JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis

Lida Zhao; Chaofan Li; Yueming Wu; Lyuye Zhang; Jiahui Wu; Chengwei Liu; Sen Chen; Yutao Hu; Zhengzi Xu; Yi Liu; Jingquan Ge; Jun Sun; Yang Liu

arXiv · 2508.02397

JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis

Lida Zhao·Chaofan Li·Yueming Wu·Lyuye Zhang·Jiahui Wu·Chengwei Liu·Sen Chen·Yutao Hu·Zhengzi Xu·Yi Liu·Jingquan Ge·Jun Sun·Yang Liu

View original source ↗Read source document ↗Export metadata ↓

Abstract

While reusing third-party libraries (TPL) facilitates software development, its chaotic management has brought great threats to software maintenance and the unauthorized use of source code also raises ethical problems such as misconduct on copyrighted code. To identify TPL reuse in projects, Software Composition Analysis (SCA) is employed, and two categories of SCA techniques are used based on how TPLs are introduced: clone-based SCA and package-manager-based SCA (PM-based SCA). Although introducing TPLs by clones is prevalent in Java, no clone-based SCA tools are specially designed for Java. Also, directly applying clone-based SCA techniques from other tools is problematic. To fill this gap, we introduce JC-Finder, a novel clone-based SCA tool that aims to accurately and comprehensively identify instances of TPL reuse introduced by source code clones in Java projects. JC-Finder achieves both accuracy and efficiency in identifying TPL reuse from code cloning by capturing features at the class level, maintaining inter-function relationships, and excluding trivial or duplicated elements. To evaluate the efficiency of JC-Finder, we applied it to 9,965 most popular Maven libraries as reference data and tested the TPL reuse of 1,000 GitHub projects. The result shows that JC-Finder achieved an F1-score of 0.818, outperforming the other function-level tool by 0.427. The average time taken for resolving TPL reuse is 14.2 seconds, which is approximately 9 times faster than the other tool. We further applied JC-Finder to 7,947 GitHub projects, revealing TPL reuse by code clones in 789 projects (about 9.89% of all projects) and identifying a total of 2,142 TPLs. JC-Finder successfully detects 26.20% more TPLs that are not explicitly declared in package managers.

Explore related subjects

cs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Lida Zhao, Chaofan Li, Yueming Wu, Lyuye Zhang, Jiahui Wu, Chengwei Liu, Sen Chen, Yutao Hu, Zhengzi Xu, Yi Liu, Jingquan Ge, Jun Sun, Yang Liu. 2025-08-04. JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis. https://arxiv.org/abs/2508.02397

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

LLM-Based Repair of Static Nullability Errors

Modern Java projects increasingly adopt static analysis tools that prevent null-pointer exceptions by treating nullness as a type property. However, integrating such tools into large, existing codebases remains a significant challenge. While annotation inference can eliminate many errors automatically, a subset of residual errors $-$ typically a mix of real bugs and false positives $-$ often persists and can only be resolved via code changes. Manually addressing these errors is tedious and error-prone. Large language models (LLMs) offer a promising path toward automating these repairs, but naively prompted LLMs often generate incorrect, contextually inappropriate edits. We present NullRepair, a system that integrates LLMs into a structured workflow for resolving the errors from a nullability checker. NullRepair's decision process follows a flowchart derived from manual analysis of 200 real-world errors. It leverages static analysis to identify safe and unsafe usage regions of symbols, using error-free usage examples to contextualize model prompts. Patches are generated through an iterative interaction with the LLM that incorporates project-wide context and decision logic. Our evaluation on 12 real-world Java projects shows that NullRepair resolves 63% of the 1,119 nullability errors that remain after applying a state-of-the-art annotation inference technique. Unlike two baselines (single-shot prompt and mini-SWE-agent), NullRepair also largely preserves program semantics, with all unit tests passing in 10/12 projects after applying every edit proposed by NullRepair, and 98% or more tests passing in the remaining two projects.

cs.SE↗

arXiv2026

Metamodel-Guided Model Generation with Layered Constraints

Large language models (LLMs) enable natural-language interaction in engineering modeling, but generated models may violate structural constraints, domain rules, or task requirements. We propose a metamodel-guided model generation method that coordinates generation-time constraints and post-generation validation. The method transforms metamodel information, uses its terminology to guide structured constraint extraction from specifications, and links constraints to metamodel elements while recording their sources in an Integrated Constraint Model (ICM). For each task, relevant constraints are bound to concrete objects, values, and references. The generation-time constraint layer (L1) restricts candidate content. The post-generation validation layer (L2) checks constructed models and serialized artifacts, and task acceptance checks retain the original requirements throughout repair. Deterministic procedures construct and serialize models, while LLMs propose candidate content and repairs. Validation uses existing domain tools and checkers written by humans with LLM assistance. Experiments cover AUTOSAR, railway models, and structured decisions in private international law. All 60 AUTOSAR generation runs passed acceptance within the declared task scope, and all 255 resulting ARXML files passed XSD validation. In a separate controlled AUTOSAR repair experiment, all 85 core fault units and 15 prespecified substitute units were restored within one repair round. A local AUTOSAR experiment recorded interventions during stepwise generation. The results support coordinating generation constraints, domain checks, and task acceptance to construct models and guide bounded repair.

cs.SE↗

arXiv2026

VeriSoftBench: Repository-Scale Formal Verification Benchmarks for Lean

Large language models have achieved striking results in interactive theorem proving, particularly in Lean. However, most benchmarks for LLM-based proof automation are drawn from mathematics in the Mathlib ecosystem, whereas proofs in software verification are developed inside definition-rich codebases with substantial project-specific libraries. We introduce VeriSoftBench, a benchmark of 500 Lean 4 proof obligations drawn from open-source formal-methods developments and packaged to preserve realistic repository context and cross-file dependencies. Our evaluation of frontier LLMs and specialized provers yields three observations. First, provers tuned for Mathlib-style mathematics transfer poorly to this repository-centric setting. Second, success is strongly correlated with transitive repository dependence: tasks whose proofs draw on large, multi-hop dependency closures are less likely to be solved. Third, providing curated context restricted to a proof's dependency closure improves performance relative to exposing the full repository, but nevertheless leaves substantial room for improvement. Our benchmark and evaluation suite are released at https://github.com/utopia-group/VeriSoftBench.

cs.SE↗