## 2 Related Work
### Comparison  
In this work, we present the CompoSecReasoner framework that monitors system and the ongoing changes, and evaluates the security, privacy, and dependability status. CompoSecReasoner utilizes an event and model-based approach and it implements dynamic system composition verification, properties validation, and automated administration based on metrics. As we know, no such method has been developed so far, combining the four design operations which are described in the introductory sections.  
Related composition and management techniques are either general methodologies [28; 29; 30; 31; 32; 33; 34; 35] or cover specific security issues [36; 37; 38; 39; 40; 41; 42; 43; 44; 45; 46; 47; 48; 49; 50; 51; 52; 53; 54; 55; 56; 57; 58], none of which fulfils the targeted design requirements. For most composition techniques (e.g., [28; 30; 52]), the composition verification is modelled as interfaces, inputs/outputs, or plug-ins of the composing components. Then, validation methodologies can verify security properties based on theorems, polices, or contracts (e.g., [44; 45; 46; 47; 48; 49; 50; 51; 52; 53; 54; 55; 56; 57; 58]). Thereupon, methods that quantify security can evaluate the finally composed system (e.g., [45; 52]). Metric-driven administration and MTDs assess the possible system states and defend the system in real-time [56; 57].  
For the composition verification procedure, CompoSecReasoner presents a novel feature, defined as _operation_ (see Section 4.3). An operation is a series of actions (such as protocols and technologies) that two components have to execute in order to be incorporated and work together. The abstraction level that is offered under this formalism is sufficient for modelling an actual application domain, in contrast to the interface and input/output proposals which are becoming quite modelling-intensive in the field of heterogeneous embedded systems.  
For system properties validation, related methodologies apply either pre- or post-validation techniques, modelling a relevant sub-set of composition situations. CompoSecReasoner uses both validation types by enforcing rules during the composition procedure (pre-validation) and model-checking afterwards (post-validation). The overall validation procedure is implemented by a set of functions which are performed for each evaluated property. The procedure is further enhanced with the metrics characteristic.  
For the core metrics formation, we adopt the well-studied techniques for attack surface calculation and medieval castle composition. The discussion of the underlying metrics is detailed in Section 2. The old surface metrics [49; 50; 51; 52; 53] consider only security as a system property and do not estimate the protection level. Moreover, the castle composition methodology evaluates static instances of a system. The SPD surface aggregates an analysis regarding security, privacy, and dependability while the SPD multi-metric reveals the provided protection level of the current setting. Finally, the composed SPD multi-metric tackles the measurement aspects of dynamic system composition and the added protection of subsequent layers of defense.  
All these features contribute to a better understanding of the composition and SPD aspects. This enables the dynamic evaluation of the various system states and development of more effective MTDs. The implementation of CompoSecReasoner supports distributed reasoning as well as conflict resolution among the involved SPD agents [59].  
The overall comparison results are summarized in Table 1.