一句话:首个面向 COBOL 文件级缺陷定位的防泄漏基准与评估流水线,发现现有方法难以超越随机排序。
COBOL 系统维护缺乏无泄漏的文件级缺陷定位基准。本文提出 COBug,首个面向 COBOL 的防泄漏基准与评估流水线:从 12 个 X-COBOL 仓库构建 552 个确定性查询、400 个受影响文件、476 个候选路径与 27,047 个报告-候选对;查询由隔离源码变异生成、ground truth 可机械追溯,症状导向缺陷报告生成时不访问受影响文件。评估采用严格 Leave-One-Repository-Out 与仓库分组内层验证,比较词汇检索、逻辑回归、随机森林、LambdaMART 和冻结 CodeBERT。结果表明这些方法均不能可靠超越仓库匹配的随机排序;LambdaMART 聚合最佳(MAP 0.1625,Top-1 0.0754,Top-5 0.2109),但提升不一致且受单个小仓库影响,Holm 校正后无显著差异;CodeBERT 接近随机下限。额外 LLM 语义故障试点仅 15/29 候选通过,未满足故障类型覆盖要求,仅作有限方法学证据。OpenCBS/ODC 对照显示类别级对应并揭示静态变异算子分布局限。
COBug is the first leakage-controlled benchmark and evaluation pipeline designed specifically for file-level bug localization in COBOL systems. It is constructed from 12 query-bearing X-COBOL repositories and contains 552 deterministic queries, 400 distinct affected files, 476 repository-local candidate paths, and 27,047 report–candidate pairs. Each query is produced using an isolated source-code mutation with mechanically traceable ground truth, while the corresponding symptom-focused bug report is generated without accessing the affected source file. The benchmark evaluates lexical information retrieval, Logistic Regression, Random Forest, LambdaMART Learning-to-Rank, and frozen CodeBERT under strict Leave-One-Repository-Out evaluation with repository-grouped inner validation. The results show that the evaluated lexical, learned, and embedding-based approaches do not reliably outperform repository-matched random ranking. LambdaMART achieves the best aggregate performance, with a MAP of 0.1625, Top-1 accuracy of 0.0754, and Top-5 accuracy of 0.2109, but its improvement over lexical retrieval is inconsistent and largely influenced by one small repository. Frozen CodeBERT performs approximately at the random floor, and no method or floor comparison remains statistically significant after Holm correction. An additional LLM-based semantic-fault pilot admitted 15 of 29 adjudicated candidates, but no generator satisfied the predefined fault-type coverage requirement; therefore, it is retained only as bounded methodological evidence. A structured OpenCBS/ODC comparison further demonstrates category-level correspondence while identifying limitations in the benchmark’s static mutation-operator distribution.