# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 2 Literature Review
### Related Work on Security Risk Assessment Tools for Software Test Techniques  
The authors in [5] used various security risk discovered as risk factors to evaluating software development risk across every step of the SDLC procedure. The foremost aim of the study was to identify the most security risks with relation to assessing security risk at each level of the SDLC process, out of the 93 risk categories. The study did not propose how security risk assessment can be performed based on data regarding the recognized risk factors. In [12] the authors applied Artificial Neural Networks (ANN) to develop risk management in SDLC process in the development of software product. The study identified ten most relevant risk factors that can be encountered during various stages of SDLC process in evaluating security risk by software developers. The study collected relevant data associated with assessing the security risk associated with software development based on the 10 risk factors. The study was limited to the identification of 10 risk factors which could only be used to evaluate security risk when the SDLC process is complete. The authors in [34] developed a fuzzy expert system that focused on determining the overall risk of a software project. The study did not take into consideration the identification of any risk factor. The study made no provision for facilities required for adding, removing, update or prioritizing risk, and the model was simulated using MATLAB software. Software risk management is a proactive decision-making process that includes techniques, strategies, and tools for controlling risks in software development projects. Many existing strategies for software project risk management are non-reusable and non-shareable with only textual documentation with varying perceptions. In [35], the authors proposed a life-cycle approach to ontology-based risk management framework for software projects. It is based on a dataset culled from the literature, domain experts, and practitioners. A total of 19 software specialists refine the identified risks, which are then theorized, modeled, and built using Protege. A version method as well as a qualitative analysis and prioritization of the risks was adopted using real-life software projects. The extraction tool's performance is validated using precision recall and F-measure metrics, while the extraction tool's performance is validated using the performance metrics. The performance appraisal form and the technology acceptance model are used to assess performance and perceptions, respectively. The assessment concept scale is used to compare mean scores from performance and perception evaluations. The results revealed that costs were decreased, high-quality projects were delivered on schedule, and software engineers regarded this framework to be a useful tool for their day-to-day software development activities. Similarly, the authors in [47] conducted a systematic literature review (SLR) on software risk in order to characterize and present the state of the art in this field, as well as to identify gaps and possibilities for future study. The scientific community's interest has shifted away from the definition of research activity that addressed an integrated risk management process in favor of work that focuses on distinct activities of this process, according to the analysis of the results of this SLR. It was also obvious that there was a distinct lack of scientific rigor work in the area of validation process in their investigations as well as a lack of usage of standards or de facto models to describe them.