Software Trustworthiness Static Measurement Model And Its Tool

Due to the high incidence of software,software trustworthiness has become one of the prominent studies in software quality assurance,in which the trustworthi-ness measurement is the primary topic.Compared with the method to evaluate the software development process,measuring the entity of software better fits users'requirement.In this paper,we propose a bottom-up method of software trustwor-thiness measurement based on the source code,which will make the measurement results more accurate and efficient.Firstly,we give the definitions of untrustworthiness and untrustworthy evi-dences.Analyzing the root causes of the major software accidents can help us collect the typical untrustworthy evidences.For a better understanding of untrust-worthy evidences,we classify these evidences into three categories.For each type,we give a way to analyze the trustworthiness respectively.In order to measure the trustworthiness of attributes,we match every untrustworthy evidence with software attributes by their effect.The untrustworthy evidence model has been applied to Common Weakness Enumeration(CWE).Secondly,this paper presents a bottom-up method to implement the stratified measurement for software trustworthiness.For the trustworthiness measurement of attributes,a comprehensive model is proposed.This model is composed of two parts.The first part is based on trustworthy properties,and the other on the un-trustworthy evidences in program.For the trustworthiness measurement of software,this paper utilizes the existing attribute-based measurement model.Furthermore,we develop a method based on the interaction of attributes to determine the weight of each attribute.The model has been verified by the Monte Carlo simulation.Thirdly,the trustworthiness measurement of software is implemented based on the open source static detection tool Cppcheck,and then customized rules are added to detect untrustworthy evidences.We name this integrated tool TSMT.The framework and tool presented in this paper form a complete software trust-worthiness measurement system.It can be used to predict the trustworthiness of software before the delivering to users.Moreover,the system can help the users to understand the trustworthiness of software.