# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 3 Materials and Methods
### Formulation of ANFIS SRA Model  
To formulate the SRA model, the validated risk factors for each SDLC phase were used as inputs for each SDLC phase. Hence, five ANFIS SRA models were formulated, one for every SDLC process phase. Each step's specific risk criteria related to the degree of security risk are accepted as inputs by the SRA model that was developed for that stage. While the vulnerability risk evaluation level at the point the SRA model was developed served as the output. Supposing P is a stage in software development life cycle, \(R_{i}\) is the various factor of risks connected to the SDLC phase's security risk assessment. As a result, the risk variables related to each phase SP affect the SRA at each of those phases. Consequently, equation can be used to represent the SRA at each step, as shown in Equation (1). The equation demonstrates that SRA can be used to assess any of the four recognized risk levels as shown in Equation (1). \[SRA_{P}=f(R_{i})\left\{ \begin{array}{c}\begin{array}{c}\text{No Risk}\\ \text{Low Risk}\\ \text{Moderate Risk}\\ \text{High Risk}\end{array}\end{array} \right. \tag{1}\]  
Following are the various assumptions that were made about the identified risk factors adopted in this study. The risk indicators that have been verified during each SDLC phase have the same degree of effect to SRA; hence they all carry equal weights. The risk factors are assigned the value of 0 if considered (value is Yes) and one if not considered (value is No). The classification for each level of security risk assessed (No, Low, Moderate and High) was made from the number of risk factors identified. Therefore, an SDLC phase with four risk factors will divide a score of 4 across the SRA levels. As a result of this assumption, two triangular membership functions were used to formulate the two labels of each risk factor. As proposed by [PERSON] and [PERSON] (2019), the interval defined for the 'Yes label is [\(-0.5\), \(0.0\), \(0.5\)] with a crisp central value of 0, and for the No label is [\(0.5\), \(1.0\), \(1.5\)] with a central crisp value of 1 as shown in Equations (2) and (3). \[\textit{Yes}(x;-0.5,\;0.0,\;0.5)=\left\{ \begin{array}{c}0;x\leq-0.5\\ \frac{x+0.5}{5};-0.5<x\leq 0\\ \frac{0.5}{0.5};0<x\leq 0.5\\ 0;x>0.5\end{array} \right. \tag{2}\] \begin{table}
\begin{tabular}{c c} \hline \hline
**Risk Factor Classification by Activity** & **Number of Instances** \\ \hline Installation & 3 \\ Operation & 2 \\ Acceptance Testing & 6 \\ Maintenance & 3 \\ TOTAL & 14 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Risk factors in Operation and maintenance phase. \[No(x;0.5,\;1.0,\;1.5)=\left\{ \begin{array}{c}0;x\leq 0.5\\ \frac{x-0.5}{0.5};0.5<x\leq 1\\ \frac{15-x}{0.5};1<x\leq 1.5\\ 0;x>1.5\end{array} \right. \tag{3}\]  
Also, the four labels of the output variable for each SDLC phase of the security risk assessment were created using four triangle membership functions. The interval defined for the No risk label is [\(-0.5\), \(0.5\)] with a central crisp value of \(0\) (Equation (4)), for the Low-risk label is [0.5, 1.5] with a central crisp value of \(1\) (Equation (5)), for the Moderate risk label is [1.5, 2.5] with a central crisp value of \(2\) (Equation (6)) and for the High-risk label is [2.5, 3.5] with a central crisp value of \(3\) (Equation (7)). The four triangle membership functions that were utilized to create the formula are depicted in a schematic in Figure 2. The names of each ANFIS-based SRA model that has been proposed for each SDLC phase's output target variables. \[No\;Risk\;(0;-0.5,\;0,\;0.5)=\left\{ \begin{array}{c}0;x\leq-0.5\\ \frac{x+0.5}{0.5};-0.5\leq x\leq 0\\ \frac{0.5-x}{0.5};0\leq x\leq 0.5\\ 0;x\geq 0.5\end{array} \right. \tag{4}\]  
\[Low\;Risk\;(1;0.5,\;1,\;1.5)=\left\{ \begin{array}{c}0;x\leq 0.5\\ \frac{x-0.5}{0.5};0.5\leq x\leq 1\\ \frac{1.7-x}{0.5};0.1\leq x\leq 1.5\\ 0;x\geq 1.5\end{array} \right. \tag{5}\]  
\[Moderate\;Risk(2;1.5,\;2,\;2.5)=\left\{