# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 4 The Experimental Results
### The Results of the Proposed ANFIS Enabled with SRA Model  
The results of the ANFIS model is presented in this section in accordance with the chosen risk factors in the preceding section. For each SDLC step that was identified, an SDLC security risk assessment model was created based on the proposed model. The proposed model first fuzzify each risk factor before processing it. Figure 5 depicts the ANFIS model's framework utilized the established SRA based on the factors identified in each SDLC process phase. The information flow from the point of input is depicted in the diagram (at the bottom) when the SRA for each stage was established fed the ANFIS model at the point of output (at the top). The total amount of the user-provided information was calculated to established the each SRA for the SDLC phase. The greater the summation value, the greater the security risk as 1 was applied each time a user responded number that was equivalent to 1. The quantity of risk factors taken into account led to the highest sum being computed, afterwards split into three segments that serve as the threshold as indicated in Equation (1), however, the no-risk class is assigned 0 value. As a percentage of the phase output's overall values, an interval was created using the various components. Figure 4: Research Methodology Process. For the risk assessment, four triangle membership functions with centers of 0, 1, 2, and 3 were developed for No, Low, Moderate and High-risk classes, respectively. The models were formulated such that a triangular membership function of the interval [\(-\)0.5, 0, 0.5] was assigned to the No risk class (Equation (4)), an interval of [0.5, 1, 1.5] were also assigned to the Low risk (Equation (5)), an interval of [1.5, 2, 2.5] were assigned to the Moderate risk (Equation (6)) while an interval of [2.5, 3, 3.5] was then assigned to the High-risk class (Equation (7)). The set of values used to allocate the security risk assessment variables was based on the amount of risk variables taken into account throughout each SDLC phase and distributed as shown in Table 7.  
The requirement analysis and definition phase's SRA report revealed that 11 high-priority risk factors had been chosen. By assigning a value of 0 to No risk, the total value of 11 was divided between the Low, Moderate, and High-Risk classes. Therefore, no risk was assigned a linguistic value of 0, low risk was assigned a linguistic interval of [1.4], the moderate risk was assigned a linguistic interval of [5.8], and high risk was assigned a \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**SDLC Process Stages** & **Risk Factors** & **No [\(-\)0.5, 0, 0.5]** & **Low [0.5, 1, 1.5]** & **Moderate [1.5, 2, 2.5]** & **High [2.5, 3, 3.5]** \\ \hline Requirement Analysis & & & & & \\ and Definition Phase & 11 & 0 & [1.4] & [5.8] & [9.11] \\ Design Phase & 8 & 0 & [1.3] & [4.6] & [7.8] \\ Implementation and & & & & & \\ Unit Testing Phase & & & & & \\ Integration and & & & & & \\ System Testing Phase & & & & & \\ Operation and & & & & & \\ Maintenance Phase & 6 & 0 & [1.2] & [3.4] & [5.6] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Description of Fuzzy and Crisp intervals of ANFIS security risk assessment labels. Figure 5: The proposed framework for SRA in software development stages. linguistic interval of [9.11]. Therefore, the linguistic value of 0 was assigned a fuzzy interval of [\(-0.5\), \(0\), \(0.5\)] for no risk, the linguistic interval of [\(1.4\)] was assigned a fuzzy interval of [\(0.5\), \(1\), \(1.5\)] for low risk, the linguistic interval of [\(5.8\)] was assigned a fuzzy interval of [\(1.5\), \(2\), \(2.5\)] for moderate risk while the linguistic interval of [\(9.11\)] was assigned a fuzzy interval of [\(2.5\), \(3\), \(3.5\)] for high risk. The design phase's SRA result revealed that 8 high priority risk factors had been chosen. By assigning a value of 0 to No risk, the total value of 8 was divided between the Low, Moderate, and High Risk classes.