A neuro-fuzzy security risk assessment system for software development life cycle

Area of Science:

• Software Engineering
• Artificial Intelligence
• Risk Management

Background:

• Software development is vulnerable to various risks throughout its lifecycle.
• Existing risk assessment methods may not adequately address phase-specific vulnerabilities.
• Securing the Software Development Life Cycle (SDLC) is critical for robust software.

Purpose of the Study:

• To develop a Software Risk Assessment (SRA) model for each SDLC phase.
• To utilize an Adaptive Neuro-Fuzzy Inference System (ANFIS) for risk modeling.
• To enhance the security of the software development process through phase-specific risk assessment.

Main Methods:

• Identified and validated risk variables for each SDLC phase.
• Collected data on risk factors and associated SRA.
• Developed ANFIS-based SRA models with risk factors as inputs and SRA as output.
• Trained and tested models using 70-80% training data and 20-30% testing data.

Main Results:

• Discovered and confirmed numerous risk variables across SDLC phases: Requirement (11), Design (8), Implementation (9), Integration (4), Operation (6).
• Formulated ANFIS models with varying inference rules per phase: Requirement (2048), Design (256), Implementation (512), Integration (16), Operation (64).
• Evaluated model performance based on accuracy using test datasets.

Conclusions:

• The ANFIS-based SRA model effectively assesses security risks at each SDLC phase.
• Implementing phase-specific SRA models contributes to a more secure software development process.
• This approach provides a systematic method for mitigating risks throughout the SDLC.