An Approach to Cognitive Root Cause Analysis of Software Vulnerabilities

Understanding the root causes of software vulnerabilities is crucial for designing and implementing preventative measures. Given that software development is inherently a human activity, developers' cognitive errors stand out as a significant contributor to software vulnerabilities. While existing studies on vulnerability analysis focus on software faults associated with vulnerabilities or types of vulnerabilities, there exists a gap in understanding how software vulnerabilities stem from developers cognitive errors. This paper proposes a novel method, Cognitive Analysis for Software Vulnerabilities (CASV), aimed at identifying the cognitive mechanisms of how software vulnerabilities are introduced by software developers. CASV includes a set of cognitive patterns established in psychology and a modeling approach to bridge the gaps between patterns and software development contexts. Two empirical studies conducted to apply and assess the CASV method. The studies involved four analysts performing root cause analysis on 152 software vulnerabilities. The results indicate that CASV was able to explain the cognitive mechanisms behind 70% (106 out of the 152) software vulnerabilities. Furthermore, CASV significantly improves the reliability of vulnerability root cause analysis. It achieved an agreement level of 0.63 among four analysts within the range of Substantial Agreement, compared to 0.29 when using a root cause taxonomy. The implications of this study are far-reaching, particularly in terms of raising developers' awareness and enhancing their cognitive skills to proactively prevent software vulnerabilities.