Before users can interact with computer software, its source code must be converted into executable binaries and software packages, a task handled by specialized tools known as build systems. Build systems are therefore a fundamental component of modern software development and have evolved into complex distributed systems that manage dependencies, optimize resources, and ensure correctness across large-scale projects. Studies have shown that build maintenance can consume up to 27% of a developer's time in large projects.
One of the most challenging aspects of build system maintenance is dependency management. Dependency-related errors account for more than 50% of build errors in large-scale software projects. Missing dependencies, in which a dependency is not declared in the build manifest, can lead to incorrect builds or failures, while redundant dependencies result in unnecessary rebuilds and low build performance. Both types of errors become increasingly difficult to manage as codebases grow in size and complexity. Although several approaches have been proposed to detect dependency errors, many introduce substantial runtime overhead and struggle to achieve the combination of performance and accuracy required for continuous integration environments.
To address this challenge, a research team led by Professor Hironori Washizaki of Waseda University has developed a new method called "mkcheck2." "Conventional dependency error detection methods that utilize ptrace-based system call tracing, while being accurate, introduce high runtime overhead due to operating in user space, requiring frequent process suspensions and context switches for each system call," explains Washizaki. "In contrast, our approach utilizes eBPF, a lightweight system call monitoring technology, combined with incremental analysis to significantly reduce verification time." The team also included Associate Professor Kazunori Sakamoto from Tokyo Online University and Yuta Saito from Waseda University. Their study was published in the Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering , held in Rio de Janeiro, Brazil, from April 12–18, 2026, and was made available online on September 11, 2026. ICSE is the premier conference in the field of software engineering.
mkcheck2 addresses two fundamental challenges in build dependency verification: the performance overhead of system call tracing and the computational cost of dependency graph analysis. It consists of three main components:
- The first component is the Build Tracer module that monitors file operations during the build process using eBPF-based system call tracing. The eBPF program operates entirely within the kernel space, filtering and processing system calls in real-time without the need for expensive context switches, thereby reducing overhead. The collected information is then passed to a user-space tracer responsible for maintaining process hierarchy information.
- The second component is the dependency graph builder, which constructs and maintains a representation of actual build dependencies based on traced file operations. It also tracks historical dependency information and classifies dependencies based on their characteristics. "The dependency graph builder serves as the system's central data processor," notes Washizaki.
- The final component is the incremental analyzer, which detects dependency errors by comparing dependency graphs generated from different builds. Rather than analyzing the entire dependency structure each time, the method focuses only on modified portions of the graph, substantially reducing computational cost.
By leveraging these components, mkcheck2 demonstrated substantial performance improvements across evaluations involving 300 open-source projects. Compared to existing ptrace-based methods, it reduced build-time overhead by 99.7% (from an average 148.0% overhead to just 0.3%). Notably, the technique reduced the mean analysis time per commit from 1267.49 seconds to just 23.56 seconds, making continuous dependency verification practical in real-world development environments. Even with these performance improvements, mkcheck2 achieved 100% accuracy in detecting missing dependencies and 92% accuracy for redundant dependencies.
"This technology could play an important role in large-scale software systems, including cloud and AI infrastructure, where rapid verification during continuous integration is essential," concludes Washizaki. "Over the long term, it may contribute to improving software reliability and security by helping developers maintain build system correctness at scale in complex projects."
