# Security Monitoring during Software Development:
## 3 Methodology
### Implementation and Deployment of the VM4 SEC Platform  
As depicted in Figure 1, the final step of our process is the actual implementation and deployment of the VM4 SEC security monitoring platform. We decided to build the VM4 SEC platform as a cloud-based web application. The reasoning behind this choice was the fact that the Cloud provides (i) increased visibility, (ii) high accessibility (via the Internet), and (iii) ease of use (since the tedious part of installing the application is avoided). In addition to this, the final application is independent of the final platform and operating system on which the end users work, thus providing a cross-platform experience that would be difficult to achieve in the case of offline applications. Among the various architectural patterns for building cloud-based applications [46; 61; 62], we decided to use the _Microservice Architecture (MOA)_ pattern [63] over the traditional Service-oriented Architecture (SOA) pattern. Both patterns are based on the concept of implementing the main functionalities of the application as individual services. The main difference between the two patterns is that while SOA requires all the services to be centrally implemented in the form of a monolithic application, in MOA, similar functionalities are grouped into components (i.e., microservices) with their own lifecycles, which can then be distributed over a network. These services can then collaborate together in order to form a broader application. Some of the main advantages of MOA over SOA (which helped us reach our final decision) are listed below [63]:  
* Microservices can be deployed independently;
* Microservices can be implemented using different technologies;
* Microservices can be developed quickly, and deployed and maintained by a small, independent team;
* Microservices offer modular maintenance. A high-level view of the VM4 SEC platform following the MOA pattern is provided in Figure 16. As can be seen in Figure 16, each one of the main modules of the overall platform, namely the quantitative security assessment and the vulnerability prediction modules, is implemented as an individual microservice. These microservices expose their functionalities through RESTfull APIs, in order to facilitate their utilization by third-party applications. A web user interface (UI) is also provided in order to facilitate the utilization of the security monitoring services by non-technical stakeholders and provide inference through proper visualization of their results. The overview presented in Figure 16 is in line with the component diagram presented in Figure 12.  
For the actual deployment of the microservices, the Docker Engine was used. Docker is an Enterprise Container Platform that allows applications to be packaged as individual containers along with their required parts (e.g., tools, configuration, dependencies, etc.) and communicate with each other through dedicated channels. In fact, the microservices of the VM4 SEC Platform are implemented as individual Docker Images, which are then deployed as independent Docker Containers. Docker encompasses a set of key features that played an important role in our final selection. First of all, each microservice (i.e., Docker Image) can be developed independently of one another, adopting different tools, frameworks, configurations, etc., without posing any restrictions to the other microservices. Hence, Docker provides flexibility in the sense that it allows individual applications to be implemented using highly different languages and technologies, encouraging in this way agile software development. In addition, the \begin{table}
\begin{tabular}{l l l} \hline \hline
**Evaluation Metric** & **Sequences** & **BoW** \\ \hline Accuracy & 85.87 & 83.06 \\ Precision & 81.20 & 85.70 \\ Recall & 91.25 & 79.50 \\ F\({}_{1}\)-score & 85.83 & 82.43 \\ F\({}_{2}\)-score & 88.98 & 80.63 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: The evaluation metrics of the vulnerability prediction model.