Method and system for identifying suspicious code contribution to a source code repository

A system for identifying suspicious code contribution of a user to a source code repository, the system comprising:

• a processor;
• and
• a memory communicatively coupled to the processor, wherein the memory stores processor instructions, which when executed by the processor, cause the processor to:
• receive a plurality of updated code files of the source code repository through an event, wherein each of the plurality of updated code files is updated by a set of user actions, wherein the set of user actions comprises at least one of an addition, a deletion, and a modification made by the user, and wherein the event is triggered in real-time when at least one of the plurality of updated code files is pushed to the source code repository;
• extract a plurality of user action parameters from the event corresponding to each of the plurality of updated code files, wherein the plurality of user action parameters comprises a file name, a user name, a timestamp of each of the set of user actions, a description of each of the set of user actions, and user comments;
• store the plurality of updated code files and the plurality of user action parameters from the event corresponding to each of the plurality of updated code files in a database, wherein the database comprises a table with a column for each of the plurality of user action parameters;
• and
• identify at least one user action from the set of user actions as a suspicious code contribution of the user for at least one of the plurality of updated code files of the source code repository based on the plurality of user action parameters, wherein identifying the at least one user action from the set of user actions as a suspicious code contribution comprises:
• for each of the plurality of updated code files,
• comparing the timestamp of each of the set of user actions with a timestamp of most recent of previous actions performed on an updated code file;
• establishing a user action as a suspicious code contribution when a difference between the timestamp of the user action and the timestamp of the most recent of the previous actions is below a predefined threshold and the user action is performed by a new author;
• and
• establishing a user action as a suspicious code contribution when a difference between the timestamp of the user action and the timestamp of the most recent of the previous actions is greater than a predefined threshold.

A non-transitory computer-readable medium storing computer-executable instructions for identifying suspicious code contribution of a user to a source code repository, the computer-executable instructions configured for:

• receiving a plurality of updated code files of the source code repository through an event, wherein each of the plurality of updated code files is updated by a set of user actions, wherein the set of user actions comprises at least one of an addition, a deletion, and a modification made by the user, and wherein the event is triggered in real-time when at least one of the plurality of updated code files is pushed to the source code repository;
• extracting a plurality of user action parameters from the event corresponding to each of the plurality of updated code files, wherein the plurality of user action parameters comprises a file name, a user name, a timestamp of each of the set of user actions, a description of each of the set of user actions, and user comments;
• storing the plurality of updated code files and the plurality of user action parameters from the event corresponding to each of the plurality of updated code files in a database, wherein the database comprises a table with a column for each of the plurality of user action parameters;
• and
• identifying at least one user action form the set of user actions as a suspicious code contribution of the user for at least one of the plurality of updated code files of the source code repository based on the plurality of user action parameters, wherein identifying the at least one user action from the set of user actions as a suspicious code contribution comprises:
• for each of the plurality of updated code files,
• comparing the timestamp of each of the set of user actions with a timestamp of most recent of previous actions performed on an updated code file;
• establishing a user action as a suspicious code contribution when a difference between the timestamp of the user action and the timestamp of the most recent of the previous actions is below a predefined threshold and the user action is performed by a new author;
• and
• establishing a user action as a suspicious code contribution when a difference between the timestamp of the user action and the timestamp of the most recent of the previous actions is greater than a predefined threshold.