一句话：通过对 Chromium OS 的病例对照研究，识别出影响代码审查能否发现安全缺陷的关键因素，并建立高精度预测模型。
本文研究为何强制代码审查下仍有安全缺陷逃逸。作者对 Chromium OS 项目开展病例对照研究，采用多阶段半自动化方法构建数据集，包含 516 个成功识别安全缺陷和 374 个漏掉安全缺陷的代码审查。结果发现两类审查所对应的安全缺陷类别存在显著差异；基于数据集拟合的逻辑回归模型 AUC 达 0.91，并识别出九个影响安全缺陷发现的审查属性。审查完成时间、开发者间相互审查次数以及是否为缺陷修复类审查有正向影响；而审查涉及目录数、开发者总审查次数和文件先前提交总数则有负向影响。
Peer code review has been found to be effective in identifying security vulnerabilities. However, despite practicing mandatory code reviews, many Open Source Software (OSS) projects still encounter a large number of post-release security vulnerabilities, as some security defects escape those. Therefore, a project manager may wonder if there was any weakness or inconsistency during a code review that missed a security vulnerability. Answers to this question may help a manager pinpointing areas of concern and taking measures to improve the effectiveness of his/her project's code reviews in identifying security defects. Therefore, this study aims to identify the factors that differentiate code reviews that successfully identified security defects from those that missed such defects. With this goal, we conduct a case-control study of Chromium OS project. Using multi-stage semi-automated approaches, we build a dataset of 516 code reviews that successfully identified security defects and 374 code reviews where security defects escaped. The results of our empirical study suggest that the are significant differences between the categories of security defects that are identified and that are missed during code reviews. A logistic regression model fitted on our dataset achieved an AUC score of 0.91 and has identified nine code review attributes that influence identifications of security defects. While time to complete a review, the number of mutual reviews between two developers, and if the review is for a bug fix have positive impacts on vulnerability identification, opposite effects are observed from the number of directories under review, the number of total reviews by a developer, and the total number of prior commits for the file under review.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{PaulTB21,
title = {Why Security Defects Go Unnoticed During Code Reviews? A Case-Control Study of the Chromium OS Project},
author = {Rajshakhar Paul and Asif Kamal Turzo and Amiangshu Bosu},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00124}
}