Using social network analysis for mining collaboration data in a defect tracking system for risk and vulnerability analysis

Abstract

Open source software projects are characterized as self organizing and dynamic in which volunteers around the world primarily driven by self-motivation (and not necessarily monetary compensation) contribute and collaborate to a software product. In contrast to close source or proprietary software, the organizational structure and task allocation in an open source project setting is unstructured. Software project managers perform risk, threat and vulnerability analysis to gain insights into the organizational structure for de-risking or risk mitigation. For example, it is important for a project manager to have an understanding of critical employees, core team, subject matter experts, sub-groups, leaders and communication bridges.Software repositories such as defect tracking systems, versioning systems and mailing lists contains a wealth of valuable information that can be mined for solving practically useful software engineering tasks. In this paper, we present a systematic approach to mine defect tracking system for risk, threat and vulnerability analysis in a software project. We 1 derive a collaboration network from a defect tracking system and apply social network analysis techniques to investigate the derived network for the purpose of risk and vulnerability analysis. We perform empirical analysis on bug report data of Mozilla Firefox project and present the results of our analysis. We demonstrate how important information pertaining to risk and vulnerability can be uncovered using network analysis techniques from static record keeping software archive such as the bug tracking system.

Using Software Dependency to Bug Prediction

“…They evaluated that network metrics can discriminate between vulnerable and neutral files and predict vulnerabilities. Sureka et al [21] derived a collaboration network from a defect tracking system and applied network analysis to investigate the derived network for the purpose of risk and vulnerability analysis. They demonstrated that important information of risk and vulnerability can be uncovered using network analysis techniques.…”

git2net - Mining Time-Stamped Co-Editing Networks from Large git Repositories

“…To this end, a first line of works has used data that directly capture communication [13], e.g. via IRC channels [14], E-Mail exchanges [15,16,17,18,19], mailing lists [20], or communication via issue trackers [21,22,23,24,25].…”

软件工程开发者社交网络: 构建、 分析及应用

“…A bug tracking system (i.e., defect/issue/problem tracking system) [33] is a repository to manage bug reports within the life-cycle of software. In bug tracking systems, communication is performed by comments, so DSNs can be constructed by relationships of comments [33][34][35][36][37][38]. The first rule to construct bug tracking system based DSNs (BTS-DSNs) is: if two developers both comment on a common bug report, there is a link between them in the DSN.…”