Session-based Social and Dependency-aware Software Recommendation

Abstract: With the increase of complexity of modern software, social collaborative coding and reuse of open source software packages become more and more popular, which thus greatly enhances the development efficiency and software quality. However, the explosive growth of open source software packages exposes developers to the challenge of information overload. While this can be addressed by conventional recommender systems, they usually do not consider particular constraints of social coding such as social influence among developers and dependency relations among software packages. In this paper, we aim to model the dynamic interests of developers with both social influence and dependency constraints, and propose the Session-based Social and Dependency-aware software Recommendation (SSDRec) model. This model integrates recurrent neural network (RNN) and graph attention network (GAT) into a unified framework. An RNN is employed to model the short-term dynamic interests of developers in each session and two GATs are utilized to capture social influence from friends and dependency constraints from dependent software packages, respectively. Extensive experiments are conducted on real-world datasets and the results demonstrate that our model significantly outperforms the competitive baselines.

\section{Introduction}

	The rapid development of the Internet has significantly fueled the prosperity of the software industry. According to AppBrain reports, in Q2, 2019 alone, over 2 million software was available on Google Play. Developers often need to develop high-quality software projects in a short time. When developing a software project, most developers prefer searching for mature software packages to coding from scratch. As software packages have been developed repeatedly, many bugs as well as deficiencies in the documentation have already been discovered. By reusing these packages, productivity is increased, time-to-market is reduced and overall project quality is improved.

	\par Fortunately, with the wide adoption of open source movement and social collaborative coding paradigm, more and more enterprise-class software is open sourced and developers from all over the world are making contributions to the open source community, resulting in an explosive growth of open source software packages. But this, on the other hand, makes it difficult for developers' technology choices. Thus software recommender systems are urgently needed for the development efficiency and quality guarantee.

	\par In recommender systems, collaborative filtering(e.g., Matrix Factorisation, MF) is a classic techniques \cite{rendle2012bpr, he2017neural}. Although also effective in software recommendation \cite{ichii2009software, thung2013automated, he2020diversified}, some studies show it ignores two key elements. First, developers' interests are gradually evolving \cite{jiang2020adapting}. In the whole lifetime of a software project, new features and requirements emerge all the way and developers need to keep conducting technology choices. Moreover, developers often change to another software project frequently. A developer may focus on Angular one year ago, but is interested in Vue now due to work needs. Furthermore, it's difficult to capture dynamic interests from long history behaviors \cite{song2019session, hidasi2015session}(developers' technology choices one year ago has a little influence now or even interferes with predictions). So we segment developers' actions into short sessions in which developers' interests are relatively stable and easy to model. Second, in GitHub, Stackoverflow and other communities, there are social influences among developers \cite{guy2009personalized}. When developing projects, developers tend to choose packages recommended by their friends.

	\par Although these studies can model developers' dynamic interests or social influences, we argue they ignore that social influences are also dynamic. For example, when a developer develops Vue-based project, he may be influenced more by friends who are proficient in this field. While when developing another project, he will trust others. Further, there is not only the relationship between developers but also the dependency between packages in software recommendation. Although dependency influences have been neglected, it naturally exists in software recommendation and has a huge impact on developers' technology choices. For example, when a developer have used iview, indicating he would like to develop a project based on iview, iview-admin needs to be recommended. What's more, we notice that the dependency influences are attentive. In consideration of the requirements of a dependent software and the functions of software packages it depends on, different dependency exhibits different importance.

	\par In this paper, we aim at predicting developers' technology choices based on their behaviors history. To effectively capture developers' dynamic interests, we introduce session mentioned above. What's more, social network and dependency network are also considered to model both dynamic social influences and attentive dependency influences. In summary, we address the problem of \textit{session-based software recommendation with social and dependency graph}.

	\par Figure \ref{Motivation Example} illustrates this in two sessions. Developer A's interests gradually evolve from Field Y to Field X and his technology choice is influenced by both social relationships between developers and dependency relationships between software packages. In session 1, developer A has previously chosen software package 12 which is a dependent package for both package 11 and package 16. However, from the view of attentive software dependency, package 16 is coupled more tightly to package 12 than to package 11. On the other hand, from the view of dynamic social influence, developer A's technology choice will be influenced more by similar developers in this session, that is developer D and E. Considering all these aspects, we will recommend package 16 to developer A in session 1. Then in session 2, developer A evolves his in interests slightly from Field Y to Field X, and he will pay more attention to new social and dependency relationships and finally choose package 7.

	In summary, the main contributions are listed as follows:

	\begin{figure}[htb]
		\centering
		\includegraphics[width=\linewidth]{figs/sample-virtual}
		\caption{Motivation example.}
		\label{Motivation Example}
	\end{figure}

	\begin{itemize}
		\item We jointly combine developers' evolving interests, attentive software dependency and dynamic social influence and propose a unified software recommendation framework.

		\item We extend graph attention network to multiple graphs and propose the SD-GAT for mutually learning developers' and software packages' representation.

		\item Extensive experiments are conducted on three real-world datasets and the results demonstrate the performance and effectiveness of our proposed model.
	\end{itemize}

	The rest of this survey is organized as follows. We first discuss some related works in \S \ref{RELATED WORK}. Then, we define some key concepts and formalize our problem in \S \ref{PROBLEMDEFINITION}. Further, our proposed approach is described in \S \ref{METHODOLOGIES}. Lastly, we presents the experimental results in \S \ref{EXPERIMENTS} and conclude the work in \S \ref{CONCLUSIONS}.

	\section{Related work} \label{RELATED WORK}

	We will briefly review three aspects of previous researches related to our work: 1) dynamic recommendation that models developers' dynamic interests; 2) social recommendation that considers influences in social network; 3) software recommendation that recommends software packages to developers.

	\subsection{Dynamic Recommendation} \label{Dynamic Recommendation}

	To model developers' dynamic interests, earlier works in literature propose their approaches based on Markov Chains \cite{cheng2013you}. However, Markov Chains can only model developers' latest behavior, discarding a lot of information. Therefore, recent works exploit recurrent neural network to model developers' recent behaviors. For example, Manotumruksa et al. \cite{manotumruksa2017deep} considered time information on the basis of MF, and used RNN to model developers' behaviors to enrich the representations. On the contrary, Dong et al. \cite{dong2018recurrent} performed joint optimization to train RNN and MF separately with shared model parameters in a multi-task learning framework. Furthermore, some studies apply RNN on session-based recommendation. For example, Hidasi et al. \cite{hidasi2015session} first proposed a RNN-based approach for session-based recommendations to capture developers' short-term interests within a session. Later, Wang et al. \cite{wang2019modeling} assumed that a session often serves for different purposes and proposed a mixture-channel model with attention mechanism to detect the purposes of each item. In addition to interactions intra a session, information inter sessions also attracts some researchers. For example, Ruocco et al. \cite{ruocco2017inter} exploited two RNNs to process the developers' current sessions and past sessions separately. Due to the limitation of computing resources, we only exploit RNN to model developers' current sessions and reserve information inter sessions for future work.

	\subsection{Social Recommendation} \label{Social Recommendation}

	Social network, which usually reveals and utilizes trust relationships \cite{xu2019trust}, has been widely used in recommender systems. Ma et al. \cite{2011Recommender} constrain connected nodes' latent factors similar to regularize developer representations. Zhao et al. \cite{2014Leveraging} leveraged friends' interaction as another positive feedback in Bayesian Personalized Ranking(BPR). Recently, neural network is widely used in various fields and some efforts have applied this technique to social recommendation. For example, Deng et al. \cite{deng2016deep} utilized Autoencoder to initialize vectors in MF and revamped them with both social trust ensemble and community effect. Further, with the success of Graph Neural Network (GNN)\cite{wang2019neural}, Fan et al. \cite{fan2019graph} encoded developers on social network and developer-item network through GNN and Guo et al. \cite{guo2020deep} utilized GNN to model social relations and correlations among item features. As a special case of GNN, Song et al. \cite{song2019session} utilized GAT to model dynamic social influences. Although effective, they only focus on social network and ignore dependency network in software recommendation.

	\subsection{Software Recommendation} \label{Software Recommendation}

	Due to the success of collaborative filtering in recommender systems \cite{rendle2012bpr, he2017neural}, many studies have introduced it into software recommendation. For instance, Ichii et al. \cite{ichii2009software} used collaborative filtering to recommend similar software packages to developers. Thung et al. \cite{thung2013automated} further combined association rule and collaborative filtering to mine deeper relationships between packages. He et al. \cite{he2020diversified} employed an adaptive weighting mechanism and neighborhood information to neutralize popularity bias in MF, significantly increasing diversity and accuracy of the recommendation results. What's more, some studies model either developers' evolving interests or social influences. For example, Guy et al. \cite{guy2009personalized} aggregated developer's familiarity network and similarity network to recommend social software. Jiang et al. \cite{jiang2020adapting} adopt time decay factor and operation behaviors weight to model developers' dynamic interests in a popular programming platform, Scratch. However, ignoring the data characteristics in technology choice such as dynamic social influences and attentive dependency influences usually prevents the adoption of new methods in software recommendation. To model the two important influences, we propose SD-GAT built on social network and dependency network, where the attention in graphs is unequal and depends on current context.

	\section{Problem Definition} \label{PROBLEMDEFINITION}

	\begin{table}[htb]
		\centering
		\parbox{.35\textwidth}{\caption{Summary of Main Notations}}
		\label{tab:notation}
		\begin{tabular}{c|l}
			\toprule
			Symbol&Description\\
			\midrule
			U & the set of developers\\
			I & the set of software packages\\
			$S_{T}^{u}$ & $u$'s session in time step $T$\\
			$N_{u,T}$ & the amount of software packages in $S_{T}^{u}$\\
			$N^{l}(i)$ & $i$'s $l$-hop neighbor in dependency network\\
			$N^{l}(u)$ & $u$'s $l$-hop neighbor in social network\\
			$e_{i}^{(l)}, h_{u}^{(l)}$ & the $l$-layer representation of $i$ and $u$\\
			$W_{D}^{(l)}, W_{S}^{(l)}$ & aggregation weight matrices for dependency and social network in $l$-layer\\
			$e_{i}, h_{u}$ & the final representation of $i$ and $u$\\
			$W_{TD}, W_{TS}$ & transformation matrix in dependency and social network\\
			\bottomrule
		\end{tabular}
	\end{table}

	In this section, we first describe the concept of session and formalize the problem of session-based software recommendation. Then, social network and dependency network are introduced. Finally, we formalize our problem - session-based software recommendation with social and dependency graph. Main notations will be introduced are summarized in table 1.

	\textbf{Definition 1 (Session).} A session is a set of items (i.e., software packages in our problem) that are interacted in a certain period (e.g., one week or one month). Let $U$ and $I$ denote the set of developers and software packages, respectively. Assume developer $u$ chooses $n$ packages $<i_{1}^{u},i_{2}^{u},i_{3}^{u},...,i_{n}^{u}>$ sequentially in a period of time, the $n$ packages compose a session $S^{u}$, i.e., $S^{u}=<i_{1}^{u},i_{2}^{u},i_{3}^{u},...,i_{n}^{u}>$. When developing projects, interests of developers change rapidly, resulting in modeling developers' dynamic interests from all historical behaviors is difficult. Taking this into consideration, we segment whole interaction history into several sessions. In this way, each developer's interests are relatively stable and easy to model.

	\textbf{Problem 1 (Session-based software recommendation).} There are two research directions in this problem: next-package(s) recommendation that recommends next one(some) software package(s) in current session and next-session recommendation that predicts information for the next session. In this paper, session-based software recommendation refers to next-package recommendation and others are remained for future. Given a session $S=<i_{1},i_{2},i_{3},...,i_{n}>$, the goal of it is to recommend the next software package $i_{n+1}$.

	\textbf{Definition 2 (Social network and dependency network).} In software recommendation, developers are influenced by their friends. In addition, packages are influenced by their dependency. To take advantage of these two influences, we first assume developer $u$'s friends $N(u)$ to construct social network. Notice that this network is dynamic and each node consists of a session(we can generalize it to multiple sessions but this is very resource intensive and single session is effective enough). For a target node $u$ and session $S_{T}^{u}$, each neighbor node $f$ in $N(u)$ uses his session right before time step $T$, i.e., $S_{T-1}^{f}$. Then we assume software package $i$'s dependency $N(i)$ to construct dependency network. In fact, for each developer $u$, we obtain all packages' dependency, i.e., construct complete dependency network.

	\textbf{Problem 2 (Session-based software recommendation with social and dependency network).} In our problem, each developer $u$ interacts with a temporally ordered list of sessions  $L^{u}=<S_{1}^{u},S_{2}^{u},S_{3}^{u},...,S_{|L^{u}|}^{u}>$, where $S_{t}^{u}$ is the $t$th session of developer $u$ and $|L^{u}|$ is the length of list. In time step $T$, we set $S_{T}^{u}=<i_{T,1}^{u},i_{T,2}^{u},i_{T,3}^{u},...,i_{T,N_{u,T}}^{u}>$ as an input, where $N_{u,T}$ is the length of this session. Note that both $|L|$ and $N_{u,T}$ are variable, and $T$ denotes arbitrary time step. To model dynamic social influences and attentive dependency influence, as another input, we utilize $u$'s social network and complete dependency network. As output, we predict the next package that $u$ is most likely to choose.

	\section{Methodologies} \label{METHODOLOGIES}

	\begin{figure}[htb]
		\centering
		\includegraphics[width=\linewidth]{figs/model-SSDRec}
		\caption{A schematic view of SSDRec.}
		\label{SSDRec}
	\end{figure}

	In this section, we propose a novel multi-graph model Session-based Social and Dependency-aware Recommendation, which jointly models developers’ evolving interests, attentive software dependency and dynamic social influences.
	\par SSDRec outlined in Figure \ref{SSDRec} is composed of three layers, namely, input layer, embedding propagation layer and prediction layer. First(\S \ref{InputLayer}), the input layer produces the representation of the nodes in social network and dependency network. On the one hand, this layer utilizes embedding to obtain representations of software packages and static interests of friends. On the other hand, it uses RNN to capture the dynamic interests of developers and friends from their sessions. Then(\S \ref{PropagationLayer}), the propagation layer propagates influences, i.e., representations in the two networks. Specially, a SD-GAT is used to weight the dynamic social influences and attentive dependency influences. At the final step(\S \ref{PredictionLayer}), the prediction layer combines the two influences and produces recommendation.

	\subsection{Input Layer} \label{InputLayer}

	\subsubsection{Represent software package and Its dependency} \label{Representsoftwarepackage}

	Following MF, we utilize embedding to map the software package $i$'s ID to a $E$-dimension dense real-value vector $e_{i}^{(0)}$ and obtain the representation of $i$'s dependency $e_{1}^{(0)},e_{2}^{(0)},...,e_{|N(i)|}^{(0)}$ the same way.

	\subsubsection{Represent Developer}

	To model the developer $u$’s dynamic preferences, we employ a RNN to capture the sequential associations in current session. Given a session $S_{T}^{u}=<i_{T,1}^{u},i_{T,2}^{u},i_{T,3}^{u},...,i_{T,N_{u,T}}^{u}>$, the RNN recursively combines the representations of all tokens as follow:
	\begin{equation}
		\label{RepresentUser}
		h_{t} = tanh(W_{i}i_{T,t}^{u}+W_{h}h_{t-1}+b)
	\end{equation}
	where $h_{t} \in \mathbb{R}^{H} $ is the $H$-dimension recurrent hidden output at time $t$ and $W_{i} \in \mathbb{R}^{H \times E}, W_{h} \in \mathbb{R}^{H \times H}, b\in \mathbb{R}^{H}$ represent weight and bias parameters to be learnt. As shown in Figure \ref{SSDRec}, we represent developer's interests with the final output of RNN $h_{n}$. While SSDRec adopts LSTM units in practice, it is flexible to plug in other recurrent units, e.g., GRU.

	\subsubsection{Represent Friends} \label{Represent Friends}

	We consider friends' two interests: dynamic interests that represent recent interests and static interests that represent long-term and average interests.

	\emph{Dynamic interests:} For a target developer $u$, given his session $S_{T}^{u}$ in time step $T$, his friends' sessions in $T-1$ are selected as their visible actions. After adopting friend $f$'s session $S_{T-1}^{f}$, we use RNN to model $f$'s dynamic interest $s_{f}^{d}$:
	\begin{equation}
		\label{RepresentFriendsdynamic}
		s_{f}^{d}=RNN(S_{T-1}^{f})
	\end{equation}
	Notice that we reuse RNN representing developers to represent friends by enforcing the two RNNs share the same weight parameters.

	\emph{Static interests:} Similar to \S \ref{Representsoftwarepackage}, for each friend $f$, we use embedding to model the static interests $s_{f}^{s} \in \mathbb{R}^{E}$ \footnote{We simply set the dimension of developer representations equal to package representations, but our model can be modified to distinguish the dimensions easily.}.

	Finally, we represent friends by concatenating friends' dynamic and static interests with a non-linear transformation:
	\begin{equation}
		\label{RepresentFriends}
		h_{f}=ReLU(W_{f} \dot (s_{f}^{d} \parallel s_{f}^{s}))
	\end{equation}
	where $\parallel$ is the concatenation operation of two vectors and $W_{f}$ is the transformation matrix.

	\subsection{Propagation Layer} \label{PropagationLayer}

	Recent works like \cite{wang2019neural, fan2019graph, guo2020deep} have demonstrated the convincing performance of performing GNN on recommender systems. Despite their effectiveness, we argue that they can't model dynamic social influences in social network and attentive dependency influences in dependency network. To propagate the influences in the two networks, we extend graph attention network to multiple graphs and propose SD-GAT, which is shown in Fig. \ref{SSDRec}. When the type of the target node is "package", the left dependency-oriented GAT will be used to propagate attentive dependency influences. Otherwise, the right social-oriented GAT is adopted to propagate dynamic social influences. These two parts work on two network and adopt different transformation functions. In this way, we can model both dynamic social influences and attentive dependency influences.

	\subsubsection{Graph construction} \label{Graph construction}

	For each software package, we build a graph that includes $|N(i)|+ 1$ nodes, where nodes correspond to that software package and its dependency. In this graph, software package node $i$ and its neighbors $N(i)$ is directly set to $e_{i}^{(0)}$ and $e_{1}^{(0)},e_{2}^{(0)},...,e_{|N(i)|}^{(0)}$. For each developer, we also build a graph that includes $|N(u)|+1$ nodes. Similarly, we use developer $u$'s dynamic preferences $h_{n}$ and his friend $f$'s preference $h_{f}$ to represent node $u$ and its neighbor $f$, i.e., $h_{u}^{(0)}=h_{n},h_{f}^{(0)}=h_{f},f\in N(u)$. It should be noted that, unlike the software package node representation remaining unchanged in $S_{T}^{u}$, the representation of developer node will be updated whenever he chooses a new software package during time step $T$.

	\subsubsection{Message Propagation} \label{Message Propagation}

	Intuitively, the dependency that is dependent on a software package can be treated as the package's features; analogously, friends provide evidence of developer's interest. We build upon this basis to propagate item representations between software package and its dependency as well as developer representations between developer and friends. Although graph convolutional networks \cite{kipf2017semi} is widely used to propagate information in graph, it treats all neighbors equally using method like symmetric normalized Laplacian. Instead, we employ graph attention network \cite{Velikovi2018Graph}, which use attention mechanism to distinguish the influences in the two graphs. There are two major operations in graph attention network: message construction and message aggregation.

	\emph{Message construction:} For software package $i$, we use attention mechanism to measure the influences of its dependency. Firstly, we calculate the attention score $a_{ij}^{(0)}$ between the target node representation $e_{i}^{(0)}$ and all of its one-hop neighbors’ representations $e_{1}^{0},e_{2}^{0},...,e_{|N(i)|}^{0}$:
	\begin{equation}
		\label{attentionscoredependency0}
		a_{ij}^{(0)}=f(e_{i}^{(0)}, e_{j}^{(0)}), j\in N(i)\cup {i}
	\end{equation}
	In particular, $f(e_{i}^{(0)}, e_{j}^{(0)})=e_{i}^{(0)^T}e_{j}^{(0)}$ represents inner production, a similarity function between two elements. Notice that we also use self-attention to preserve $i$' representation here. After adopt attention score, we calculate attention weight with softmax function:
	\begin{equation}
		\label{attentioncoefficientdependency0}
		\alpha_{ij}^{(0)}=\frac{exp(a_{ij}^{(0)})}{\sum_{k\in N(i)\cup {i}}exp(a_{ik}^{(0)})}, j\in N(i)
	\end{equation}
	intuitively, $\alpha_{ij}^{(0)}$ is the level of influence of dependency $j$ on software package $i$ (conditioned on layer 0). Finally, we define message from $j$ to $i$ as:
	\begin{equation}
		\label{Messagedependency0}
		m_{i\gets j}^{(0)}=\alpha_{ij}^{(0)}e_{j}^{(0)}, j\in N(i)\cup {i}
	\end{equation}
	Analogously, for developer $u$, the message that one-hop neighbors propagate can be represented by:
	\begin{equation}
		\label{Messagesocial0}
		m_{u\gets f}^{(0)}=\alpha_{uf}^{(0)}h_{f}^{(0)}, f\in N(u)\cup {u}
	\end{equation}
	where $\alpha_{uf}^{(0)}=Softmax(f(h_{u}^{(0)}, h_{f}^{(0)}))$.

	\emph{Message Aggregation:} With the message defined as above, we then combine the target node and its neighbors to update its representation. The first-layer software package representation $e_{i}^{(1)}$ and developer representation $h_{u}^{(1)}$ are defined as follows:
	\begin{equation}
		\label{MessageAggregationdependency0}
		e_{i}^{(1)}=ReLU(W_{D}^{(1)}\cdot\sum_{j\in N(i)\cup {i}}m_{i\gets j}^{(0)})
	\end{equation}
	\begin{equation}
		\label{MessageAggregationsocial0}
		h_{u}^{(1)}=ReLU(W_{S}^{(1)}\cdot\sum_{f\in N(u)\cup {u}}m_{u\gets f}^{(0)})
	\end{equation}
	where $W_{D}^{(1)} \in \mathbb{R}^{E \times E}$ and $W_{S}^{(1)}\in \mathbb{R}^{H \times H}$ denote the aggregation weight matrices for dependency network and social network, respectively.

	\subsubsection{High-order Propagation} \label{High-order Propagation}

	We can further obtain the high-order connectivity information of each node by stacking this attention layer. Specifically, when we stack $l$ layers, the representation of software package $i$ and developer $u$ are recursively formulated as:
	\begin{equation}
		\label{MessageAggregationdependencyl}
		e_{i}^{(l)}=ReLU(W_{D}^{(l)}\cdot\sum_{j\in N(i)\cup {i}}\alpha_{ij}^{(l-1)}e_{j}^{l-1})
	\end{equation}
	\begin{equation}
		\label{MessageAggregationsociall}
		h_{u}^{(l)}=ReLU(W_{S}^{(l)}\cdot\sum_{f\in N(u)\cup {u}}\alpha_{uf}^{(l-1)}h_{f}^{l-1})
	\end{equation}
	where $W_{D}^{(l)} \in \mathbb{R}^{E \times E}$ and $W_{S}^{(l)} \in \mathbb{R}^{H \times H}$ are the trainable transformation matrices in layer $l$, the $\alpha^{(l-1)}$ guiding message propagation in the $l-1$ layer is defined as follows:
	\begin{equation}
		\label{attentioncoefficientdependencyl}
		\alpha_{ij}^{(l-1)}=Softmax(f(e_{i}^{(l-1)}, e_{j}^{(l-1)})), j\in N(i)\cup {i}
	\end{equation}
	\begin{equation}
		\label{attentioncoefficientsociall}
		\alpha_{uf}^{(l-1)}=Softmax(f(h_{u}^{(l-1)}, h_{f}^{(l-1)})), f\in N(u)\cup {u}
	\end{equation}

	\subsection{Prediction Layer} \label{PredictionLayer}

	After propagating with $L$ layers, we obtain the merged representation of software package $i$, namely $e_{i}^{(L)}$. Since a package's features depends on both its origin function and attentive dependency influences, we combine them with a fully-connected layer to constitute the final representation $e_{i} \in \mathbb{R}^{E}$:
	\begin{equation}
		\label{itemfinalrepresentation}
		e_{i}=W_{TD}\cdot(e_{i}^{(0)}\parallel e_{i}^{(L)})
	\end{equation}
	where $W_{TD} \in \mathbb{R}^{E \times 2E}$ is a linear transformation matrix in dependency network. For developer $u$, the formulations are similar for combine developers' evolving interests and dynamic social influences:
	\begin{equation}
		\label{userfinalrepresentation}
		h_{u}=W_{TS}\cdot(h_{u}^{(0)}\parallel h_{u}^{(L)})
	\end{equation}
	where $W_{TS} \in \mathbb{R}^{E \times 2H}$ is transformation matrix in social network, and $h_{u} \in \mathbb{R}^{E}$ indicates developer $u$'s current interest.

	Finally, we conduct the softmax to estimate the probability that developer $u$ will choose software package $i$:
	\begin{equation}
		\label{predictpossibility}
		p(i|S_{T}^{u})=\frac{exp(h_{u}^{T}e_{i})}{\sum_{z=1}^{|I|}exp(h_{u}^{T}e_{z})}
	\end{equation}
	where $|I|$ is total number of packages and $T$ represent transposition.

	\subsection{Train} \label{Train}
	To learn model parameters, we maximize the log-likelihood of the observed packages in all sessions:
	\begin{equation}
		\sum_{u\in U}\sum_{t=2}^{T}\sum_{n=1}^{N_{u,T}-1}log(p(i^{u}_{t,n+1}|i^{u}_{t,1},...,i^{u}_{t,n}))
	\end{equation}
	where $U$ denotes all developers. Notice that SSDRec model utilizes an iterative method to update developer representations, which can increase the size of training set and reduce the cost of updating (some state-of-the-art approaches, such as NCF \cite{he2017neural}, need to build a new developer-package matrix for any new interaction).

	\subsection{Time Complexity Analysis} \label{TimeComplexityAnalysis}
	Assume batch size $B$ and we calculate the time complexity of a batch. In input layer, embedding and RNN is the main operation. According to \cite{hochreiter1997long}, the complexity of an LSTM unit is $O(H^{2} + H \times E)$. Thus, input layer has computational complexity $O(B \times N^{2} \times (H^{2} + H \times E))$, where $N$ denotes the length of a session. In propagation layer, we first compute the complexity of each layer for a session. For dependency network, complexity of $l$-th layer is $O(\sum_{i=1}^{|I|} |N^{l}(i)| \times E^{2})$. For social network, the complexity is $O(\sum_{r=1}^{l} |N^{r}(i)| \times H^{2})$. As we only use the dependency network once in a batch, the overall complexity for propagation layer is $O(\sum_{l=1}^{L}(\sum_{i=1}^{|I|} |N^{l}(i)| \times E^{2} + B \times N \times \sum_{r=1}^{l} |N^{r}(i)| \times H^{2}))$. In prediction layer, the time complexity of transformation and softmax is $O(B \times (2H \times E + |I| \times E) + 2E^{2})$. Therefore, the overall complexity of SSDRec can be simplified to $O(B \times N^{2} \times (H^{2} + H \times E) + \sum_{l=1}^{L}(\sum_{i=1}^{|I|} |N^{l}(i)| \times E^{2} + B \times N \times \sum_{r=1}^{l} |N^{r}(i)| \times H^{2}))$.

	\section{Experiments} \label{EXPERIMENTS}

	In this section, we conduct experiments to answer the following research questions:
	\begin{itemize}
		\item{RQ1} Does SSDRec outperform state-of-the-art methods on all experimental settings?
		\item{RQ2} Do the components of the SSDRec enhance the effectiveness by (a) modeling dynamic social influences and attentive dependency influences, (b) capturing friends' dynamic and static interests.
		\item{RQ3} How do some hyper-parameters (e.g., neighborhood sample sizes, segmentation strategies of session) affect the performance of SSDRec?
	\end{itemize}

	In the remainder of this section, we will first describe the experimental settings (\S \ref{Setup}) and then answer the above three research questions(\S \ref{Comparison}, \S \ref{Ablation}, \S \ref{parameters}). Final, some illustrative examples is given (\S \ref{Visualization}).

	\subsection{Experimental Setup} \label{Setup}

	\subsubsection{Datasets}

	We conduct experiments mainly on GitHub \cite{Gousi13}, a software hosting platform and open source cooperative community specially designed for programmers. In GitHub, developers can watch software packages and the behaviors are segmented into sessions. We also obtain follow relationship as social network. However, there is no obvious dependency between pakcages on GitHub. Thus, we combine GitHub and Libraries, an online search repository that contains dependency between software packages, to construct a new dataset. Then, to make the experimental results more accurate and reliable, we divide the new dataset according to language. Finally, we choose three biggest datasets as follows: 1) PHP, a server-side scripting language, is commonly used for website programming; 2) Ruby, a completely object-oriented language, is suitable for rapid development; 3) JavaScript, a very popular language with cross-platform features.

	\subsubsection{Preprocessing}

	To ensure that each developer in datasets focuses on social network, we filer out developers with fewer than $m$ friends. Then, to cater sufficient information about each friend and software package, we ensure that each developer is followed by at least $n$ times and each package is watched by at least $k$ developers. Due to different size of datasets, we set $m=20, 50, 100; n=50, 100, 200; k=20, 20, 50$ for PHP, Ruby and JavaScript respectively. Additionally, we segment all datasets into week-long sessions and filer out sessions with fewer than 2 packages or more than 30 packages following \cite{song2019session}. To split datasets for train, validation and test, for each developer, we reserve about two years (104 weeks)'s sessions and randomly split them into validation/test sets. Note that when splitting dataset, we ensure all packages in validation/test sets appear in train set. Descriptive statistics for all datasets after preprocessed are shown in Table \ref{tab:dataset}.

	\begin{table}[htb]
		\caption{Descriptive statistics of our three data sets.}
		\label{tab:dataset}
		\begin{tabular}{lccc}
			\toprule
			Dataset&PHP&Ruby&JavaScript\\
			\midrule
			$\#$ Developers & 7,095 & 5,935 & 8,144\\
			$\#$ Software packages & 1,402 & 1,487 & 2,282\\
			$\#$ Events & 118,256 & 116,832 & 436,409\\
			\hline
			Avg. friends/developer & 8.59 & 13.05 & 16.24\\
			Avg. dependency/packages & 4.56 & 5.09 & 10.09\\
			Avg. session length & 2.95 & 3.13 & 3.25\\
			\bottomrule
		\end{tabular}
	\end{table}

	\subsubsection{Parameter Settings.}

	We implement our model based on TensorFlow \cite{abadi2016tensorflow}. Adam \cite{kingma2014adam} is chosen as optimizer and optimization parameters are set as suggested in \cite{abadi2016tensorflow}. In this environment, our model is trained in 20 epochs of batch size 200 and dropout \cite{srivastava2014dropout} with 0.2 is applied. For all models, the dimensions of package representations and hidden vectors are fixed to 100. Both in social and dependency networks, we set number of layers $L = 2$ and sample 10 one-hop neighbors and 5 two-hop neighbors as recommended in \cite{hamilton2017inductive}.

	\subsubsection{Baselines.}

	We compare SSDRec to the following baselines:
	\begin{itemize}
		\item BPR \cite{rendle2012bpr}: a classical MF-based method optimized with a ranking objective.
		\item NCF \cite{he2017neural}: uses neural network instead of inner product to model relationship between developers and items of MF.
		\item RNN \cite{hidasi2015session}: captures developers' session-level dynamic interests with RNN.
		\item DGRec \cite{song2019session}: a state-of-the-art model for session-based social recommendation. It utilizes RNN and GAT to model dynamic interests and dynamic social influences.
	\end{itemize}

	\subsubsection{Evaluation Metrics}

	For all models, their recommendation effectiveness is evaluated by two well-known metrics: $Hit Rate (HR)@K$ and $Normalized Discounted Cumulative Gain (NDCG)@K$.

	\emph{$HR@K$} emphasizes the accuracy of prediction, measures the proportion of watched packages in K-length truncated ranked list. It can be formulated as:
	\begin{equation}
		HR@K=\frac{\sum_{u \in U}|R_{K}(u) \cap T(u)|}{|U|}
	\end{equation}
	where $R_{K}(u)$ is top-K recommended packages, $T(u)$ is the software packages developers actually watch.

	\emph{$NDCG@K$} emphasizes the sequence of recommendation, measures the position watched packages are placed in. It can be formulated as:
	\begin{equation}
		NDCG@K=\frac{1}{|U|}\sum_{u \in U}\frac{1}{log_{2}(1+pos(T(u)))}
	\end{equation}
	where $pos(T(u))$ represents the rank of watched packages. It's obvious that the higher position that positive packages are placed in, the higher $NDCG@K$ is. Note that because developers don't have the patience to flip through the entire list, $NDCG@K$ is equal to 0 when $pos(T(u))>K$.

	\subsection{Perfomance Comparison(RQ1)} \label{Comparison}

	\begin{table}[htb]
		\centering
		\caption{Performance in terms of $HR$ and $NDCG$ between various approaches. The best performing result is highlighted in bold and the improve rate of best result over second best result is also be shown.}
		\label{tab:comparision}
		\begin{tabular}{cccccccc}
			\toprule
			\multirow{2}{*}{Dataset} & \multirow{2}{*}{Model} & \multicolumn{3}{c}{$HR@K$($\%$)} & \multicolumn{3}{c}{$NDCG@K$($\%$)}\\
			&& 10 & 20 & 50 & 10 &  20 & 50\\
			\midrule
			\multirow{6}{*}{PHP} &
			BPR & 3.33 & 6.68  & 15.33 & 1.36 & 2.20 & 3.90 \\
			& NCF & 4.59 & 8.09 & 17.77 & 2.10 & 2.98 & 4.88 \\
			& RNN & 9.72 & 16.14 & 28.80 & 4.64 & 6.31 & 8.85 \\
			& DGRec & 11.07 & 17.29 & 29.64 & 5.37 & 7.04 & 9.55 \\
			& SSDRec & \textbf{11.95} & \textbf{18.93} & \textbf{31.13} & \textbf{5.88} & \textbf{7.74} & \textbf{10.22} \\
			\hline
			& Improve rate (\%) & 7.97 & 9.44 & 5.02 & 9.49 & 9.96 & 6.98 \\
			\hline
			\multirow{6}{*}{Ruby} &
			BPR & 2.07 & 3.81 & 9.74 & 0.93 & 1.36 & 2.52 \\
			& NCF & 2.91 & 5.39 & 12.61 & 1.37 & 1.98 & 3.39 \\
			& RNN & 6.24 & 9.79 & 19.04 & 3.23 & 4.17 & 6.01 \\
			& DGRec & 7.00 & 10.86 & 20.73 & 3.68 & 4.70 & 6.68 \\
			& SSDRec & \textbf{7.63} & \textbf{12.05} & \textbf{21.98} & \textbf{4.01} & \textbf{5.19} & \textbf{7.17} \\
			\hline
			& Improve rate (\%) & 9.08 & 10.96 & 6.02 & 8.93 & 10.40 & 7.43 \\
			\hline
			\multirow{6}{*}{JavaScript} &
			BPR & 2.12 & 3.86 & 8.23 & 0.95 & 1.38 & 2.24 \\
			& NCF & 2.33 & 3.98 & 8.97 & 1.08 & 1.49 & 2.47 \\
			& RNN & 4.57 & 7.72 & 15.00 & 2.17 & 2.99 & 4.45 \\
			& DGRec & 5.26 & 8.87 & 17.58 & 2.53 & 3.47 & 5.22 \\
			& SSDRec & \textbf{5.70} & \textbf{9.73} & \textbf{18.47} & \textbf{2.65} & \textbf{3.73} & \textbf{5.48}\\
			\hline
			& Improve rate (\%) & 8.32 & 9.71 & 5.05 & 5.02 & 7.52 & 4.92 \\
			\bottomrule
		\end{tabular}
	\end{table}

	Table \ref{tab:comparision} shows the comparison between five recommendation methods when generating top-$K$ recommendation. It can be seen from the table that: 1) SSDRec achieves the best performance on three datasets by considering developers' evolving interests, dynamic social influences and attentive dependency influences in software recommendation. 2) The models based on RNN have much higher $HR$ and $NDCG$ than other methods(on average, the worst RNN-based model RNN outperforms the best conventional model NCF by 97.17$\%$). The reason may be that the interests of developers in the computer industry change frequently, and the dynamic interests of developers have much impact on their behaviors. 3) The prediction accuracy of DGRec and SSDRec that consider dynamic social influences are generally high, which proves that modeling such influences is necessary.

	\subsection{Ablation Studies(RQ2)} \label{Ablation}

	To demonstrate the usefulness of different components, we compare the performance of variants of SSDRec.

	\subsubsection{Effect of social network and dependency network(RQ2(a))}

	\begin{table}[htb]
		\caption{Variants of SSDRec that only consider one network. SSDRec-social ignores the dependency network and SSDRec-dependency ignores the social network. Note that when ignoring the dependency network, SSDRec-social is identical to DGRec.(Here the function of $W_{T}$ transforms the dimension of developer from $H$ to $E$)}
		\label{tab:variantofnetwork}
		\begin{tabular}{l c}
			\toprule
			Variants&Modification\\
			\midrule
			SSDRec-social & Eq.(\ref{itemfinalrepresentation}) $\rightarrow$ $e_{i}=e_{i}^{(0)}$ \\
			SSDRec-dependency & Eq.(\ref{userfinalrepresentation}) $\rightarrow$ $h_{u}=W_{T} \cdot h_{u}^{(0)}$ \\
			\bottomrule
		\end{tabular}
	\end{table}

	\begin{table}[htb]
		\caption{Performance of SSDRec and its variants ignoring social or dependency network.}
		\label{tab:comparisionofnetwork}
		\centering
		\begin{tabular}{cccccccc}
			\toprule
			\multirow{2}{*}{Dataset} & \multirow{2}{*}{Model} & \multicolumn{3}{c}{$HR@K$($\%$)} & \multicolumn{3}{c}{$NDCG$@K($\%$)}\\
			&& 10 & 20 & 50 & 10 & 20 & 50\\
			\midrule
			\multirow{3}{*}{PHP} &
			SSDRec-social & 11.07 & 17.29 & 29.64 & 5.37 & 7.04 & 9.55 \\
			& SSDRec-depdence & 11.07 & 17.70 & 29.89 & 5.30 & 7.05 & 9.53 \\
			& SSDRec & \textbf{11.95} & \textbf{18.93} & \textbf{31.13} & \textbf{5.88} & \textbf{7.74} & \textbf{10.22} \\
			\hline
			\multirow{3}{*}{Ruby} &
			SSDRec-social & 7.00 & 10.86 & 20.73 & 3.68 & 4.70 & 6.68 \\
			& SSDRec-depdence & 7.25 & 10.69 & 19.76 & 3.74 & 4.65 & 6.44 \\
			& SSDRec & \textbf{7.63} & \textbf{12.05} & \textbf{21.98} & \textbf{4.01} & \textbf{5.19} & \textbf{7.17} \\
			\hline
			\multirow{3}{*}{JavaScript} &
			SSDRec-social & 5.26 & 8.87 & 17.58 & 2.53 & 3.47 & 5.22 \\
			& SSDRec-depdence & 4.68 & 8.04 & 15.73 & 2.28 & 3.14 & 4.69 \\
			& SSDRec & \textbf{5.70} & \textbf{9.73} & \textbf{18.47} & \textbf{2.65} & \textbf{3.73} & \textbf{5.48}\\
			\bottomrule
		\end{tabular}
	\end{table}

	SSDRec utilizes SD-GAT to model dynamic social influences and attentive dependency influences. To study the contribution of each GAT, we modify SSDRec by masking corresponding network. Table \ref{tab:variantofnetwork} shows the details of variants in this part. We compare the performance of the two variants with SSDRec and report results in Table \ref{tab:comparisionofnetwork}. It's obvious that SSDRec significantly beats SSDRec-social and SSDRec-dependency, proving that our model benefits from both social network and dependency network.

	\subsubsection{Effect of dynamic interests and static interests(RQ2(b))}

	\begin{table}[htb]
		\caption{Performance of SSDRec and its variants only with dynamic interests (SSDRec-dynamic) or static interests(SSDRec-static). }
		\label{tab:comparisionofprefrence}
		\centering
		\begin{tabular}{cccccccc}
			\toprule
			\multirow{2}{*}{Dataset} & \multirow{2}{*}{Model} & \multicolumn{3}{c}{HR@K($\%$)} & \multicolumn{3}{c}{NDCG@K($\%$)}\\
			&& 10 & 20 & 50 & 10 & 20 & 50\\
			\midrule
			\multirow{3}{*}{PHP} &
			SSDRec-dynamic & 11.37 & 18.04 & 30.83 & 5.68 & 7.46 & 10.05 \\
			& SSDRec-static & 11.03 & 17.62 & 30.00 & 5.44 & 7.23 & 9.73 \\
			& SSDRec & \textbf{11.95} & \textbf{18.93} & \textbf{31.13} & \textbf{5.88} & \textbf{7.74} & \textbf{10.22} \\
			\hline
			\multirow{3}{*}{Ruby} &
			SSDRec-dynamic & 7.30 & 11.34 & 21.29 & 3.77 & 4.81 & 6.82 \\
			& SSDRec-static & 7.39 & 11.36 & 21.01 & 3.84 & 4.88 & 6.81 \\
			& SSDRec & \textbf{7.63} & \textbf{12.05} & \textbf{21.98} & \textbf{4.01} & \textbf{5.19} & \textbf{7.17} \\
			\hline
			\multirow{3}{*}{JavaScript} &
			SSDRec-dynamic & 5.54 & 9.50 & 18.23 & 2.58 & 3.62 & 5.37 \\
			& SSDRec-static & 5.10 & 8.67 & 16.76 & 2.36 & 3.30 & 4.92 \\
			& SSDRec & \textbf{5.70} & \textbf{9.73} & \textbf{18.47} & \textbf{2.65} & \textbf{3.73} & \textbf{5.48}\\
			\bottomrule
		\end{tabular}
	\end{table}

	Dynamic and static interests are two main features of developers. Table \ref{tab:comparisionofprefrence} shows the effect of two interests respectively. We can observe that SSDRec-dynamic outperforms SSDRec-static in most cases and is completely defeated by SSDRec. The reasons are as follows.

	(1) With the rapid development of computer field, both software and hardware are constantly updated, which leads to the rapid change of developers' interests. A developer may have been using Angular before, but now he is learning VUE following the trend. Compared with other fields, the dynamic interests of developers in computer field is particularly important. Thus, SSDRec-dynamic beats SSDRec-static in most cases.

	(2) Although most developers' interests change frequently, some of their characteristics will not change easily, such as learning speed, coding ability and so on. Thus, SSDRec considering two interests achieves highest $HR$ and $NDCG$.

	\subsection{Exploring Hyper-parameters(RQ3)} \label{parameters}

	In this part, we conduct experiments to show how hyper-parameters affect our model.

	\subsubsection{Neighborhood sample sizes}

	Due to the large range of node degrees in social and dependency networks, our model uses a sampling technique proposed in \cite{hamilton2017inductive}. To study the influence of sampling size on aggregation ability, we set $\beta$ and $\gamma$ as sampling sizes of first layer in the two networks (number of neighbors in every layer is half of previous layer, i.e. sampling sizes of second layer are $\beta/2$ and $\gamma/2)$. Figure \ref{influenceofnneighbors} illustrates the performance of SSDRec when changing $\beta$ and $\gamma$. Note that when $\beta=0$, the model is equal to SSDRec-dependency proposed in the previous subsection. Similarly, when $\gamma=0$, our model is equal to SSDRec-social.

	\begin{figure}[htb]
		\centering
		\subfigure[PHP-dependency]{
			\label{influenceofnneighbors:a}
			\includegraphics[width=0.23\linewidth]{figs/n_neighbors/PHP-dependency}}
		\subfigure[Ruby-dependency]{
			\label{influenceofnneighbors:b}
			\includegraphics[width=0.23\linewidth]{figs/n_neighbors/Ruby-dependency}}
		\subfigure[PHP-social]{
			\label{influenceofnneighbors:c}
			\includegraphics[width=0.23\linewidth]{figs/n_neighbors/PHP-social}}
		\subfigure[Ruby-social]{
			\label{influenceofnneighbors:d}
			\includegraphics[width=0.23\linewidth]{figs/n_neighbors/Ruby-social}}
		\caption{$HR@10$ and $NDCG@10$ w.r.t $\beta$ and $\gamma$. The result of $HR@20$, $HR@50$ and $NDCG@20$, $NDCG@50$ is similar hence omitted.}
		\label{influenceofnneighbors}
	\end{figure}

	As shown in Figure \ref{influenceofnneighbors}, for both $HR@10$ and $NDCG@10$ in PHP, the optimal $\gamma$ and $\beta$ are 10. What's more, the optimal $\gamma$ and $\beta$ are 8 and 14 respectively in Ruby.

	\subsubsection{Segmentation strategies of session}

	Segmentation strategies of session is an important factor that controls the lifespan of sessions. In this part, we compare the performance of SSDRec with different segmentation strategies \footnote{To ensure the consistency of data for each segmentation strategy, we do not reprocess the data, but merge adjacent sessions to increase the lifespan of sessions.} and comparison results on three datasets are shown in Figure \ref{influenceoflifespan}. From the results, we observe that the performance of SSDRec is dropped with the increase of lifespan in most cases. The possible reason is that one week is enough for the developer to complete a feature of the project, which means the developers' interests may change in just two weeks, i.e., it will become more and more difficult to model interests from sessions with the lifespan increased.

	\begin{figure}[htb]
		\centering
		\subfigure[PHP]{
			\label{influenceoflifespan:a}
			\includegraphics[width=0.30\linewidth]{figs/PHP-lifespan}}
		\subfigure[Ruby]{
			\label{influenceoflifespan:b}
			\includegraphics[width=0.30\linewidth]{figs/Ruby-lifespan}}
		\subfigure[JS]{
			\label{influenceoflifespan:c}
			\includegraphics[width=0.30\linewidth]{figs/JS-lifespan}}
		\caption{Impact of lifespan on the performance of SSDRec.}
		\label{influenceoflifespan}
	\end{figure}

	\subsection{Attention Visualization} \label{Visualization}

	We hypothesized that developers' interests rapidly change inter sessions and are relatively stable intra a session. As developers prefer to focus on friends with similar interests, the influences of their friends should follow the same rules. To reflect the change of influences of friends across sessions, we conduct the experiments from both the whole and specific individual.

	\subsubsection{developers as a whole.}

	Figure \ref{variance} illustrates the empirical distribution of inter-session, intra-session and across-friend attention variance on three datasets. From Figure \ref{variance}, we can observe:

	\begin{figure}[htb]
		\centering
		\subfigure[PHP]{
			\label{variance:a}
			\includegraphics[width=0.30\linewidth]{figs/variance_PHP}}
		\subfigure[Ruby]{
			\label{variance:b}
			\includegraphics[width=0.30\linewidth]{figs/variance_Ruby}}
		\subfigure[JS]{
			\label{variance:c}
			\includegraphics[width=0.30\linewidth]{figs/variance_JS}}
		\caption{Attention variance distribution of SSDRec for inter-session, intra-session and across friends.}
		\label{variance}
	\end{figure}

	(1) As a whole, the inter-session variance is much larger than intra-session variance, indicating attention changes rapidly inter sessions. This confirms that developers' interests are relatively stable.

	(2) The attention variance across friends is highest on average, which indicates that although interests of developers are dynamic, they rarely changes dramatically. This is reasonable. For example, a developer may learn angular and Vue sequentially and rarely uses front-end development after learning back-end development. But some of his friends may specialize in front-end development and some specialize in back-end development.

	\subsubsection{Invididual case studies.}

	To show individual developer behavior within and across session(s), we random select a developer $u1039$ who have 8 test sessions and at least 5 friends in PHP. Figure \ref{user_invididual} shows the attention visualization inter sessions and intra a session. From Figure \ref{user_invididual}, we can observe:
	\begin{figure}[htb]
		\centering
		\includegraphics[width=\linewidth]{figs/att_sessions}
		\caption{Inter(left) and intra-session(right) attention of $u1039$. For both plot, y-axis represents $u1039$'s friends and the color of attention is consistent. In the left plot, x-axis represents sessions and the average attention weight within a session is plotted. In the right plot, to obtain more convincing  results, x-axis represent the package sequence in fourth session (the longest session across eight sessions).}
		\label{user_invididual}
	\end{figure}

	(1) The attention allocated to friends changes whether across sessions or within a session. This confirms that the influences of social network change with the change of developer's interest.

	(2) Attention is relatively stable intra a session. This is in line with our hypothesis and reasonable. In general, developers' interests will not change much within a week (lifespan of sessions in our experiments) and their attention to friends is relatively stable. However, the time span inter sessions may exceed one year, during which the developer's interest may change, causing developer to focus on different sets of friends in different sessions.

	\section{Conclusions}\label{CONCLUSIONS}

	In this article, we first depict the evolving interests, dynamic social influences and attentive dependency influences in software recommendation and then propose a unified software recommendation framework to model them. Graph attention network is introduced and extended to combine attentive software dependency and dynamic social influences, and recurrent neural network is applied to model developers' evolving interests. Experiment results on real-world datasets indicate the performance and effectiveness of our proposed model. In future, we will consider higher order relationship in dependency network and social network.

	\section*{Declaration of Competing Interest}

	The authors declared that they have no conflicts of interest to this work.

	\section*{Acknowledgement}

	This work is supported by the National Natural Science Foundation of China (Grant No. 61872002, U1936220), the University Natural Science Research Project of Anhui Province (Grant No. KJ2019A0037), the National Key R$\&$D Program of China (Grant No.2019YFB1704101) and the Anhui Provincial Natural Science Foundation (Grant No. 2008085QF307).

	\bibliographystyle{unsrt}

Information Retrieval (cs.IR); Software Engineering (cs.SE)


MalNet: A Large-Scale Image Database of Malicious Software

Abstract: Computer vision is playing an increasingly important role in automated malware detection with the rise of the image-based binary representation. These binary images are fast to generate, require no feature engineering, and are resilient to popular obfuscation methods. Significant research has been conducted in this area, however, it has been restricted to small-scale or private datasets that only a few industry labs and research teams have access to. This lack of availability hinders examination of existing work, development of new research, and dissemination of ideas. We release MalNet-Image, the largest public cybersecurity image database, offering 24x more images and 70x more classes than existing databases (available atthis https URL). MalNet-Image contains over 1.2 million malware images -- across 47 types and 696 families -- democratizing image-based malware capabilities by enabling researchers and practitioners to evaluate techniques that were previously reported in propriety settings. We report the first million-scale malware detection results on binary images. MalNet-Image unlocks new and unique opportunities to advance the frontiers of machine learning, enabling new research directions into vision-based cyber defenses, multi-class imbalanced classification, and interpretable security.

\section{Introduction}

\input{tables/comparison}

Attack campaigns from criminal organizations and nation state actors are one of the most powerful forms of disruption, costing the U.S. economy as much as \$109 billion a year~\cite{council2018}.
These cyber attacks are highly sophisticated, targeting governments and large-scale enterprises to interrupt critical services and steal intellectual property~\cite{freitas2020d2m}.
Defending against these attacks requires the development of strong antivirus tools to identify new variants of malicious software before they can infect a network.
Unfortunately, as a majority of newly identified malware is \textit{polymorphic} in nature, where a few subtle source code changes result in significantly different compiled code (e.g., instruction reordering, branch inversion, register allocation)~\cite{dullien2005graph,you2010malware}, the predominant signature-based form of malware detection is rendered inert~\cite{sathyanarayan2008signature}.

To combat these issues, the cybersecurity industry~\cite{chen2020stamina} has turned to image-based malware representations as they are quick to generate, require no feature engineering, and are resilient to common obfuscation techniques (e.g., section encryption~\cite{nataraj2011malware}, file packing~\cite{nataraj2011comparative}).
For all of these reasons, image-based malware detection and classification research has surged in popularity.
Unfortunately, a majority of this research uses small-scale or private data repositories, making it increasingly difficult to characterize and differentiate existing work, develop new research methodologies, and disseminate new ideas~\cite{chen2020stamina,conti2010visual,fang2020android,fu2018malware,gennissen2017gamut,han2015malware,lu2019new,luo2017binary,nataraj2011malware,nataraj2011comparative,raff2018malware}.
To address these issues, we constructed \textsc{MalNet-Image}\xspace, the first large-scale ontology of malicious software images.

\subsection{Contributions}

\noindent\textbf{1. Largest Cybersecurity Image Database.}
\textsc{MalNet-Image}\xspace contains over 1.2 million software images across a hierarchy of $47$ types and $696$ families, enabling researchers and practitioners to conduct experiments on an industry scale dataset, and evaluate techniques that were previously reported in propriety settings.
Compared to the next large public database~\cite{noever2021virus}, \textsc{MalNet-Image}\xspace offers $24\times$ more images and nearly $70\times$ more classes (see Table~\ref{table:dataset_comparison}).
We report the first public large-scale malware detection and classification results on binary images, where we are able to detect malicious files with an AUC of $0.94$ and classify them across $47$ types and $696$ families with a macro-F1 score of $0.49$ and $0.45$, respectively.

\medskip\noindent\textbf{2. Permissive Licensing \& Open Source Code.}
We release \textsc{MalNet-Image}\xspace with a CC-BY license, allowing researchers and practitioners to share and adapt the database to their needs.
We open-source the code to create the images and run the experiments on \href{https://github.com/safreita1/malnet-image}{Github}.

\medskip\noindent\textbf{3. Visual Exploration Without Downloading.}
We develop \textsc{\textsc{MalNet-Image}\xspace{} Explorer}, an image exploration and visualization tool that enables researchers and practitioners to easily study the data without installation or download.
\textsc{\textsc{MalNet-Image}\xspace{} Explorer} is available online at: \url{https://mal-net.org}.

\medskip\noindent\textbf{4. Community Impact.}
\textsc{MalNet-Image}\xspace offers new and unique opportunities to advance the frontiers of cybersecurity research.
In particular, \textsc{MalNet-Image}\xspace offers researchers a chance to study imbalanced classification on a large-scale cybersecurity database with a natural imbalance ratio of $16,901\times$ (see Figure~\ref{fig:imbalance}); and explore explainability research in a high impact domain, where it is critical that security analysts can interpret and trust the model.

\section{Advancing the State-of-the-Art}
Aside from \textsc{MalNet-Image}\xspace, there are only two publicly available binary-image based cybersecurity datasets--- {Malimg}~\cite{nataraj2011comparative} and Virus-MNIST~\cite{noever2021virus}---containing 9,458 images across 25 classes, and 51,880 images across 10 classes, respectively.
In surveying the malware detection and classification literature \cite{nataraj2011comparative,chen2020stamina,gennissen2017gamut,kancherla2013image,choi2017malware,fu2018malware,han2015malware,su2018lightweight,mclaughlin2017deep,mercaldo2020deep,burks2019data,azab2020msic,yue2017imbalanced,catak2020data,ren2020end,chen2018deep,luo2017binary,jain2015enriching,kumar2016machine,fang2020android}, we observed that almost all experiments were conducted on small-scale or private data.
As the field advances, large-scale public databases are necessary to develop the next generation of algorithms.
In Table~\ref{table:dataset_comparison}, we compare \textsc{MalNet-Image}\xspace with other public and private cybersecurity image datasets.
We find that that \textsc{MalNet-Image}\xspace offers 24$\times$ more images and 70$\times$ the classes, compared to the largest alternative public binary image database (Virus-MNIST~\cite{noever2021virus}); and $479,800$ more images and $694$ more classes than the largest private database (Stamina~\cite{chen2020stamina}).
We do not compare against repositories of malicious binaries such as AndroZoo~\cite{li2017androzoo++}, AMD~\cite{wei2017deep}, Microsoft-BIG~\cite{ronen2018microsoft},  Malicia~\cite{nappa2013driving}, VirusShare, and VirusTotal in this discussion, as none of them have images available to use.

\medskip
\noindent\textbf{Security Implications.}
With the release of \textsc{MalNet-Image}\xspace, researchers will now have access to a critical resource to develop advanced, image-based malware detection and classification algorithms.
Like most open data resources, there is a potential for misuse by malicious actors who aim to craft new variants to evade detection.
We believe \textsc{MalNet-Image}\xspace's contribution to the research community significantly outweighs such risk.

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{figures/image-distribution.pdf}
\vspace{-6mm}
\caption{Class imbalance distribution for \textit{type} and \textit{family}.
}
\label{fig:imbalance}
\end{figure}

\subsection{Constructing MalNet-Image}\label{sec:construction}
\textsc{MalNet-Image}\xspace is an ambitious project to collect and process over 1.2 million binary images, and is a major extension to the graph representation learning database \textsc{MalNet}~\cite{freitas2020large}, offering significant new malware detection capabilities.
Below, we describe the provenance and construction of \textsc{MalNet-Image}\xspace.

\medskip
\noindent\textbf{Collecting Candidate Images.}
We construct \textsc{MalNet-Image}\xspace using the Android ecosystem due to its large market share~\cite{popper2017}, easy accessibility~\cite{li2017androzoo++} and diversity of malicious software~\cite{nokia2019}.
With the generous permission of AndroZoo~\cite{allix2016androzoo,li2017androzoo++}, we collected 1,262,024 Android APK files, specifically selecting APKs containing both a \textit{family} and \textit{type} label obtained from Euphony~\cite{hurier2017euphony}, a state-of-the-art malware labeling system that aggregates and learns from the labelling results of up to 70 antivirus vendors from VirusTotal~\cite{total2012virustotal}.

\begin{figure}[b]
\centering
\includegraphics[width=\linewidth]{figures/dex-structure.png}
\caption{\textbf{Left:} Android DEX file structure, composed of three major components---(1) header, (2) ids, and (3) data.
\textbf{Right:} binary image representation of the DEX file.
}
\label{fig:dex-structure}
\end{figure}

\medskip
\noindent\textbf{Processing the Images.}
The first step in constructing the image representation was to extract the DEX file (bytecode) from each Android APK.
The extracted DEX file was then converted into a 1D array of $8$ bit unsigned integers.
Each entry in the array is in the range $[0, 255]$ where $0$ corresponds to a black pixel and $255$ a white pixel.
We then convert each 1D byte array into a 2D array using standard linear plotting where the width of the image is fixed and the height is allowed to vary based on the file size.
We use the same image width proposed in the seminal work \cite{nataraj2011malware} (and follow up work~\cite{kalash2018malware,cui2018detection,rezende2018malicious,yakura2018malware}), and scale each image to $256\times 256$ using a standard Lanczos filter from the Pillow library.
Finally, we color each byte according to its use, adding a layer of semantic information on top of the raw bytecode.
While a variety of techniques can be used to encode semantic information into the image, there is currently no accepted standard.
We follow \cite{gennissen2017gamut} and assign each byte to a particular RGB channel depending on its position in the DEX file structure---(i) \textit{header}, (ii) \textit{identifiers} and \textit{class definitions}, and (iii) \textit{data} (see Figure~\ref{fig:dex-structure}).
Distributed across Google Cloud's General-purpose (N2) machine with $16$ cores running $24$ hours a day, this process took approximately a week.
We release the source code used to process the APKs on \href{https://github.com/safreita1/malnet-image}{Github}.

\medskip
\noindent\textbf{MalNet-Image Tiny.}
We construct \textsc{\textsc{MalNet-Image}\xspace Tiny}, containing $61,201$ training, $8,743$ validation and $17,486$ test images, for \textit{type level classification} experiments by removing the 4 largest types in \textsc{MalNet-Image}\xspace.
The goal of \textsc{\textsc{MalNet-Image}\xspace-Tiny} is to enable users to rapidly prototype new ideas, since it requires only a fraction of the time needed to train a new model.
\textsc{\textsc{MalNet-Image}\xspace Tiny} is released alongside the full dataset at {\small\url{https://mal-net.org}}.

\section{MalNet-Image Applications}\label{sec:application}
\textsc{MalNet-Image}\xspace offers new and unique opportunities to advance the frontiers of cybersecurity research.
As examples, we show three exciting new applications made possible by the \textsc{MalNet-Image}\xspace database---(1) as a state-of-the-art cybersecurity image benchmark in Section~\ref{subsec:app_baselines};
(2) as the first large-scale public analysis of malicious software detection using binary images in Section~\ref{subsec:malware-detection};
and (3) how to categorize high-risk malware threats (e.g., is this Ransomware or Spyware?) in Section~\ref{subsec:malware-classification}.
Then, in Section~\ref{subsec:research-challenges} we highlight new research directions enabled by \textsc{MalNet-Image}\xspace.

\medskip\noindent
\textbf{Application Setup.}
We divide \textsc{MalNet-Image}\xspace into three stratified sets of data, with a training-validation-test split of $70$-$10$-$20$ respectively;
repeated for both type and family labels (suggested splits available at {\small\url{https://mal-net.org}}).
In addition, we conduct malware detection experiments by grouping all 46 malicious software images into one type while the benign type maintains its original label.
We evaluate 3 common architectures---ResNet~\cite{he2016deep}, DenseNet~\cite{huang2017densely} and MobileNet~\cite{howard2017mobilenets}, based on its macro-F1 score, as is typical for highly imbalanced datasets~\cite{duggal2020elf,duggal2020rest,duggal2021har,freitas2020large}.
Each model is trained for 100 epochs using cross entropy loss  (unless specified otherwise) and an Adam optimizer on an Nvidia DGX-1 containing 8 V100 GPUs and 512GB of RAM using Keras with a Tensorflow backend.

\subsection{Application 1: Benchmarking Techniques}\label{subsec:app_baselines}
Leveraging the unprecedented scale and diversity of \textsc{MalNet-Image}\xspace, we evaluate numerous malware detection and classification techniques that have previously been studied using only private or small-scale databases.
Specifically, we evaluate recent techniques including: (a) semantic information encoding via colored channels, (b) model architecture, (c) imbalanced classification techniques, and (d) the performance of \textsc{\textsc{MalNet-Image}\xspace Tiny}, a small-scale version of \textsc{MalNet-Image}\xspace.
We detail the setup, results, and analysis of each experiment below.

\medskip\noindent
\textbf{Semantic Information Encoding.}
We evaluate the effect of information encoding in the classification process by training two ResNet18 models---one on the RGB images, where each byte is assigned to a particular color channel depending on its position in the DEX file structure as proposed in \cite{gennissen2017gamut}, and another on grayscale converted images.
We find no improvement in the macro-F1 score using semantically encoded RGB images compared to grayscale ones.
As there are alternative encoding techniques~\cite{gennissen2017gamut}, we believe comparing the effects of different encodings could be an interesting  future research direction.
Going forward, all models are trained using grayscale images.

\input{tables/results-models}

\medskip\noindent
\textbf{Evaluating Model Architectures.}
We evaluate malware detection and classification performance on 3 popular deep learning architectures (ResNet, DenseNet and MobileNetV2) across a variety of model sizes, using grayscale encoded images, and cross entropy loss.
In Table~\ref{tab:large_scale_results}, we report the macro-F1, macro-precision, and macro-recall of each model.
We find that all models obtain similar macro-F1 scores, indicating that a small model has enough capacity to learn the features present in the binary images.
Going forward, all experiments use a ResNet18 model due to its strong performance and fast training time.

\medskip\noindent
\textbf{Accounting for Class Imbalance.}
We evaluate 3 imbalanced classification techniques---(1) class reweighting with cross entropy loss, (2) focal loss, and (3) class reweighting with focal loss; and compare this to a model trained using cross entropy loss without class weighting.
For class reweighting, each example of a class $c$ is weighted according to it's effective number $\frac{1-\beta}{1-\beta^{n_c}}$, where $n_c$ is the number of images in class $c$ and $\beta=0.999$ is selected through a line search across standard values~\cite{cui2019class} of $\{0.9, 0.99, 0.999, 0.9999\}$.
For focal loss~\cite{lin2017focal}, a regularization technique that tackles imbalance by establishing margins based on the class size, we set the hyperparameter $\gamma=2$ as suggested in \cite{lin2017focal}.

Analyzing the results, we find that cross entropy loss with class reweighting improves the \textit{type} macro-F1 score by $0.021$, but lowers the binary and family classification scores by $0.002$ and $0.006$, respectively.
In particular, we notice that \textsc{MalNet-Image}\xspace's smallest types benefit the most from class reweighting, where the `Click' type (113 examples), sees its F1 score rise from $0$ to $0.91$.
On the other hand, focal loss shows no improvement over the baseline model, likely due to its design for use in dense object detectors like R-CNN.
Going forward, all experiments use cross entropy loss with class reweighting due to the strong improvement in smaller malware types.

\medskip\noindent
\textbf{\textsc{MalNet-Image Tiny} Performance.}
We train a ResNet18 model on grayscale images using cross entropy loss and class reweighting, and achieve a macro-F1 score of $0.65$.
Compared to full dataset, the macro-F1 score is significantly higher $0.65$ vs $0.49$; which is unsurprising since the largest 4 types contained a significant proportion of the image diversity (based on the number of families), resulting in an easier classification task.

\medskip\noindent
\textbf{Limitations.} Methods that work well on other datasets may not work well on \textsc{MalNet-Image}\xspace due to structural differences in the images; vice-versa, methods that work on \textsc{MalNet-Image}\xspace may not transfer well to other datasets.
We hope this work inspires new research in the binary image domain, enabling the development of methods that generalize across key domains such as cybersecurity.

\subsection{Application 2: Malware Detection}\label{subsec:malware-detection}

Researchers and practitioners can now conduct malware detection experiments on an industry scale dataset, evaluating things that were previously reported in propriety settings.
Using the model selected in Section~\ref{subsec:app_baselines}---a ResNet18 model trained on grayscale images using cross entropy loss and class reweighting---we perform an in-depth analysis of this highly imbalanced detection problem containing $1,182,905$ malicious and $79,119$ benign images.
We find that the model is able to obtain a strong macro-F1 score of $0.86$, macro-precision of $0.89$ and a macro-recall of $0.84$.
We further study the model's detection capabilities by analyzing its ROC curve, where the model achieves an AUC score of $0.94$, and is able to identify $84\%$ of all malicious files with a false positive rate of $10\%$ (a common threshold used in security~\cite{chen2020stamina}).
This first of its kind analysis allows researchers insight into malware detection that is usually restricted to handful of industry labs.

\textsc{MalNet-Image}\xspace also opens new opportunities in the nascent and promising research direction of analyzing attention maps to interpret malware detection results.
Yakura et al.~\cite{yakura2019neural,yakura2018malware} showed that specific byte sequences found in the attention map closely correlate with malicious code payloads.
We evaluate the potential of attention maps on \textsc{MalNet-Image}\xspace using the popular Grad-Cam~\cite{selvaraju2017grad} technique to highlight regions of interest across 3 types of malware and benignware in Figure~\ref{fig:model-attention}.
In the malware images (left three), we see the attention map is focused on thin regions of bytecode in the data section (where malicious payloads are often stored), while in the benign images (right side) the attention map is dispersed across the larger data region.
This type of visual analysis can significantly reduce the amount of time and effort required to manually investigate a file by guiding security analysts to suspicious regions of the bytecode.

\subsection{Application 3: Malware Classification}\label{subsec:malware-classification}
\textsc{MalNet-Image}\xspace opens up new research into binary images as a tool for multi-class malware classification (e.g., is this file Ransomware or Spyware?).
Using the model selected in Section~\ref{subsec:app_baselines}, we perform an in-depth analysis of its multi-class classification capability across $47$ types and $696$ families of malware.
We find the model is able to classify the malware \textit{type} and malware \textit{family} with a macro-F1 score of $0.49$ and $0.45$, respectively.

In Figure~\ref{fig:cm}, we conduct an in-depth analysis into \textit{type} level classification performance through a confusion matrix heatmap.
A dark diagonal indicates strong classifier performance, where a dark off-diagonal entry indicates poor performance.
Each square in the diagonal indicates the percent of examples correctly classified for a particular malware type, and each off-diagonal row entry indicates the percent of incorrectly classified examples for a particular malware type.
We find that four types of malware comprise the majority of misclassifications: Adware, Benign, Riskware, and Trojan.
Unsurprisingly, these are the 4 largest types of malware (based on the number of images in each class), indicating the strong effect that data imbalance has in the malware classification process.
In addition, the heatmap can be used to identify potential naming disagreements between vendor labels (e.g., ``adware'' and ``adsware''), serving as the basis for merging certain types of malware.
To the best of our knowledge, this is the first public large-scale analysis of malware classification, providing a new state-of-the-art benchmark to compare against.

\begin{figure}
\centering
\includegraphics[width=\linewidth]{figures/attention.pdf}
\caption{Model attention patterns across $4$ malware types (each with $2$ images).
\textbf{Ransom++Trojan:} focus on thin region of data section.
\textbf{Benign:} wide range of attention across data section.
\textbf{Adware:} attention on circular bytecode ``hotspots''.
\textbf{Monitor:} focus on ``empty''  black region of data section.
}
\label{fig:model-attention}
\end{figure}

\begin{figure*}
\includegraphics[width=\textwidth]{figures/cm.pdf}
\caption{
Malware classification results using confusion matrix heatmap (classes in descending order of number of samples).
We analyze type level classification performance, where a dark diagonal indicates strong performance, and a dark off-diagonal indicates poor performance.
Each square in the diagonal indicates the percent of examples correctly classified for a particular malware type, and each off-diagonal entry indicates the percent of incorrectly classified examples for a particular type.
}
\label{fig:cm}
\end{figure*}

\subsection{Enabling New Research Directions}\label{subsec:research-challenges}
The scale and diversity of \textsc{MalNet-Image}\xspace opens up new exciting research opportunities to the ML and security communities. Below, we present 3 promising directions (R1-R3).

\begin{enumerate}[topsep=2mm, itemsep=1mm, parsep=1mm, leftmargin=*, label=\textbf{R\arabic*.}]

\item \textbf{Advancing Vision Based Cybersecurity Research.}
Research into developing image-based malware detection and classification algorithms has recently surged across industry (e.g., Intel-Microsoft collaboration on Stamina~\cite{chen2020stamina}, security companies~\cite{noever2021virus,gennissen2017gamut}) and academia~\cite{kancherla2013image,choi2017malware,fu2018malware,han2015malware,su2018lightweight,mclaughlin2017deep,mercaldo2020deep,burks2019data,azab2020msic,yue2017imbalanced,catak2020data,ren2020end,chen2018deep,luo2017binary,jain2015enriching,kumar2016machine,fang2020android}.
However, existing public datasets contain only a handful of classes and thousands of images, and as the field advances, larger and more challenging datasets are needed for the next generation of models.
With the release of \textsc{MalNet-Image}\xspace, researchers have access to a critical resource to develop and benchmark advanced image-based malware detection and classification algorithms, previously restricted to a few industry labs and research teams.

\item \textbf{Extending Imbalanced Classification to a New Domain.}
Only preliminary work has studied binary-image malware classification under data imbalance~\cite{yue2017imbalanced} due to the limited number of classes and images available in public datasets.
As a result, it is unknown whether many techniques may generalize to the binary-image domain, and how they will perform in highly imbalanced classification scenarios.
We take a first step in this direction in Section~\ref{subsec:app_baselines}, where we show that classes containing only a few examples typically underperform relative to their more populous counterparts---highlighting the significant challenge of imbalanced classification in the cybersecurity domain.
By releasing \textsc{MalNet-Image}\xspace, one of the largest naturally imbalanced databases to date, we hope to foster new interest in this important research area, enabling the machine learning community to impact and generalize across domains.

\item \textbf{Interpretable Cybersecurity Research.}
Preliminary research has demonstrated the importance of attention mechanisms in binary-image malware classification, where extracted regions can provide strong indicators to human analysts, helping guide them to suspicious parts of the bytecode for additional analysis~\cite{yakura2019neural,yakura2018malware}.
This includes recent research in salience based methods that automatically discover concepts, helping to identify correlated regions of bytecode~\cite{zhao2015saliency}.
Prior to \textsc{MalNet-Image}\xspace, researchers were limited to a small number of malicious families and types, hindering their ability to conduct large-scale explainability studies.
With \textsc{MalNet-Image}\xspace's nearly 700 classes, researchers can explore a wide variety of malicious software, enabling new breakthroughs and discoveries.
For example, researchers might discover that new types of visualization and sense-making techniques are needed to accurately summarize large volumes of binary-image data to enhance security analysts decision making capabilities.
\end{enumerate}

\section{Conclusion}\label{sec:conclusion}
Computer vision research into binary-image malware detection and classification is a crucial tool in protecting enterprise networks and governments from cyber attacks seeking to interrupt critical services and steal intellectual property.
Leveraging \textsc{MalNet-Image}\xspace's scale and diversity---containing $1,262,024$ binary images across a hierarchy of $47$ types and $696$ families---researchers and practitioners can now conduct experiments that were previously restricted to a few industry labs and research teams.
We hope \textsc{MalNet-Image}\xspace becomes a central resource for a broad range of research into vision-based cyber defenses, multi-class imbalanced classification, and interpretable security.

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computer Vision and Pattern Recognition (cs.CV); Machine Learning (cs.LG)