 for the lowest vibrational levels v< 15 and to increase sharply when exciting to higher energies.
△ Less
Submitted 21 February, 2011; v1 submitted 3 November, 2010;
originally announced November 2010.
-
Integrated Atom Detector Based on Field Ionization near Carbon Nanotubes
Authors:
B. Grüner,
M. Jag,
A. Stibor,
G. Visanescu,
M. Häffner,
D. Kern,
A. Günther,
J. Fortágh
Abstract:
We demonstrate an atom detector based on field ionization and subsequent ion counting. We make use of field enhancement near tips of carbon nanotubes to reach extreme electrostatic field values of up to 9x10^9 V/m, which ionize ground state rubidium atoms. The detector is based on a carpet of multiwall carbon nanotubes grown on a substrate and used for field ionization, and a channel electron mu…
▽ More
We demonstrate an atom detector based on field ionization and subsequent ion counting. We make use of field enhancement near tips of carbon nanotubes to reach extreme electrostatic field values of up to 9x10^9 V/m, which ionize ground state rubidium atoms. The detector is based on a carpet of multiwall carbon nanotubes grown on a substrate and used for field ionization, and a channel electron multiplier used for ion counting. We measure the field enhancement at the tips of carbon nanotubes by field emission of electrons. We demonstrate the operation of the field ionization detector by counting atoms from a thermal beam of a rubidium dispenser source. By measuring the ionization rate of rubidium as a function of the applied detector voltage we identify the field ionization distance, which is below a few tens of nanometers in front of nanotube tips. We deduce from the experimental data that field ionization of rubidium near nanotube tips takes place on a time scale faster than 10^(-10)s. This property is particularly interesting for the development of fast atom detectors suitable for measuring correlations in ultracold quantum gases. We also describe an application of the detector as partial pressure gauge.
△ Less
Submitted 6 November, 2009;
originally announced November 2009.
