一句话：面向同行代码评审漏检安全缺陷的问题，研究如何提升其识别安全缺陷的有效性。
已有研究表明同行代码评审有助于发现安全缺陷，因此多数商业与开源项目都在软件开发生命周期中强制实施同行评审。然而，尽管强制执行了同行评审，Chromium、Mozilla、Qt 等安全关键的开源项目仍在 CVE 数据库中报告大量发布后漏洞。这提示评审流程中可能存在被忽视的环节，使安全缺陷在评审阶段被漏过。本博士论文研究的主要目标即提升同行代码评审在识别安全缺陷方面的有效性，从而减少此类漏检。
Prior studies found peer code review useful in identifying security defects. That is why most of the commercial and open-source software (OSS) projects embraced peer code review and mandated the use of it in the software development life cycle. However, despite conducting mandatory peer code review practices, many security-critical OSS projects such as Chromium, Mozilla, and Qt are reporting a high number of post-release vulnerabilities to the Common Vulnerabilities and Exposures (CVE) database. Practitioners may wonder if there is any missing piece in the puzzle that leads code reviews to miss those security defects. Therefore, the primary objective of this dissertation study is to improve the effectiveness of peer code review in identifying security defects.
DOI 原文 ·
@inproceedings{paperbot6465,
title = {Improving the effectiveness of peer code review in identifying security defects},
author = {Rajshakhar Paul},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3473107}
}