Disclosed herein are techniques for identifying sources of software-based malfunctions. Techniques include identifying a potential software malfunction in a system, the system having multiple code sets associated with a plurality of different software sources; accessing a line-of-code behavior and relation model representing execution of functions of the code sets; identifying, based on the line-of-code behavior and relation model, a code set determined to have the potential to cause, a least in part, the potential software malfunction; and determining a source identifier of the identified code set.