Can Developer Data Predict Vulnerabilities? : Examining Developer and Vulnerability Correlation in the Kibana Project

Abstract: Open-source software is often chosen with the expectation of increased security. The transparency and peer review process of open development offer advantages in terms of more secure code. However, developing secure code remains a challenging task that requires more than just expertise. Even with adequate knowledge, human errors can occur, leading to mistakes and overlooked issues that may result in exploitable vulnerabilities. It is reasonable to assume that not all developers introduce bugs or vulnerabilities randomly since each developer brings unique experience and knowledge to the development process. The objective of this thesis is to investigate a method for identifying high-risk developers who are more likely to introduce vulnerabilities or bugs, which can be used to predict potential locations of bugs or vulnerabilities in the source code based on the developer who wrote the code. Metrics related to developers’ code churn, code complexity, bug association, and experience were collected during a case study of the open- source project Kibana. The findings provide empirical evidence suggesting that developers that write code with higher complexity and have a greater project activity pose a higher risk of introducing vulnerabilities and bugs. Developers who have introduced vulnerabilities also tend to exhibit higher code churn, code complexity, and bug association compared to those who have not introduced a vulnerability. However, the metrics employed in this study were not sufficiently discriminative for identifying developers with a higher risk of introducing vulnerabilities or bugs per commit. Nevertheless, the results of this study serve as a foundation for further research in this area exploring the topic further.