dependency analysis

Industrial applications heavily rely on open-source libraries, yet stalled community maintenance frequently leaves vulnerabilities unpatched for extended periods, posing critical software supply chain security risks. Existing approaches suffer from label scarcity, sparse feature representations, and incomplete modeling of transitive dependency relationships, hindering practical deployment in industrial settings. This paper proposes the first maintenance-activity monitoring framework that jointly models direct and transitive dependencies. It constructs fine-grained maintenance metrics from multi-source repository metadata—including commits, releases, issues, and pull requests—and introduces a graph propagation model to quantify the cross-dependency transmission of maintenance decay. Crucially, the method operates without manual labeling. Evaluated across multiple enterprise projects, it achieves early warning of high-risk stagnant libraries 3–6 months in advance, substantially reducing manual auditing effort and significantly enhancing the security and maintainability of open-source dependency ecosystems.

Java lacks runtime dependency introspection capabilities, hindering dynamic integrity verification in software supply chain security. To address this, we propose Classport, the first Java platform solution enabling configuration-free runtime dependency awareness. Classport leverages bytecode instrumentation to embed dependency metadata into class files at compile time and exploits the JVM’s class loading mechanism to dynamically extract and query actually loaded dependencies at runtime. This approach avoids false positives from static analysis and false negatives caused by reflection-based invocations, supporting fine-grained, on-demand dependency provenance. Evaluated on six real-world projects, Classport achieves 100% accuracy in identifying actively loaded runtime dependencies. It provides a lightweight, reliable, and deployable runtime assurance mechanism for software supply chain security—requiring no external configuration, toolchain modifications, or developer intervention.

Taint analysis faces two key challenges: heavy reliance on manual annotation of third-party libraries and poor scalability due to the prohibitively large size of whole-program dependency graphs. This paper proposes a language-agnostic, explicit data-dependency graph construction method enabling efficient taint analysis for large-scale programs. Our contributions are threefold: (1) the first taint propagation mechanism supporting *incremental library annotation*—i.e., adding or refining library function specifications *without re-analyzing the entire program*; (2) a lightweight, cross-language intermediate representation for data dependencies; and (3) a flow-sensitive but context-insensitive over-approximation model built atop Joern, balancing precision and performance. Evaluation demonstrates substantial improvements in analysis speed and scalability, making the approach suitable for CI/CD integration. The implementation is open-sourced and integrated into Joern, advancing practical, automated vulnerability detection.

To address the challenges of root cause localization in complex software systems—particularly susceptibility to spurious correlations and incomplete domain expertise—this paper proposes a causal graph modeling method that integrates partial domain knowledge. We introduce a novel four-stage framework: (1) initial causal structure learning via PC/GES variants; (2) reliability enhancement of causal edges using graph neural networks; (3) redundancy elimination through counterfactual reasoning; and (4) lightweight domain knowledge injection, enabling analysts to initiate analysis with only localized expert priors. Evaluated on both synthetic and real-world industrial datasets, our approach achieves a 27.3% improvement in root cause localization accuracy and reduces average causal path length by 41%, outperforming state-of-the-art causal discovery and correlation-based methods. The framework has been deployed in a cloud platform’s performance operations system.

Existing program behavior prediction models struggle to effectively capture dynamic inter-statement dependencies, limiting their performance in code coverage prediction and runtime error detection. To address this, we propose a dual-path joint modeling framework: (1) a static path that encodes control dependencies via control flow graphs (CFGs) and graph neural networks; and (2) a dynamic path that learns temporal execution dependencies from program execution traces. Crucially, we introduce node-level dual-path embedding to enable fine-grained, unified representation of both static and dynamic dependencies. To the best of our knowledge, this is the first work to jointly and coherently model static control-flow dependencies and dynamic execution-time dependencies within a single framework. Evaluated on code coverage prediction and runtime error localization tasks, our approach achieves significant improvements over state-of-the-art methods—yielding a 12.3% gain in prediction accuracy and an 18.7% increase in error localization precision.

Existing debugging tools excel at verifying hypotheses but struggle to support hypothesis generation, as programmers must manually reconstruct the program’s state evolution. This work proposes a novel debugging paradigm centered on complete execution traces, leveraging program tracing techniques to record and temporally visualize the actual code paths executed, rather than relying on the static structure of the source code. By presenting runtime behavior in a chronological and contextualized manner, this approach significantly enhances the comprehensibility of program execution, thereby facilitating more efficient hypothesis generation during debugging. We implement a prototype system and conduct preliminary experiments that demonstrate its effectiveness in improving program understanding efficiency, while also uncovering key challenges and promising directions for future research.

While large language models (LLMs) have shown promise in program defect analysis, their explanations lack formal guarantees, making it difficult to reliably conclude the absence of bugs. This work proposes Evident, a novel system that decouples LLMs from formal verification: the LLM generates only analysis stubs tailored to static warnings, while a formal backend rigorously verifies whether error states are unreachable. By restricting the LLM to constructing analysis context—and delegating correctness assurance to formal methods—Evident ensures semantic reliability in “no-bug” conclusions. Evaluated on 200 real-world Android kernel driver warnings, Evident accurately classified 151 cases (76%), eliminated 111 false positives with zero false negatives, and rediscovered a previously overlooked confirmed vulnerability.

Current evaluations of code-generating agents rely solely on overall pass rates, which obscure the root causes of failures. This work proposes TRAJEVAL, a novel framework that decomposes agent execution trajectories into three interpretable stages—search, read, and edit—and aligns them with reference patches to compute stage-wise precision and recall for fine-grained diagnostic insights. Analysis of 16,758 trajectories reveals both general inefficiencies and model-specific failure patterns. The proposed metrics effectively predict Pass@1 performance with a mean absolute error of 0.87–2.1%. Furthermore, integrating TRAJEVAL with a real-time feedback mechanism improves state-of-the-art model performance by 2.2–4.6 percentage points while reducing inference costs by 20–31%.

This work proposes the first unified formal framework that integrates runtime verification and model-based diagnosis, overcoming the limitations of traditional approaches that rely on disjoint toolchains and struggle to jointly support online fault detection and localization. Built upon the LOLA stream specification language, the method encodes system behavior, component health states, and observational data into a common stream-based representation. This formulation accommodates both time-invariant and transient faults and handles nondeterministic observations. By leveraging online stream processing and explicit fault semantics, the approach enables efficient, continuous end-to-end fault localization without requiring additional tools, thereby significantly enhancing the integration and practicality of runtime monitoring for complex systems.

Debugging in data-intensive programming faces significant challenges, including fragmented evidence, difficulty in discerning discrepancies between expected and observed behaviors, and the complexity of tracking state evolution across components. Through semi-structured interviews and thematic analysis, this study systematically characterizes practitioners’ debugging practices and, for the first time, identifies three core requirements: cross-artifact evidence alignment, expectation-based comparison mechanisms, and traceable state evolution. Building on these insights, the work constructs a visualization-driven design space tailored to debugging in data-intensive contexts, exposing critical gaps in existing tools and providing a theoretical foundation and clear direction for the development of future debugging aids.