Assessing risk of software commits to prioritize verification resources

Patent metadata

Field	Value
Publication number	US-9946633-B2
Application number	US-201514947216-A
Country	US
Kind code	B2
Filing date	Nov 20, 2015
Priority date	Sep 29, 2015
Publication date	Apr 17, 2018
Grant date	Apr 17, 2018

Abstract

A computer-implemented method and system for assessing risk of a software program and software updates to a program to prioritize verification resources, which includes receiving code for a software product for a testing assessment. The code is analyzed according to a risk assessment criteria, and the risk assessment criteria includes risk assessment factors. The risk assessment factors for the code are weighted as part of the criteria. A risk assessment score of the code is determined based on the criteria. Testing resources are allocated in response to the risk assessment score.

First claim

What is claimed is:

1. A computer-implemented method for assessing risk of a software program and software updates to a program to prioritize verification resources, comprising:
receiving software code for a software product for a testing assessment;
analyzing the code according to a risk assessment criteria, the risk assessment criteria includes risk assessment factors;
selecting the risk assessment factors from a group consisting of: a complexity of change; a previous history of change; a functional area of code and its quality history; and a quality of the coder;
evaluating an additional risk assessment factor of the risk assessment factors, the additional risk assessment factor includes determining when the software code includes a link directed to external software with respect to the software code, the external software including a daemon in a common operating system for running the software code and the external software, or a piece of external software running remotely, the piece of external software being run remotely and including one or more endpoints;
determining when a change occurs to the link or external software;
weighting the risk assessment factors for the code as part of the criteria, wherein the link or the external software of the additional risk assessment factor is considered an increased risk, and the endpoints being assigned respective sub-weights in the weighting of the risk assessment factors;
determining a risk assessment score of the code based on the criteria, before running the testing assessment of the software code; and
allocating testing resources for the testing assessment of the software code in response to the risk assessment score.

2. The method of claim 1 , wherein the code is an update to the software application.

3. The method of claim 2 , wherein an overall risk assessment score is computed for multiple code updates.

4. The method of claim 1 , wherein the risk assessment factors include: authors, reviewers, reviewing quality, testing coverage, complexity, code usage, and rate of updates.

5. The method of claim 1 , further comprising:
adjusting allocated testing resources in response to the risk assessment score.

6. The method of claim 1 , further comprising:
increasing allocated testing resources in response to a higher risk assessment score.

7. The method of claim 1 , further comprising:
decreasing allocated testing resources in response to a lower risk assessment score.

8. The method of claim 1 , further comprising:
receiving multiple code updates for the software application;
analyzing each of the multiple code updates according to the risk assessment criteria;
weighting the risk assessment factors for each of the code updates as part of the criteria;
determining an overall risk assessment score for the multiple code updates based on the criteria; and
allocating testing resources in response to the overall risk assessment score.

9. The method of claim 1 , wherein the allocating testing resources include:
determining a first risk assessment threshold for allocating functional testing resources;
determining a second risk assessment threshold for allocating regression testing; and
determining a third risk assessment threshold for integration testing.

10. The method of claim 1 , further comprising:
selecting the risk assessment factors from an additional group consisting of: modeled cross-component software links; a quality and a type of code review for a code change; a quality of a review and a reviewer; a test case coverage and quality of the test case; a frequency of changes in a functional area; a rate of change of a frequency of changes over a time period; and a caller count of a commit including an amount of functions called by a program changed by a code change.

Assignees

• IBM

Inventors

• Atyam Balaji V
• Bofferding Nicholas E
• Geissler Andrew
• Hollinger Michael C

Classifications

• G06F11/3672 Primary

  Test management · CPC title

• G06F11/3616 Primary

  using software metrics · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F8/70

  Software maintenance or management · CPC title