## 4 CyberSPL: Cybersecurity Software Product Line
### CyberSPL Implementation  
The CyberSPL architecture is modular, and it includes as main modules a user management module, a platform management module, and a feature model management module as shown in Figure 6. CyberSPL is integrated with the FAMA framework via a REST API (cf., CyberSPL API REST) to integrate reasoning characteristics. In this respect, the FAMA framework uses ChocoSolver (ChocoSolver: [[http://www.choco-solver.org](http://www.choco-solver.org)]([http://www.choco-solver.org](http://www.choco-solver.org))) reasoner which enables the analysis and reasoning with feature models. CyberSPL and public models are free accessible for the community at [[https://estigia.lsi.us.es/cyberspl](https://estigia.lsi.us.es/cyberspl)]([https://estigia.lsi.us.es/cyberspl](https://estigia.lsi.us.es/cyberspl)). CyberSPL is designed as a cross-platform and multi-user web solution. The user only needs a web browser to register and to use it. The public models are available in CyberSPL for all users of the community, and users are able to create their catalogue of models as shown in Figure A1 at the appendices. In the public repository, the feature models can be consulted and analysed but not edited. Moreover, in Figure A1 it is shown how to edit a CyberSPL model in a formal way (i.e., FAMA format) or graphically as is shown in Figure A2. The models of a user can be private and exclusive for his/her, or public and available for every user. In contrast, in the user private repository, each model can be edited, deleted, or analysed. Figure A1 shows a private repository of a user, but some models have been established as public (cf., Toy Model). As aforementioned, the edition of existing feature model automatically creates a new version of this model. Thus, CyberSPL presents a track record (i.e., versioning history) to enable a version control of feature models (cf., Version History button in Figure A1). At the appendices, Figure A3 shows in background the versioning history with a track record of versions of model shown in Figure 1. The focused window highlighted one of the tracked changes using the _Show Diff_ button. For each model, CyberSPL enables the editing, deleting, and performing an analysis. The analysis section provides for main options as shown at the appendices in Figure A4: (1) to validate model; (2) to diagnose compliance of a configuration and a cybersecurity policy; (3) to obtain all valid configurations for cybersecurity policy, and; (4) diagnosis with regard to the history. In Figure A4 (cf., Appendix A), the option of diagnosis a configuration is selected, and a specific configuration has been introduced and compared by CyberSPL with the model previously shown in Figure 1. The results of the operations performed on the model are available for the user in a panel (cf., Analysis Console). CyberSPL has an option to save externally in a JSON format, the obtained configurations. This option is named _Export configurations_ and it is below the option to obtain all configurations. Although CyberSPL has been created with the aim of analysing security using SPL techniques, it also provides characteristics that differentiate it from the rest. In general, most of the tools provide a modeller (i.e., in formal or graphical way) and automated analysis similar to CyberSPL. A comparison of CyberSPL with regard to non-commercial tools has been done in Table 2, but the comparison has been focused on the next aspects: (1) _Web_, if a distributed and multi-user tool is provided; (2) _Diagnosis_, if the tool supports diagnosis mechanisms; (3) _Private catalogue_, if the tool supports the development of a catalogue of models per user; (4) _Public catalogue_, if the tool allows users to share their models publicly; (5) _Historical_, if the tool allows the versioning of models and maintain a history of these versions per model. Figure 6: CyberSPL architecture.