# Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases
## 2 Literature Review
### Related Work on Security Risk Assessment Tools for Software Test Techniques
In [48], the authors conducted an SLR on risk management's software process simulation modeling (SPSM), the purpose of which was to: (i) determine where this issue has been used the most in risk management efforts, (ii) view the most common forms of risk for which SPSM has been used, (iii) determine which SPSM models are most commonly utilized in risk management, (iv) determine which SPSM standards are most commonly utilized in risk management, and (v) examine how SPSM approaches and models in risk management that have been implemented in practice. The authors in [19] developed a software risk estimation tool. The study identified 17 risk factors that are related to specialists' assessments of the security risk. The study collected associated data, after that, a security risk assessment model known as the ANFIS was developed based on the 17 risk categories identified throughout the SDLC process. The study was only focused on the creation of a security risk assessment tool using a neuro-fuzzy (ANFIS) model; however, it was limited to the use of 17 risk factors adopted at the end of the SDLC process. The authors in [49] worked on developing a qualitative risk assessment tool for offshore projects. The study adopted the use of risk factors that could only be identified systematically from the project document. The study didn't take into account ranking risks in order of importance or identifying risks specific to software development. In [50], the authors developed a fuzzy-based expert system for the estimation of risk of project failure. The study estimated various levels of risk categories and severity of impacts as a basis of estimating project failure. The study did not consider the identification of any risk factor in the estimation of project failure. Internet-based, web-data servers, online services, and GUI-based applications are increasingly being exploited as software threats. Each phase prior to the completion of the software product requires a different form of threat modeling [51]. The most important role in the SDLC is identifying software and hardware threats [52; 53]. To reduce risks, the threat modeling approach is incorporated into the SDLC early enough [54; 55]. In [54], the authors proposed a Secure (S-SDLC) through Agile Methods. The study shows that vulnerabilities can be quickly identify if security is taken into consideration from the beginning with no additional time or costs to the client, and can be fixed within the project's allotted period. Additionally, it increases the likelihood of success in terms of both consistency and effectiveness. Finding the risk factors is crucial in the initial phases of the SDLC process. Threat classification of risk-based techniques is investigated by authors in [56] to review threat attacks with regard to security issues. During the life cycle stages' complexity is used to categorize the most risk factor. The results of the suggested method are compared to those of Microsoft Stride in order to identify component boundaries, rank attacks, and better comprehend software development and operation threats in the software development process. The authors of [57] proposed a novel technique for selecting the optimal reliability prediction model. This approach combines the analytical hierarchy method (AHP), hesitant fuzzy (HF) sets, and a methodology for ranking preferences according to how closely they resemble the ideal answer. Procedural sensitivity testing was also done to validate the results using the various rounds of the method. The developers will be able to estimate reliability prediction depending on the software type with the aid of the results of the software reliability prediction models prioritizing. From the reviewed literature, the SRA challenges attracted the attention of researchers, and ML-based techniques were used in this field to satisfy this requirement. More notably,in the area of SRA in SDLC process in the development of software product effort. In the literature various approaches have been used like ANNs, optimization, and fuzzy methods.