Component-Based Software Trustworthiness Fuzzy Analytic Hierarchy Process Model

Jounal of Beijing Institute of Technology, 2010，Vol. 19, No.2Component-Based Software Trustworthiness FuzzyAnalytic Hierarchy Process ModelSHI Jian-fei(石剑飞)，YAN Huai-zhi(闫怀志)，QIN Wei(秦玮),WANG Wen-tong(王文同)*(1. School of Mechatronics Engineering, Bejing Institute of Technology , Beijing 100081 , China; 2. School of Software,Bejing Institute of Technology, Beijing 100081, China; 3. Network Support Management Department, RegourceManagement Department, Agriculural Bank of China, Beijing 100161 , China; 4. Armament PriceManagement Center, PLA General Armament Department, Beijing 100086 , China)Abstract: For a more accurate and comprehensive asessment of the trustworthiness of component-based goft-ware system, the fuzy analytic hierarchy process is introduced to establish the analysis model. Combine quali-tative and quantitative analyses, the impacts to overall trustworthiness by the different types of components aredistinguished. Considering the coupling relationship between components，dividing the system into several lay-ers from target layer to scheme layer, evaluating the scheme advantages disadvantages by group decision-mak-ing, the trustworthiness of a typical J2EE structured component-based software is assessed. The trustworthinessa8ses model of the software components provides an efective methods of operation.Key words: component-based software ; trustworthiness analysis; fuzzy analytic hierarchy process; J2EE strue-tureCLC number: TP 393Document code: A Article ID: 1004-0579(2010)02-0170-07Software is a key part of information system. Soft-precise definition of components in functions, softwareware failure can cause a large number of disasters. Assystem can be built by components easily. Softwarean integrated indicator of the software failure, trustwor-componentizing technology has become an inevitablethiness has been highly concerned. Trustworthiness is adevelopment trend, but components will bring securitynew concept generating from several concepts, such asproblems. The issues of component-based softwarereliability，availabiliy, testability， maintainability,trustworthiness become more and more important, howsafety and security. It's a. comprehensive reflectionto accurately a88ess the trustworthiness of component-about the various properties of a software"based sofware become a hot spot.I's generally believed that the software's “trust-Component-based software trustworthiness is com-worthiness”means that the dynamic behavior of soft-plex and ambiguous, 80 its evaluation needs to intro-ware systems and the results are according with expec-duce the fuzzy analysis. In order to reduce component-tations，which can continuously provide continuousbased software system assessment complexity, the a8-services under interferences' 2 -3。Accurate and com-sessment form should be divided into several layers.prehensive assessment of software trustworthiness is e8-Therefore, we introduce the fuzzy analytic hierarchysential to build highly trustworthy software. Componentprocess ( FAHP ) into component-based software trust-technology is an extension of the object-oriented devel-worthiness assessment, distinguishing different impactsopment technologies. Because of the dispersion andof different types of components on the system's trust-中国煤化工Received 2009-05-05Sponsored by the National High Technology Research and Development Program CMHCNMHG433)Biographies SHI Jian-ei(1982 - ), doctoral student, jshi0311@ 163. com; YAN Huan-zh1(19/5-儿, 8ss0clatle prolessor.一170一SHI Jian-fei(石剑飞) et al. / Component-Based Sofuare Trstworthiness Fzy Analyrie Hierarchy Process Modelworthiness , and proposing the general assessment mod-impacts of different components on the system, the per-el of component-based softw are trustworthiness. Apply-formance of interface between components, differenting this model to an example, the experiment resultsensitive extents to the trustworthiness of componentsshows that the model provides a new approach to assesswhich provided various services.the trustworthiness of component-based software; it can2 FAHP Stepsassess the trustworthiness more comprehensively andaccurately.Analytical hierarchy process ( AHP) is a muli-1 Component-Based Software Trust-objective decision method which is a combination ofqualitative analysis and quantitative analysis. I's pro-worthiness Compositionposed in the twentieth century the seventies by Profes-Software trustworthine8s is a comprehensive con-sor T. L. Saaty. This method quantifies a number ofcept deriving form reliability, availability ，integrity,qualitative factors in order to provide the basis of quan-maintainability, security, and safety. Most recent re-titative evaluation and decision-making. Combining thesearches focus on software reliability model, softwarefuzzy mathematics theory and the AHP, FAHP con-formalization theory and validation， software defectstructs a fuzzy matrix firsly, and then changes theanalysis theory, the system survivability and so on.qualitative valuation to quantitative valuation throughMost of these researches take the certain aspect(s) ofthe fuzzy matrix judge. In order to solve the consisten-he trustworthiness into account'Because of thecy problem, construct fuzzy consistency judge matrixemergent property of system trustworthiness factors, theby fuzzy judge matrix. The fllwing are the basic stepstrustworthiness is not the simple overlay of a number ofof FAHP analysis:attributes; sofware trustworthiness assessment is an①Divide the target analysis into several layers;analysis process of synthesize qualitative and quantita-②Construct fuzzy judge matrix, calculate weighttive factors. Decomposition elements of the trustworthi-factors in each layer;ne8s are shown in Fig. 1, the decomposition has dem-③Construct evaluation matrix about scheme layeronstrated in Ref. [1].using group decision-making, calculate the evaluation厂relabilityfrom the low to the high layer;④Give a comprehensive evaluation of the target.I tuslworhiness Isofware广sprunityintegrityC mafry ]3 Component-Based Software Trust-Fig. 1 Software trustworhinese decompositionworthiness A ssessment ModelComponent-based software trustworthiness not onlyComponent-based software trustworthiness assess-has the common atributes of software trustworthiness,ment model combines the characteristics of component-but also has the features caused by component cou-based software and FAHP. Ceneral model establishpling. At present, the main component technologysteps are as follows.standard include OMG's COBRA, Microsoft's COM/.1 Establishment of Component-Based SoftwareDCOM/COM +，Sun's EJB, etc. Components can beTrustworthiness Assessment Hierarchyprovided by the standard components and can also beAccording to the characteristics of component-developed.based software, we will decompose the trustworthinessDifferent components of the system provide differ-analysis into four layers. They are the target layer (T:nt services to external through interfaces. V ariouslayer)attribute layer (A中国煤化工services have the different impacts on the trustworthi-layer:layer), the archi-ness of the system. The analysis of component-basedtecturTYHCNMHGsoftware trustworthiness needs to consider the differentT layer is the final result of the assessment, which一171一Journal of Beijing Insitute of Technology, 2010, Vol. 19, No. 2layer, the impact weight is reduced according the first,compnnent-hased softwarptrustworthinessecond, third order. Components interface (C.) hasLarget layer .the same weights as second-class components. Expressfinst-rlassthid-rlasromponentcomponentthe diferent weights by coefficient 山，,山and μs,pevund-lasswhich represent corresponding impact weight of C,compnnentinterfaceeriterion layerCz, Cz, C(whereμ >μz =μs >u) respectively.reliahility[ maintainabiy ]Trustworthiness of each factor in C layer is deter-availabilitysecuritymined by some atributes in A layer. Attributes in Aintrgritysafelylayer, such as reliability (A,), availability (A2), in-atribute lategrity (A;), maintainability (A.), security (A;) andsubatributes about peach atrihutesafety (A6), have different impact weights on certainsubratibute layerfactor in C layer. Express the different attributes'Fig.2 Component-based softw are trustworthinessweights by coefficient λ，入2, λz, λo，λs and λ6，decomposition layerwhich represent corresponding impact weight of A，is determined by the trustworthiness of different compo-A2，Ag, A., As, A。respectively ( where λ = λz > .nents in the C layer. C layer divides the component in-λz=λs>λs=λ6).to four classes, the first-class is key component (C),Six factors in A layer are determined by the differ-the second-class is important component (C2)，theent options of sub-attribute layer (S layer), as shownthird-class is general component ( C, ). To targetin Tab. 1.Tab. 1 Decomposition of factors of attribute layer fftected by scheme layerattributereliabilityintegritymaintainabilitysafetyfailure probabilty cos-platform mi- metadata integrity documentcom- completenese of the Ii- component sourceper unit timegration abilty.pletenesscensing mechanismconsistency nccess control poliey operation loggingbubatribute tween failurestion capacitymation integrityrulesreasonablenessaveragedefects Adaptive eapacity of components back- test case coverage communications pro- component contain-number of kilo lines the assemnbly couground informationtection mechanismsem stbilitycodeponentsintegityFor each attribute, Tab. 1 determines three impactfuzzy matrix about the weight of factors in all levels thatschemes for each attribute according to its characteris-infuence the upper layer and to express the relativetics and the requirements of the attributes. For exam-importance of factors in the same layer to certain factorple, factor A is determined by the subatribute failurein the upper layer. The meanings are shown in Tab. 2.probability per unit time (Sn), average time betweenTab.2 0-1 five scale meaningfailures (S2), average defects number of kilo lines0-1 five 8calemeaningcode ( Su). Express the diferent subattributes'0Compare to N,M is extremely minorweights by coefficient 81, 812， 813, which represent.2Compare to N,M is minorthe impact weight of Su, SIz, Sn, respectively. e1>M a same important a N8p2>8g. Similar states will be existed for the factor0.8Compare to N,M is majorAz-As, 8n>8a>8a,ie[2,3,4,5,6].3.2 Construction of Fuzzy Judgment Matrix and中国煤化工mjo_____Calculation of Corresponding Weight VectorYHC N M H Gbtained from fuzzy0-1 five scale is used to construct complementary complementary matrix through fllowing steps0- 1” .一172-SHI Jian-fei(石剑飞) et al. / Componenl-Based Sofrvare Trustworthiness Fuzy Analytic Hierarchy Process ModelStep 1 According to actual situation ，constructSimilarly , construct fuzzy complementary matrix ofthe complementary judgment matrix of impact weight;A layer and S layer, then construct fuzzy consistencymatrix, and calculate the sort vector about A layer andStep2 Sum the matrix by line: τ == Ea,i=S layer for a certain factor in upper layer.1,2,",n;Each factor in the atribute layer to the second-Step3 Translate after Step 2, ry=(r-r)/2class component, third-class component， interface(n-1) +0.5, get the fuzzy consistent matrix: R =component weight is expressed by vector Ua, Ua，(ry)oxn;Uc. The results are as follows.Step4 Normalize the line of matrix R, get sortUa=[0.317, 0.317, 0.227, 0. 140],vector U=[u, u,"",u.].Uc=[0.650, 0. 350]，From the target layer,construct complementaryUa= [0.317, 0. 317, 0.227, 0. 140].matrix T according to four class components in c layerAs shown in Tab. 1, the reliability, availabilityto the different impacts of the overall trustworthiness.and other factors in A layer, is determined by the dif-「0.5 0.8 1.0 0.8]ferent factors combination of S layer. According to the0.20.5 0.8 0.5characteristics of component, the impact of each factor0 0.2 0.5 0.2in Tab. 1 on the reliability, availability and others is0.2 0.5 0.8 0.5_reduces from top to bottom. The impact weights of dif-Calculate fuzzy consistent matrix R，ferent factor are three level arithmetical. The impact「0.500 0.683 0.867 0.6831weights of factors in S layer to each factor in A layer0.317 0.500 0. 683 0. 500are expressed by UA, Un, Us, Uu, Us, Us6.Rr:0.133 0.317 0. 500 0.317Un=[0.47, 0.33, 0.20]=Un2=L0.317 0.500 0.683 0. 500」Us=Uu=Us=Us6.Get sort vector U, = [0. 342, 0. 250, 0. 158,completely constructing weight vector of0. 250], which expressed the relative weight of factorscomponent-based software factor in each layer for thein C layer to T. Six factors in A layer which related tocertain factor of the upper layer, then construct anthe first class, the impact sort for factor c as matrixevaluation matrix from the bottom to the top layer.3.3 Construction of Evaluation Matrix from S「0.5 0.5 0.8 0.8 1.0 1.07Layer to C Layer0.5 0.5 0.8 0.8 1.0 1.0Step 1 Using results of the evaluation by the0.2 0.2 0.5 0.5 0.8 0.group to build evaluation matrix..2 0.2 0.5 0.5 0.8 0.8Each factor in S layer is divided into four levels :0 0.2 0.2 0.5 0.excellent, good，medium and poor, corresponding to a0 0.2 0.2 0.5 0.5」percentile score column vector S。= [90,75 ,60,45]",「0.50 0.50 0.66 0.66 0.82 0. 82]the element eg of matrix E.x4 means that the proportion0.50 0.50 0.66 0.66 0.82 0. 82of the people whose assess factors from i level to j level0.34 0.34 0.50 0.50 0. 660. 66among all the people take part in the assment.Rc=0.34 0.34 0.50 0.50 0.66 0. 66Step 2 Calculate evaluation proportion vector of0.18 0.18 0.34 0.34 0.50 0.50factors in S layer to factor in A layer.0.18 0.18 0.34 0.34 0.50 0.50」Such as evaluation proportion vector of the relia-Calculate the sort vector, which is the attributebility relevant factors: V. =U。xEg. similarly, cal-layer relative weight about the first-class component inculate中国煤化工，proportion vectorC layer.ofS l2:YHCNMH GUc =[0. 220,0. 220,0. 167 ,0. 167 ,0.113,0.113].Step 3 Obtain the evaluation vector of S layer一173一Journal of Bejing Instiute of Technology, 2010, Vol. 19, No. 2from step 2, calculate the evaluation proportion vectorattributes as failure probability per unit time, averageofA layer to C layer.number of defects per thousand lines of code, accessEach factor evaluation in C layer is determined bycontrol strategy and so on. Qualitative evaluation isdifferent factors evaluation in A layer, such as C is re-used for such as the adaptive capacity of the assemblylated with six factors in A layer.components, component soure, and integrity of com-Ec=[Vn, Va, Va, Vu, Vn, V6]°.ponents background information and so on. AccordingAfter get V1 - VM6，we can obtain Ec，becauseto the result of testing and evaluation, conclusions asUc has obtained, then the evaluation proportion vector[ excellent, good, medium, poor] are given.about A layer to the factor c, in C layeris Vc=Ua xUsing group decision -making methods, each deci-Ec. Vc, Va，Va can be got similarly.sion-maker in the group should not affect others andStep4 Obtain the evaluation proportion vector ofshould give an independent evaluation. Establishing 10A layer to C layer from step 3, calculate the evaluationmembers for the evaluation team, some factors combi-proportion vector from C layer to T layer.nation in S layer which affects certain factor in A layerFrom the above calculation results obtain the eval-is evaluated. The reliability factors A, in A layer is de-uation proportion vector from C layer to T layer.termined by the factor in S layer such as failure proba-E,=[Va, Va, Va, Va]",bility per unit time S;, average time between failuresV,=UrxE. .Sq, the average number of defects per thousand of lines3.4 Comprehensive Evaluation of the Targetcode Sg. Following are the group evaluation results.According to the evaluation scores vector, theS1[0.5 0.2 0.2 0.17component-based software system trustworthiness scoresEn=S2|0.3 0.4 0.2 0.1can be calculated.S3L0.4 0.4 0.2 0 」S=V, xS。.Similarly, according to results of the group evalu-According to the scores and system requirementsation, C layer to B, - B。in B layer group evaluationon the scores, the trustworthiness scores of the systemmatrice are established as follows.is qualified or not can be judged. Generally believed0.4 0.2 0.2 0.27that to the normal system, when the score is more thanEx=|0.2 0.5 0.2 0.160 points can be judged to be qualified.L0.2 0.4 0.2 0.2」「0.20.800、4 ExperimentsE,=0.3 0.1 0.2 0.4An armament information management systemL0.3 0.5 0.20..based on the J2 EE framework is a typical component-「0.1 0.4 0.2 0.37based software. Using the method proposed in this arti-E:=|0.3 0.4 0.3 0cle to evaluate the trustworthiness of the system. DataL0.4 0.4 0.20」base operations component is defined as critical compo-「0.2 0.5 0.2 0.1nent, Java Servlet and JSP component which runningEs=0.2 0.4 0.3 0. 1on the server such as J2EE server (Tomcat is used inL0.2 0.4 0.4this system ) component is defined as important compo-「0.4 0.3 0.2 0.1]nent, applications and applet which running on the cli-E:6=|0.2 0.4 0.3 0.1|.ent is defined as general components. First of all,0.1 0.4 0.2 0.3」combinate quantitative tests and qualitative evaluation,As known U. = [0.47, 0.33, 0.20]，fromevaluate the factors which impacting relibility，availa-Vμ中国煤化工bility and other atribute respectively.fYHCNMHG,0.080].First, quantitative tests are applied to such sub-Similarly we getSHI Jjian-fei(石剑飞) et al. 1 Component Based Sofuware Trustworthiness Fuzy Analyric Hierarchy Process ModelVx=[0.294, 0. 339, 0. 200, 0. 167]，this paper gives a combination of qualiative and quan-Vs=[0.253, 0. 509, 0. 106, 0. 132],titative method of the component-based software trust-Vμ=[0.226, 0. 400, 0.233, 0. 141],worthiness assessment; it's a new and effective methodVs=[0.200, 0.447, 0. 237, 0. 080],to evaluate the trustworthiness of the component-basedV%6=[0.274, 0. 353, 0. 233, 0. 140],software.Ec=[Vn，Vx, Vs, Vu, Vs, VnJ]'.Our further research is directed towards the fol-As known Ue = [0. 220,0.220,0.167,0. 167，lowing works:0.113,0.113]. Va =Uc xEc = [0.289, 0. 386,①Consider the different impacts of different sort0.198, 0. 127].member. Give the corresponding weight value to theSimilarly, Ec=[Vn, Va, Vs, Vs].conclusions according to the level of participating mem-Getber.Va=[0.320, 0.351, 0. 193, 0.136]，②Consider the factors amount of each type ofVa=[0.348, 0. 339, 0.212, 0. 101],component，as different systems have different 8-Vo=[0.304, 0.358, 0.213, 0. 122].mounts, take this into account and build up a commonAs known,weighted method， it can enhance the applicationUτ= (0.342,0.250,0.158, 0. 250),breadth of the model.Er=[Vn，Vo, Vs, vu]',③Try to find the weakness based on the judg-V,=U,xE,=[0.320, 0. 364, 0.221, 0. 115].ment results, and then give proposals about how to en-Component-based software system score is as fol-hance the trustworthiness of the aystem.lows.S=V_xSo=[0.320, 0.364, 0. 201, 0.115]xReferences:[90, 75, 60, 45]" =73.4.[1] Liu Ke, Shan Zhiguang, Wang Ji, et al. Overiew onThe trustworthiness of the system meets the re-major research plan of trustworthy software[J]. Bulletinquirement. Score of the system more than 60 points isof National Natural Science Foundation of China, 2008qualified, while less than 60 points need to be re-ex-(3):145 -151. (in Chinese)[2Li Xiaoyong, Zuo Xiaodong, Shen Changxiang. Systemamined and adjusted.behavior based trustworthiness attestation for computingConclusionplatform[J]. Acta Electronica Sinia, 2007, 35 (7):1234 - 1239. ( in Chinee)In this paper, we introduce FAHP to resolve the[3] Lin Chuang, Peng Xuehai. Research on trustworthy net-complexity and ambiguity in the evaluation of the com-works[J]. Chinese Journal of Computers，2005 ,28(5):ponent-based software trustworthiness. Based on analy-751 -758. ( in Chinese)zing the characteristics of component-based software ,4] Jamieson M Cohleigh, Lori A Clarke, leon J Osterweil.classify component-based software into different typesFLAVERS-A finite state verification technique for softwareaccording to different impacts on the overall componentsystems[J]。IBM Systems Jourmal, 2002, 41(1): 140- 161.trustworthiness, and distinguish different types of fac-tors which have different impacts on the overall compo-[5] Toscano R, Lyonnet P. 0n-line reliability prediction viadynamic failure rate model [ J]. IEEE Transactions onnent trustworthiness. Decompose the trustworthiness ofReliability, 2008 ,57(3) :452 -457.each type of components, the specific sub-attribute in[6] Hall J Brian, Mosleh Ali. A reliability growth projetionS layer according to the decomposition properties layermodel for one-shot systems [ J ]。IEEE Transactions onis given, and then the sub atribute is judged by groupdecision-making.[7]中国煤化工。ofware rliabilitiy &A typical J2EE component-based software exam-YHC N M H Ge and infnite severple has proved that the evaluation method proposed inqueueing models[J]. IEEE Transactions on Reliability ,一175-~Joumnal of Beijing Institute of Technology, 2010, Vol. 19, No. 22008 ,57(1):192 - 203.[C] // Proceedings of the 10th International Conference[8] Christie Alan M. Network survivability analysis using ea-on Enterprise Information Systems. Barelona, Spain:sel CMU/SEI-2002-TR-039， ESC-TR-2002-039 [ R ].ICEIS, 2008:161 - 168.PennsyIvania, USA : Sofware Engineering Institute, Car-[12] Gao Huisheng, Ran Jingxue, Sun Yiqun. Risk evalua-negie Mellon University, 2002.tion of communication network of electric power based on[9] KoromaJ, Li Wei, Kazakos D. A generalized model forimproved FAHP[ C] // Proceedings of the 4th Intema-network survivability[ C] // Proceedinga of the 2003 Con-tional Conference on Fuzzy Systerms and Knowledge Dis-ference on Diversity in Computing. Atlanta, USA: ACM ,covery. Hainan, China; FSKD, 2007 :653 - 659.2003:47 -51.[13] Hosam Mahmoud. Ahmad Fahmy: Reliability evalua-[10] Xu Zeshui. Algorithm for priority of fuzzy complementa-tion in distributed computing environments using theny judgement matrix[J]. Jourmal of Systems Engineer-AHP[J]. Computer Networks, 2001 ，36 (5/6):597 -ing, 2001 ,16(4):311 -314. (in Chinese)615.[11] Liu Kinchung， Kehoe Dennis F, Li Dong. A FAHP-( Edited by Wang Yuxia)based technology selection and specification methodology中国煤化工MYHCNMHG一176-