A cognitive-based evidence model for software trustworthiness evaluation
Lu Gang,Wang Huai-Min,Mao Xiao-Guang
2010-01-01
Abstract:Nowadays more trustworthy software and services are demanded to cope with the growing scale and complexity of computing systems and internet has become one of the most important sources for software acquisition,but existing trust models are challenged to evaluate the trustworthiness of the open,complex and widely-used software resources on the internet. From the perspective of trustworthy software management,software submission is more open and more frequent than the traditional way,a large number of the software are under evaluation,and the suppliers often do not present sufficient evidence for proving trustworthiness of the software they have submitted. To provide each software package with some specific evaluators is neither practical nor necessary.In order to answer the challenges,several concepts related to software trustworthiness evaluation (STE) are defined,and then an evidence model for STE used to evaluate software on the internet in a cognitive and cost-progressive way is provided. Three trustworthiness profiles of the model are proposed and explained,namely reputation,experience and mechanism. Multiple objectives under the profiles and the evidence sources of the objectives are analyzed.A software entity is trustworthy if there are sufficient reliable evidences leading evaluator and users to believe that the software will meet the users' anticipation. Our model organizes the evidences according their cognitive reliability. To assign software to higher level of trust depends on more reliable cognitive evidences provided. Reputation evidences are less reliable and can lead the software to a low level of trust. It is also the low cost way to evaluate software. The evidences of intuitional experiences of interaction with the executing software are more reliable to achieve a higher trust level. The interaction experiences are perception on software attributes such as correctness,reliability,security,privacy,safety,survivability,behavior consistency,etc. Mechanism evidences include the artifacts of software requirement,design,implementation,and proof of consistency between two adjacent development phases,as well as the reports of software fault detection and diagnosis. Sufficient credible mechanism evidences make it justified to assign software to the highest trust level. It takes more effort to provide sufficient evidences to meet the needs of evaluation.Finally,some considerations of applying the model to software evaluation are discussed. The paper offers the model only as guidance and would not want it to be seen as binding in all circumstances. It needs to be tailored to the software trustworthiness evaluation for particular domain and environment.