0

I'm wondering whether git commit metadata can shred light on potential risk signals or vulnerabilities.

Henry Hinnefeld has investigated this, here but this seems to be a way of detecting vulnerabilities which already have been spotted by other developers.

Can anyone think how metadata alone can detect vulnerabilities that have never been found before?

1 Answer 1

1

... but this seems to be a way of detecting vulnerabilities which already have been spotted by other developers.

This is the wrong interpretation of what he did. He tried to create a machine learning model which predicts the risk from git meta data. This model is trained with supervised learning where the label in the training data (vulnerability or not) is derived from associating a commit with a later bugfix or not in the same place. The model is then applied to previously unseen commits in the hope to estimate the risk of a bug. Unfortunately no results are shown of how good this model performs in practice.

Apart from this there are some patterns associated with the meta data to be expected, like: Changes very late in the day have probably a higher risk since the developer might be exhausted already from all the work. Some developers tend to introduce more problems than others since they are less experienced. Small commit message for large commits might be associated with more vulnerabilities too. Commits in areas where lots of vulnerabilities occur are more risky than others. Etc.

But directly detecting a vulnerability from the meta data is the wrong expectation. At most one can decide which commit have a higher risk than others in order to more thoroughly review the more risky commits.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .