一句话：利用过程挖掘从控制流与语义两方面识别 PR 过程异常并综合根因，为开源供应链风险提供早期预警。
为评估开源软件 Pull Request（PR）流程的可信性，本文利用过程挖掘识别并分析 PR 流程的正常与异常模式，从控制流和语义两方面检测异常并综合归纳根因。作者分析 GitHub 上 18 个开源项目的 17,531 个 PR，提取出 26 类控制流异常根因和 19 类语义异常根因。结果显示，多数 PR 很难同时包含两类异常，项目内部自定义规则可能是关键原因；非 fork 模型（42%）比 fork 模型（5%）更易绕过评审，风险更高；九个被投毒项目的 PR 实践确实更差。该工作可为 OSS 供应链中投毒等可疑事件提供早期风险提示。
Trustworthy Open Source Software (OSS) development processes are the basis that secures the long-term trustworthiness of software projects and products. With the aim to investigate the trustworthiness of the Pull Request (PR) process, the common model of collaborative development in OSS community, we exploit process mining to identify and analyze the normal and anomalous patterns of PR processes, and propose our approach to identifying anomalies from both control-flow and semantic aspects, and then to analyze and synthesize the root causes of the identified anomalies. We analyze 17531 PRs of 18 OSS projects on GitHub, extracting 26 root causes of control-flow anomalies and 19 root causes of semantic anomalies. We find that most PRs can hardly contain both semantic anomalies and control-flow anomalies, and the internal custom rules in projects may be the key causes for the identified anomalous PRs. We further discover and analyze the patterns of normal PR processes. We find that PRs in the non-fork model (42%) are far more likely than the fork model (5%) to bypass the review process, indicating a higher potential risk. Besides, we analyzed nine poisoned projects whose PR practices were indeed worse. Given the complex and diverse PR processes in OSS community, the proposed approach can help identify and understand not only anomalous PRs but also normal PRs, which offers early risk indications of suspicious incidents (such as poisoning) to OSS supply chain.
@inproceedings{paperbot11441,
title = {Mining Pull Requests to Detect Process Anomalies in Open Source Software Development},
author = {Bohan Liu and He Zhang and Weigang Ma and Hongyu Kuang and Yi Yang and Jinwei Xu and Shan Gao and Jian Gao},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639196}
}