Assessment of development team factors
Techniques described herein include assessing factors that may affect the quality of software under development by a development team or that may be used to evaluate the health of software already deployed in a computing environment. In one example, this disclosure describes a method that includes collecting, by a computing system, historical information about a plurality of prior development projects; correlating, by the computing system, the historical information with each of a plurality of developers that participated in one or more of the plurality of prior development projects; collecting, by the computing system, information about an application developed by a subset of the plurality of developers; generating, by the computing system and based on the information about the application and the correlated historical information, a predicted outcome for the application; and taking an action, by the computing system and based on the predicted outcome, to prevent the predicted outcome.
1. A method comprising:
collecting, by a computing system, historical information about a plurality of prior development projects;
correlating, by the computing system, the historical information with each of a plurality of developers that participated in one or more of the plurality of prior development projects;
collecting, by the computing system, information about an application developed by a subset of the plurality of developers;
generating, by the computing system and based on the information about the application and the correlated historical information, a predicted outcome for the application; and
taking an action, by the computing system and based on the predicted outcome, to prevent the predicted outcome, wherein taking the action includes communicating with a network system and configuring a web application firewall to prevent the predicted outcome.
2. The method of claim 1 , wherein the historical information includes at least one of:
information about reliability of an application resulting from at least one of the prior development projects;
information about a defect that was present in an application resulting from at least one of the prior development projects;
information about a security vulnerability that was present in an application resulting from at least one of the prior development projects; or
results from scans of source code created during at least one of the prior development projects.
3. The method of claim 1 , wherein correlating the historical information includes:
identifying source code written during development of each of the prior development projects.
4. The method of claim 3 , wherein correlating the historical information further includes:
identifying portions of the source code written by each member of the prior development projects.
5. The method of claim 1 , wherein collecting information about the application includes:
performing an assessment of each of the developers in the subset of the plurality of developers.
6. The method of claim 1 , wherein collecting information about the application includes:
collecting information about an application still being developed.
7. The method of claim 1 , wherein collecting information about the application includes:
collecting information about an application that is deployed in a production environment.
8. The method of claim 1 , wherein generating the predicted outcome includes:
creating a training set of data based on the historical information about the plurality of prior development projects, wherein the training set identifies each developer that participated in each of the prior development projects; and
training a machine learning model, based on the training set of data, to generate the predicted outcome based on identities of developers in the subset of the plurality of developers.
9. The method of claim 8 , wherein creating the training set of data includes:
labeling instances of project training data with an outcome associated with each of the prior development projects; and
correlating each developer with the labeled instances of project training data corresponding to projects in which the developer participated.
10. The method of claim 1 , wherein generating the predicted outcome includes predicting at least one of:
a defect in an application in development;
a defect in an application deployed in production;
a security vulnerability in an application in development;
a security vulnerability in an application deployed in production;
a corporate governance violation in an application in development; or
a corporate governance violation in an application deployed in production.
11. The method of claim 1 , wherein taking the action includes:
identifying a developer in the subset of developers that wrote source code on which the predicted outcome is based; and
initiating an educational process for the identified developer.
12. The method of claim 1 , wherein taking the action includes:
identifying a developer in the subset of developers that wrote source code on which the predicted outcome is based; and
adjusting the subset of developers to exclude the identified developer.
13. A computing system comprising processing circuitry and a storage device, wherein the processing circuitry has access to the storage device and is configured to:
collect historical information about a plurality of prior development projects;
correlate the historical information with each of a plurality of developers that participated in one or more of the plurality of prior development projects;
collect information about an application developed by a subset of the plurality of developers;
generate, based on the information about the application and the correlated historical information, a predicted outcome for the application, wherein to generate the predicted outcome, the processing circuitry is configured to:
create a training set of data based on the historical information about the plurality of prior development projects, wherein the training set identifies each developer that participated in each of the prior development projects, and
train a machine learning model, based on the training set of data, to generate the predicted outcome based on identities of developers in the subset of the plurality of developers; and
take an action, based on the predicted outcome, to prevent the predicted outcome.
14. The computing system of claim 13 , wherein the historical information includes at least one of:
information about reliability of an application resulting from at least one of the prior development projects;
information about a defect that was present in an application resulting from at least one of the prior development projects;
information about a security vulnerability that was present in an application resulting from at least one of the prior development projects; or
results from scans of source code created during at least one of the prior development projects.
15. The computing system of claim 13 , wherein to correlate the historical information, the processing circuitry is further configured to:
identify source code written during development of each of the prior development projects.
16. The computing system of claim 15 , wherein to correlate the historical information, the processing circuitry is further configured to:
identify portions of the source code written by each member of the prior development projects.
17. The computing system of claim 13 , wherein to correlate information about the application, the processing circuitry is further configured to:
perform an assessment of each of the developers in the subset of the plurality of developers.
18. A non-transitory computer-readable medium comprising instructions that, when executed, configure processing circuitry of a computing system to:
collect historical information about a plurality of prior development projects;
correlate the historical information with each of a plurality of developers that participated in one or more of the plurality of prior development projects;
collect information about an application developed by a subset of the plurality of developers;
generate, based on the information about the application and the correlated historical information, a predicted outcome for the application; and
take an action, based on the predicted outcome, to prevent the predicted outcome, wherein the instructions that cause the processing circuitry to take an action further include instructions that, when executed, cause the processing circuitry to communicate with a network system and configure a web application firewall to prevent the predicted outcome.