  How can we identify similar repositories and clusters among a large online
archive, such as GitHub? Determiningrepository similarity is an essential
building block in studying the dynamics and the evolution of such software
ecosystems. The key challenge is to determine the right representation for the
diverse repository features in a way that: (a) it captures all aspects of the
available information, and (b) it is readily usable by MLalgorithms. We propose
Repo2Vec, a comprehensive embedding approach to represent a repository as a
distributed vector by combining features from three types of information
sources. As our key novelty, we consider three types of information:
(a)metadata, (b) the structure of the repository, and (c) the source code. We
also introduce a series of embedding approaches to represent and combine these
information types into a single embedding. We evaluate our method with two real
datasets from GitHub for a combined 1013 repositories. First, we show that our
method outperforms previous methods in terms of precision (93%vs 78%), with
nearly twice as many Strongly Similar repositories and 30% fewer False
Positives. Second, we show how Repo2Vecprovides a solid basis for: (a)
distinguishing between malware and benign repositories, and (b) identifying a
meaningful hierarchical clustering. For example, we achieve 98% precision and
96%recall in distinguishing malware and benign repositories. Overall, our work
is a fundamental building block for enabling many repository analysis functions
such as repository categorization by target platform or intention, detecting
code-reuse and clones, and identifying lineage and evolution.
