Measuring similarity of software components
Methods, systems, and computer program products are included for measuring similarity between different versions of software components. An example method includes a computing device identifying one or more software components. Properties are determined corresponding to a component of the identified one or more software components. The determined properties are represented as elements of a vector. A similarity is determined between the vector and a second vector corresponding to a different version of the component. A result is provided that indicates the determined similarity.
1. A method comprising:
receiving, at a server computing device, a manifest corresponding to a software of a client computing device;
identifying, based on the manifest, a component of the software;
determining properties corresponding to the identified component;
representing the determined properties as elements of a vector corresponding to the identified component;
determining a similarity between the vector and a second vector corresponding to a second version of the identified component, wherein determining the similarity comprises determining:
a
1
-
b
1
+
a
2
-
b
2
+
…
+
a
n
-
b
n
a
1
2
+
a
2
2
+
…
+
a
n
2
*
b
1
2
+
b
2
2
+
…
+
b
n
2
wherein a 1 , a 2 , . . . a n comprise the properties that are elements of the vector, and wherein b 1 , b 2 , . . . b n comprise properties that are elements of the second vector;
comparing the determined similarity to a threshold; and
providing, by the server computing device, a result of the comparing to the client computing device, the result indicating whether to replace the identified component on the client computing device with the second version of the identified component;
wherein the properties include an amount of functions property, a security vulnerability property, and a license property.
2. The method of claim 1 , wherein the properties further include a technical debt property, a code complexity property, and an amount of lines of code property.
3. The method of claim 2 , wherein the license property indicates one or more licenses corresponding to the software component.
4. The method of claim 2 , wherein the security vulnerability property indicates an amount of security issues corresponding to the software component, and wherein the security vulnerability property is determined, at least in part, by querying a Common Vulnerabilities and Exposures (CVE) database.
5. The method of claim 2 , wherein the code complexity property is determined at least in part by an amount of keywords and an amount of nested loops included in the identified component.
6. The method of claim 1 , wherein determining the similarity includes normalizing the properties.
7. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause at least one machine to perform operations comprising:
identifying one or more components of a software;
determining properties corresponding to the identified one or more components of the software;
representing the determined properties of a component of the identified one or more components as elements of a vector;
determining a similarity between the vector and a second vector corresponding to a different version of the component, wherein determining the similarity comprises determining:
a
1
-
b
1
+
a
2
-
b
2
+
…
+
a
n
-
b
n
(
a
1
+
a
2
+
…
+
a
n
)
+
(
b
1
+
b
2
+
…
+
b
n
)
wherein a 1 , a 2 , . . . a n comprise the properties that are elements of the vector, and wherein b 1 , b 2 , . . . b n comprise properties that are elements of the second vector; and
providing a result indicating the determined similarity to a client computing device, the result indicating whether to replace the identified component on the client computing device with the different version of the identified component;
wherein the properties include a code complexity property, a security vulnerability property, and a technical debt property.
8. The non-transitory machine-readable medium of claim 7 , wherein the properties further include an amount of functions property and an amount of lines of code property.
9. The non-transitory machine-readable medium of claim 8 , wherein the security vulnerability property indicates an amount of security issues corresponding to the component.
10. The non-transitory machine-readable medium of claim 8 , wherein the complexity property is determined at least in part by an amount of keywords included in the component, and wherein the code complexity property is further determined at least in part by an amount of nested loops included in the component.
11. A system comprising:
a non-transitory memory including instructions; and
one or more hardware processors of a server computing device, the one or more hardware processors coupled to the non-transitory memory to read the instructions to cause the server computing device to perform operations comprising:
receiving, from a client computing device, a manifest corresponding to a software;
identifying, based on the manifest, one or more software components of the software;
determining properties corresponding to a software component of the identified the one or more software components;
representing the determined properties as elements of a vector corresponding to the software component;
determining a similarity between the vector and a second vector corresponding to a different version of the software component, wherein determining the similarity comprises determining:
a
1
-
b
1
+
a
2
-
b
2
+
…
+
a
n
-
b
n
a
1
2
+
a
2
2
+
…
+
a
n
2
*
b
1
2
+
b
2
2
+
…
+
b
n
2
wherein a 1 , a 2 , . . . a n comprise the properties that are elements of the vector, and wherein b 1 , b 2 , . . . b n comprise properties that are elements of the second vector;
comparing the determined similarity to a threshold;
providing, to the client computing device, a result of the comparing that indicates whether to replace the software component on the client computing device with the different version of the software component; and
wherein the properties include an amount of lines of code property, a security vulnerability property, and a license property.
12. The system of claim 11 , wherein the properties include a technical debt property, a code complexity property and an amount of functions property.
13. The system of claim 12 , wherein the security vulnerability property is determined at least in part by querying a Common Vulnerabilities and Exposures (CVE) database.
14. The system of claim 12 , wherein the code complexity property is determined at least in part by an amount of keywords and an amount of nested loops included in the software component.