# Assessing Security of Software Components for Internet of Things: A Systematic Review and Future Directions

Authors: Zitian Liao; Shah Nazir; Habib Ullah Khan; Muhammad Shafiq
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Software component plays a significant role in the functionality of software systems. Component of software is the existing and reusable parts of a software system that is formerly debugged, confirmed, and practiced. The use of such components in a newly developed software system can save effort, time, and many resources. Due to the practice of using components for new developments, security is one of the major concerns for researchers to tackle. Security of software components can save the software from the harm of illegal access and damages of its contents. Several existing approaches are available to solve the issues of security of components from different perspectives in general while security evaluation is specific. A detailed report of the existing approaches and techniques used for security purposes is needed for the researchers to know about the approaches. In order to tackle this issue, the current research presents a systematic literature review (SLR) of the present approaches used for assessing the security of software components in the literature by practitioners to protect software systems for the Internet of Things (IoT). The study searches the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The proposed study will benefit practitioners and researchers in support of the report and devise novel algorithms, techniques, and solutions for effective evaluation of the security of software components.


---

## Body

## 1. Introduction

The role of component-based software engineering (CBSE) is obvious in software development. Software is designed according to previous experiences and component reusability which can save a lot of time, effort, and resources [1, 2]. Its effort is to bring commercial, cost-effective, and quality system by integrating the existing components. A system is designed using available components which is cheap, already tested, and error-free [1, 3–6]. An individual component is a single part of a software system and is a unit to facilitate reputable functionality in the system. The functionality of such components is combined which forms a complete software system. Two types of interfaces are used in a component such as provided and required interfaces. Both of these interfaces are a source of communication inside the software system. A component can be replaced, modified, and changed according to the requirements of the system. The developments with the use of existing components can save about half of the complete developed software [7]. Compositional approaches have many benefits in the development of software systems from the appearance of development of components which has accordingly produced substantial attention in research and developments in business standards for architectures of domain-specific, component interaction, toolkits, and numerous other applicable fields.A number of approaches exist for the security of systems [8–12]. The elementary prerequisites of security are demarcated in Availability, Integrity, and Confidentiality [10, 13–17]. Diverse reviews, frameworks, surveys, models, and analysis affecting the IoT security for security investigation are in use. Tekeoglu and Tosun [18] offered a framework of layer-based packet capturing for inspecting IoT devices’ privacy and security. Mazhelis and Tyrväinen [19] assessed platforms of IoT from application provider perceptions. Machine learning (ML) algorithms have exposed a substantial enactment in diverse applications and fields such as text recognition, facial recognition, and detection of spam. These applications of ML have understandable performance in different areas and domains [9, 12, 20–25]. The devices of the Internet of Medical Things (IoMT) are susceptible to quite a lot of security threats, attacks, and liabilities. IoMT devices are suffering commencing massive threats of security due to little costs and power, unlike typical mobile and desktop devices. The malware reproduces itself by negotiating the joining that links the devices of IoT [26]. Mao et al. [27] planned an approach for structuring dependencies of security to measure the implication of system security from an extensive perception. The consequence of small-world and power-law distribution for in- and out-degree in security dependence networks was observed. The authors in [28] planned a method to measure the performance and services’ evaluation of security for the cloud on the ground of a set of evaluation measures using Goal-Question-Metric. The authors in [29] conceived a framework for testing the security of interfaces of automotive Bluetooth with the help of a proof-of-concept tool for carrying out a test on a vehicle with the support of a planned framework. Nazir et al. [1] presented an approach for assessing software security of components via the analytic network process (ANP). The approach of ANP can work in a complex situation where the dependence arises among diverse network nodes.The proposed research presents an SLR of the existing approaches used by practitioners to protect software systems. The protocol followed for conducting the proposed study is based on [3]. The study searches the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The following key contributions are achieved by the proposed study:(i)
To study the security measures for assessing software security of components(ii)
To identify the techniques and methods available for assessing software security of components(iii)
To show how these techniques efficiently work for evaluating the security of componentsThe paper is structured as follows. Section2 shows the research method focusing on SLR for showing the analysis of the current study. Section 3 shows the results and discussions of the paper with answers to the research questions. The conclusion is presented in Section 4.


## 2. Methodology

### 2.1. Research Plan and Process

The SLR is a formal way of searching the keywords, identifying the relevant materials associated with the research, organizing in an efficient way, and deriving meaningful information and derivations from the studies selected. Figure1 represents the steps followed for the proposed research where firstly the review protocol is defined, then the search strategies are defined for the research, then the search strategies are documented, the relevant materials are included while the rest of the materials are excluded, the quality assessment is done for the selected papers, and lastly the data analysis is extracted from the included papers.Figure 1
Process of conducting a systematic literature review.


### 2.2. Research Questions

Below are the questions which were defined for the current study:(1)
What can be the security measures for assessing software security of components?(2)
What are the techniques and methods available for assessing the security of software components?(3)
How efficiently the techniques work for evaluating component security?


### 2.3. Keywords and Libraries

The keywords (“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”) were defined to search the libraries. The following libraries were adopted for the process of search. Other libraries were skipped due to the reason that these libraries are publishing materials which are peer-reviewed, while Google Scholar has all of the materials.(i)
ACM(ii)
Hindawi(iii)
IEEE(iv)
ScienceDirect(v)
SpringerThe following are the details of the process of the search for each of the selected library.(i)
ACM: [[[All: “software components”] OR [All: “components of software”]] AND [[All: “security”] OR [All: “protection”]] AND [All: (]] OR [All: (] OR [All: “evaluation”] OR [All: “assessment”] OR [All: “measuring”](ii)
Hindawi: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(iii)
IEEE: (“All Metadata”:Software components) OR “All Metadata”:components of software) AND “All Metadata”:security) OR “All Metadata”:protection) AND “All Metadata”:evaluation) OR “All Metadata”:assessment) AND “All Metadata”:measuring)(iv)
ScienceDirect: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(v)
Springer: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessments” OR “measuring”)”Figure2 shows the process of searching the keywords in the given libraries with the results of the search obtained. The filtering process of papers by title, abstract, and finally contents is also shown in the figure. The figure is initially based on the research questions defined and then the search process in the given libraries with the use of Boolean operators “AND” and “OR.”Figure 2
Protocol process and the libraries.Figure3 shows the number of papers filtered by title and then by an abstract in the given libraries. Initially, huge numbers of papers were obtained during the search process. It was considered that the analysis of all the searched papers was difficult, so due to this reason, the papers were filtered by title for obtaining the relevant papers. After this, a total of 264 papers were obtained which was also difficult to analyze in one process, so these articles were then filtered by abstract, and a total of 198 articles were achieved.Figure 3
Overall search results.The articles were filtered based on content, and a total of 117 articles were achieved for the given libraries which are shown in Figure4.Figure 4
Final filtered papers by contents.The articles selected are shown in Figure5.Figure 5
Selected articles.After this, the details of each library were analyzed which are given hereinafter. The library of ACM was analyzed in the first step for the research article type and content type. This search was for the initial results of the search which is shown in Figure6.Figure 6
Article types and the number of papers.The article type for the ACM library is shown in Figure7.Figure 7
Article types and publications.After the initial search process, the materials were filtered to extract only relevant studies. Figure8 shows the articles published in the mentioned years.Figure 8
Year and number of papers published.The article types were viewed in the given year. Figure9 depicts article types and the total number of articles in given years.Figure 9
Year and number along with the type of paper published.After searching the ACM library, the library of the Hindawi publisher was checked for relevant materials related to the proposed study. Figure10 presents year-wise publication numbers in the library of Hindawi.Figure 10
Year and total of articles.Figure11 represents the total number of articles published in given years based on the types of publications.Figure 11
Year and number along with the type of paper published.The library of IEEE was searched for identifying relevant studies to the proposed research. Figure12 shows initial search results for publications with publication types in the IEEE library.Figure 12
Number of publications along with the type of publication.The obtained papers from the searched process in the IEEE were then filtered to extract only relevant papers. Figure13 shows the total number of articles in given years in the IEEE library.Figure 13
Year and the total number of articles.Figure14 presents publication types with publication numbers in given years in the same library.Figure 14
Year and number along with the type of paper published.The library of ScienceDirect was considered to find the relevant materials to the proposed research. During the initial search process, the publication types were checked which is shown in Figure15.Figure 15
Publication type and the number of papers published.The total number of articles was checked in given years. The total number of articles with the year of articles is presented in Figure16.Figure 16
Number of publications in the given year.The publication titles were also checked that where the papers are published. Figure17 presents the titles of the articles with a total number of articles.Figure 17
Publication title and number of papers.After filtering the process of papers in the ScienceDirect library, the number of articles in given years was reviewed. The details are given in Figure18.Figure 18
Number of publications in the given years.Figure19 presents the total number of articles with the types of publications in given years.Figure 19
Article type with the total number of articles.Finally, the library of Springer was searched to obtain the associated material to the proposed research. The initial search results for the number of publications with article types are shown in Figure20.Figure 20
Articles with the type of papers.After filtering the process of papers, the results were analyzed to obtain meaningful results related to the proposed research. Figure21 represents article numbers in the given year in the library of Springer.Figure 21
Number of publications in the given year.Figure22 represents the total number of publications with the type of publications in the given year in the Springer library.Figure 22
Article type with the total number of papers in the given year.


### 2.4. Quality Assessment of the Selected Papers

The quality assessment process of the carefully chosen articles was done in order to know how much the paper is related to the proposed study. A score of “1” was given to the research paper which completely fulfills the research question, “0.5” was given to the paper somewhat satisfying the research question, and “0” was given to the paper not satisfying the research question. Figure23 shows the quality score for each paper based on the defined research questions.Figure 23
Score of research questions for each paper.Figure24 shows the sum of the overall score for each paper. The assigned values of the selected papers for all the research questions were summed and the total score is shown in the figure.Figure 24
Sum of scores for each paper.


## 2.1. Research Plan and Process

The SLR is a formal way of searching the keywords, identifying the relevant materials associated with the research, organizing in an efficient way, and deriving meaningful information and derivations from the studies selected. Figure1 represents the steps followed for the proposed research where firstly the review protocol is defined, then the search strategies are defined for the research, then the search strategies are documented, the relevant materials are included while the rest of the materials are excluded, the quality assessment is done for the selected papers, and lastly the data analysis is extracted from the included papers.Figure 1
Process of conducting a systematic literature review.


## 2.2. Research Questions

Below are the questions which were defined for the current study:(1)
What can be the security measures for assessing software security of components?(2)
What are the techniques and methods available for assessing the security of software components?(3)
How efficiently the techniques work for evaluating component security?


## 2.3. Keywords and Libraries

The keywords (“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”) were defined to search the libraries. The following libraries were adopted for the process of search. Other libraries were skipped due to the reason that these libraries are publishing materials which are peer-reviewed, while Google Scholar has all of the materials.(i)
ACM(ii)
Hindawi(iii)
IEEE(iv)
ScienceDirect(v)
SpringerThe following are the details of the process of the search for each of the selected library.(i)
ACM: [[[All: “software components”] OR [All: “components of software”]] AND [[All: “security”] OR [All: “protection”]] AND [All: (]] OR [All: (] OR [All: “evaluation”] OR [All: “assessment”] OR [All: “measuring”](ii)
Hindawi: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(iii)
IEEE: (“All Metadata”:Software components) OR “All Metadata”:components of software) AND “All Metadata”:security) OR “All Metadata”:protection) AND “All Metadata”:evaluation) OR “All Metadata”:assessment) AND “All Metadata”:measuring)(iv)
ScienceDirect: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(v)
Springer: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessments” OR “measuring”)”Figure2 shows the process of searching the keywords in the given libraries with the results of the search obtained. The filtering process of papers by title, abstract, and finally contents is also shown in the figure. The figure is initially based on the research questions defined and then the search process in the given libraries with the use of Boolean operators “AND” and “OR.”Figure 2
Protocol process and the libraries.Figure3 shows the number of papers filtered by title and then by an abstract in the given libraries. Initially, huge numbers of papers were obtained during the search process. It was considered that the analysis of all the searched papers was difficult, so due to this reason, the papers were filtered by title for obtaining the relevant papers. After this, a total of 264 papers were obtained which was also difficult to analyze in one process, so these articles were then filtered by abstract, and a total of 198 articles were achieved.Figure 3
Overall search results.The articles were filtered based on content, and a total of 117 articles were achieved for the given libraries which are shown in Figure4.Figure 4
Final filtered papers by contents.The articles selected are shown in Figure5.Figure 5
Selected articles.After this, the details of each library were analyzed which are given hereinafter. The library of ACM was analyzed in the first step for the research article type and content type. This search was for the initial results of the search which is shown in Figure6.Figure 6
Article types and the number of papers.The article type for the ACM library is shown in Figure7.Figure 7
Article types and publications.After the initial search process, the materials were filtered to extract only relevant studies. Figure8 shows the articles published in the mentioned years.Figure 8
Year and number of papers published.The article types were viewed in the given year. Figure9 depicts article types and the total number of articles in given years.Figure 9
Year and number along with the type of paper published.After searching the ACM library, the library of the Hindawi publisher was checked for relevant materials related to the proposed study. Figure10 presents year-wise publication numbers in the library of Hindawi.Figure 10
Year and total of articles.Figure11 represents the total number of articles published in given years based on the types of publications.Figure 11
Year and number along with the type of paper published.The library of IEEE was searched for identifying relevant studies to the proposed research. Figure12 shows initial search results for publications with publication types in the IEEE library.Figure 12
Number of publications along with the type of publication.The obtained papers from the searched process in the IEEE were then filtered to extract only relevant papers. Figure13 shows the total number of articles in given years in the IEEE library.Figure 13
Year and the total number of articles.Figure14 presents publication types with publication numbers in given years in the same library.Figure 14
Year and number along with the type of paper published.The library of ScienceDirect was considered to find the relevant materials to the proposed research. During the initial search process, the publication types were checked which is shown in Figure15.Figure 15
Publication type and the number of papers published.The total number of articles was checked in given years. The total number of articles with the year of articles is presented in Figure16.Figure 16
Number of publications in the given year.The publication titles were also checked that where the papers are published. Figure17 presents the titles of the articles with a total number of articles.Figure 17
Publication title and number of papers.After filtering the process of papers in the ScienceDirect library, the number of articles in given years was reviewed. The details are given in Figure18.Figure 18
Number of publications in the given years.Figure19 presents the total number of articles with the types of publications in given years.Figure 19
Article type with the total number of articles.Finally, the library of Springer was searched to obtain the associated material to the proposed research. The initial search results for the number of publications with article types are shown in Figure20.Figure 20
Articles with the type of papers.After filtering the process of papers, the results were analyzed to obtain meaningful results related to the proposed research. Figure21 represents article numbers in the given year in the library of Springer.Figure 21
Number of publications in the given year.Figure22 represents the total number of publications with the type of publications in the given year in the Springer library.Figure 22
Article type with the total number of papers in the given year.


## 2.4. Quality Assessment of the Selected Papers

The quality assessment process of the carefully chosen articles was done in order to know how much the paper is related to the proposed study. A score of “1” was given to the research paper which completely fulfills the research question, “0.5” was given to the paper somewhat satisfying the research question, and “0” was given to the paper not satisfying the research question. Figure23 shows the quality score for each paper based on the defined research questions.Figure 23
Score of research questions for each paper.Figure24 shows the sum of the overall score for each paper. The assigned values of the selected papers for all the research questions were summed and the total score is shown in the figure.Figure 24
Sum of scores for each paper.


## 3. Results and Discussion

After individual analysis of the libraries, all the references were merged into a single Endnote file to analyze them. It was found that there is an increase in the year-wise number of publications related to the proposed research. Figure25 shows the number of publications in the given years for the overall libraries collectively.Figure 25
Overall number of papers in all the libraries in the given years.Figure26 shows the number of publications along with the type of publications in the given years for all the libraries collectively.Figure 26
Overall number of papers and type of papers in all libraries in the given years.


### 3.1. What Can Be the Security Measures for Assessing the Security of Software Components?

Security features can play a significant role in the smooth running of a particular system. A number of features were identified from the literature based on which the security is evaluated. Table1 shows the identified list of features from the literature presented by different researchers.Table 1
Identified list of security features presented by researchers.
ReferencesFeatures[30]Maximum signal rangeVariety of network topologiesSafety and security of data transferReliability and dependability of WCTThroughput and data rateApplicability of WCTWireless power transferMinimum latency[17]ConfidentialityAvailabilityIntegrityAuthenticationAccess controlAuthorizationAuditingTrustPrivacyReputation meteringAccountabilityReplay protectionAnonymizationResilience to attacksFault toleranceNonrepudiation[31]ConfidentialityIntegrityAvailabilityFault toleranceAccountabilitySystem trust[32]Privacy and securityTechnologyCommunicationCultureJobLegal regulation[33]Privacy protectionNode information certificateSecure cloud computingEncryption mechanismAnti-DDoSPlatform securitySecure multiparty computationInformation application securityAntiattack securityHeterogeneous network recognition


### 3.2. What Are the Techniques and Methods Available for Assessing the Security of Software Components?

Diverse approaches are presented by the researchers to tackle the issue of security evaluation of software and its components. These approaches work from different perspectives. Table2 shows the summary of the existing techniques available for security evaluation.Table 2
Existing approaches for evaluating security.
CitationTechniqueDescription[34]Quantitative assessment approachThis approach evaluates the component security level quantitatively and identifies efficiently the component security vulnerabilities.[35]Secure multiparty computation (SMC)This paper revisits the history of developments to SMC that completed the years and studies the opportunity of coupling reliable hardware with SMC.[36]Software-defined networking (SDN)The analysis demonstrated that SDN appears to be the most attractive developmental structure for upcoming networks.[37]Conventional security mechanismsThey focus on emerging security threats aiming at vulnerabilities, human errors, and defects of a mobile device structure in existing schemes.[38]Abstract network modelThe analysis shows that the abstract network model is a valuable method for attack graph-based assessments.[39]Logic programmingIn this article, model-based testing and logic programming was introduced for detecting accessible SQL injection (SQLI) and cross-site scripting (XSS) of web applications.[40]Cognitive dimensions questionnaireResults revealed that the usability issues of security application programming interfaces (APIs) may be determined using this methodology with significantly good reliability and validity.[28]Goal-question-metric (GQM) methodThe proposed assessment methodology might help cloud service providers (CSPs) to practice a security self-evaluation and is suitable for the level of their security services within the cloud market.[29]Threat modelThis model is helpful for the evaluation of the Bluetooth interface on a range of built-in automotive infotainment systems.[41]Security assessmentThis study presents the cybersecurity associated principles for the smart grid which address the issue in different ways and to various extents.[42]Semantic modelIn this paper, a semantic model for structuring and risk visualization implemented into the metric visualization system (MVS) was presented.[43]NIST national vulnerability database (NVD) combined with EBIOS risk analysis and evaluation methodologyThe finding of this research has demonstrated that virtual networks, SDN controllers, and hypervisors continue to present new attack capabilities that are continually being exposed, further escalating the security risk of modern data centers.[44]Security behaviorThe research findings show that psychological ownership, descriptive norm, response cost, self-efficacy, and perceived vulnerability all were significant in determining personal computing security intentions and behavior for both the mobile device and home computer users.[45]Countermeasure-cantered approachIn this article, a prototype implementing such a security management system is described.[46]Threat modelThis work presents a quantitative study on the security solutions for communication quality used in robotics, while security capabilities are enabled.[47]Supervisory control and data acquisition (SCADA) systems securityThis provides an insight into developing a framework that can be used to assist critical infrastructure sectors.[48]Innovative ontology and graph-based approachFor network security evaluation, an innovative approach that uses ontology was proposed. The ontology is intended to illustrate security knowledge such as that of attacks, vulnerabilities, assets, and the relationships between them.[49]Information-theoretic modelFor the computer systems security analysis, the entropy concept was utilized and a quantitative model was derived. The assessment process consists of dynamic and static phases.[50]International symposium on formal methods (FM 2012)This short paper is intended to accompany a talk at the 18th international symposium (FM 2012). It discusses software security with a highlight on formal aspects, defenses, and low-level attacks.[51]Security metrics and risk analysisIn this work, formal analysis of associations between risk and security metrics and formal definition of risk were provided.[52]Security information and event management (SIEM) systemsThe article proposed a general framework for the visualization of SIEM which permits integration of different visualization approaches and expands simply the application functionality.[53]Big data frameworkA framework for big data in this work was proposed to build up the security capability of small enterprises.[54]Usability of security softwareThis article addresses the usability of security alerts across a wider range of security products.[55]Security evaluation using Bayesian belief networksThis article demonstrates parts of the gap, in particular the challenges associated with variable quality of information, lack of empirical information, limited budget, short time-to-market, and lack of resources.[56]Multimetrics approach for securityThis article presents a multimetric approach jointly with a methodology to estimate the system security, privacy, and dependability (SPD) level throughout both the running and design process.[57]Ontology-based model for security assessmentIn this article, the ontology-based framework was classified in five dimensions for assessing attack effect; they are defense, vulnerability, attack target, attack vector, and attack impact.[58]Vulnerability-centric requirements engineering frameworkThis paper gives an engineering framework to maintain the elicitation of security requirements and analysis based on vulnerabilities.[59]Evaluation and assessment of the security of wearable devicesThis paper examined the usefulness and design of SecuWear platform for recognizing vulnerabilities in these areas and assists wearable security research to mitigate them.[60]Assessment of platformsThis paper explains how the PRIME platform trust can enhance trust and manager operates.[61]Software-defined security frameworkFor protecting the distributed cloud, a software-defined security framework was proposed in this paper.[62]Software-defined mobile network securityThis article gives a survey of software-defined mobile network (SDMN) and its related security issues.[63]Reputation modelIn this article, the most critical as well as essential security threats for a utility-based reputation model in grids were assessed.[64]IoT monitoring solutionA monitoring tool based on the extension of the Montimage network monitoring tools for IoT systems was presented in this paper.[65]A comprehensive pattern-driven security methodologyASE—a comprehensive pattern-driven security methodology intended particularly for (common) distributed systems—focuses on the early life cycle phases and particularly the design phase.[66]Contract-based security assertion monitoringThis article demonstrates how in a live environment on Linux a contract-based security assertion monitoring can be attained.[67]Network security visualizationFor the security visualization systems evaluation such as ranking and rating, a framework was proposed in this paper.[68]Empirical studyThis article empirically examines how refactoring can progress the security of an application by removing code bad smells.[69]Computational approachFor the standardization of the software development process, a computational approach was proposed in this work.[70]Multitarget approachIn this paper, for the estimation of scores and vulnerability characteristics from the technical description, a model of the combination of multitarget classification and text analysis approaches was created.[71]A new threat identification approachIn this paper, for the assessment of security threats quantitatively, a new approach was adopted, which is modular, extendable, and systematic.[72]Regression modelFor the identification of security requirements, a linear based approach was proposed in this work.[73]Problem-oriented security patternsBased on the problem frames technique, a systematic approach was proposed in this work for the iterative development of software architectures and requirements analysis.[74]A framework for semiautomated coevolutionFor the security maintenance and support, a model-based framework was addressed in this paper for a software system during the long-term evolution.[75]A manual approachThe legal and security risks were discussed in this paper which arise from reuse.[76]A coarse approach to quantitative modeling and analysisFor the integrated vulnerability assessment, a methodology using a coarse approach to quantitative analysis and modeling was discussed in this paper.[77]Cyberdefense and cloud vulnerability assessmentIn order to decrease, evaluate, and assess the vulnerability level of distributed computing systems (DCIs), an IT security audit framework was created in this paper.[1]Analytic network process (ANP)For the component security evaluation, an ANP was proposed in this paper.[78]Distributed security systemsDistributed security systems were examined in this paper with devoted server modules that perform client modules’ monitoring and managing.[79]Threatened-based software security evaluation methodIn software security literature, for the software security assessment, a new concept was introduced in this paper: the threatened-based method.[80]Measurement frameworksThis paper reports a measurement framework for software development.[81]A cloud data monitoring systemBased on autonomic computing, a data security monitoring approach was proposed in this paper for the feasibility verification through simulation.[82]Hybrid reputation modelBased on both explicit definition of reputation and implicit reputation calculation, a hybrid reputation model is presented in this article.[83]Security architectureIn this paper, the implementation and design of a security framework to FPGA-based heterogeneous systems developed on top of MAC-based OS/Hypervisors was presented.[84]Website security analysisA model-based website security testing method was proposed in this paper.[85]Methodology for enhancing software securityFor enhancing software security in the development life cycle, a methodology was proposed in this paper.[86]Dynamic disassembly of machine instructionsThis paper talks about a novel concept RECSRF, consisting of the runtime execution complexity (REC) and its evaluation method security risk factor (SRF).[87]Protection of IoT devices using Berkeley packet filtersThis paper reports a practical approach which is an easy-to-use framework to protect IoT devices against attacks.[88]Software security knowledgeFor the secure software development that incorporates an artifact and a knowledge-based management system, a case-based management system (CBMS) was proposed in this work.[89]Security analysis of android applicationsThis paper addresses a mobile app security investigation tool StaDART that merges dynamic and static examination to present the existence of dynamic code update.[90]Surveys and overviewsThis paper summarizes the field of software vulnerability examination and discovery that uses machine learning and data mining approaches.[91]Security and privacyThis paper talks about safe patch fingerprinting.[92]Text miningThis paper focuses on text mining approaches and their different classification techniques (support vector machines, neural networks, and decision trees).[93]Software security engineeringThis paper described an attempt to benchmark and baseline the state of company software and also incorporates state of software reliability data across the company's products.[94]Quantitative measurementIn this paper, for software engineering service bus (EngSB) platform assessment, a set of quantitative metrics was proposed.[95]Common vulnerability scoring systemThis article reports which information cues decrease or increase vulnerability evaluation by humans.[96]Automatic approachIn this article, an automatic approach was proposed for detecting the software vulnerabilities on multiple systems using/sharing API libraries or similar code.[97]Software and application securityThis paper talks about the software vulnerabilities by means of descriptions only via deep learning and word embedding approaches.[98]Threat analysisThis paper talks about the threat agent approach.[99]Machine learning techniquesThis paper reports a lightweight dynamic and static features approach for the software vulnerability testing detection by means of machine learning methods.[100]Models of computationIn this paper, a cryptographically secure attestation scheme was proposed, which detects direct memory access (DMA) attacks.[101]Understanding security requirements and challengesThis work describes the state-of-the-art efforts in ensuring security in the IoT network.


### 3.3. How Efficiently the Techniques Work for Assessing the Security of Components?

There is high need of effective security evaluation techniques which can efficiently evaluate the security of software system. Such techniques can be useful for the success of software from a business perspective. Table3 shows the summary of the efficiently used techniques for evaluating the security of software systems.Table 3
Summary of the existing techniques for evaluating security.
CitationTechniqueDescription[102]A framework for the comparison of security adaptation approachesFive security adaptations were compared in this framework. The framework includes three perspectives that are life cycle, security, and adaptation. The evaluation illustrated that in each adaptation approach the monitor and analysis phase is described.[103]Information security risk assessmentThe analysis showed that this method gets more scientific evaluation and reliable and stable results on the evaluation of the risk of the control systems of industry.[104]State fusion finite state machine modelIn this paper, an SF-FSM model was proposed to recognize a legitimate application to evaluate its vulnerabilities and illegal behavior of unauthorized parties for an industrial control system.[105]Core unified risk framework (CURF)This approach is suitable for the qualitative comparison of activities and processes in each method of information security risk assessment (ISRA) and presented a measure of completeness.[106]Complexity metrics for software security improvementFor the security level of computer-based systems, improving software security is essential.[107]Security vulnerability assessment, prevention, and prediction (SVAPP)The proposed SVAPP methodology exploits an active security barrier approach and adapts it to suit the security facet.[108]Security quality requirements engineering (SQUARE) methodIn this paper, SQUARE effectiveness was evaluated in terms of its artifacts (attack tree, security templates, system architecture diagram and use-case diagram, and scenarios), a set of security goals, vulnerabilities, threats, and prioritized and categorized security requirements.[109]SODAIn this paper, SODA was introduced, which leverages integrate virtual network functions (VNFs) and software-defined networking (SDN) to realize service management and security policy for IoT environments.[110]Evaluating of security risks frameworkIn this article, the security risks for IEC 61850 network, intelligent electronic devices (IEDs), and distributed denial of service (DDoS) attack assessment within an SDN-enabled smart grid communication network.[111]Security analysis and security rulesThis analysis investigates four in-app payments’ implementation and also summarizes a series of security rules.[112]Formal frameworkIn this paper, a formal framework for the strength of software obfuscation evaluation was proposed. It is used for the protection of secret data or control-flow graphs (CFGs) of a program.[113]Machine learning methodsThe contribution of this paper is a methodology for analyzing features from C source code to classify functions as vulnerable or nonvulnerable.[114]UML or SysML languageIn this article, the state of the art associated with quantification, verification, and security specification for systems and software that are modeled by means of UML or SysML language is reviewed.[115]Security diagnosis as a service (SDaaS)The scalability, performance, and accuracy of the framework were evaluated. The results of the evaluation reveal that SDaaS demonstrates information flow vulnerabilities with not merely scalability, performance, and accuracy, but furthermore lightweight footprint on resource utilization.[116]Calculus IoT-LySaThis article presents a methodology, based on the process calculus IoT-LySa, to infer quantitative measures on the evolution of systems.[117]Framework for modeling and assessing the security of the Internet of Things (IoT)The IoT is facilitating innovative applications in a variety of domains. The key contributions of this article were to assess the framework using three scenarios, including environment monitoring, wearable healthcare monitoring, and smart home.[118]Broadcasting serviceThis article describes and records all probable threats to broadcasting services[119]Security in software evolutionIn this chapter, four challenges including relevant knowledge, the impact of available knowledge, reestablishing, and reactions of security were addressed.[120]Framework for security testingIn this article, the proposed framework is used for security testing subsequent to the system implementation.[121]Multiperspective security managementThe projected modeling approach for managing and designing IT security in institution account used for diverse perceptions is based on multiperspective enterprise modeling.[122]Embedded device design and verificationThis paper focused on the approaches for verification and design of information systems with embedded devices.[123]Automotive security assuranceIn this article, a systematic security assessment to specify undesirable behaviors, enabling the assignment of severity ratings in a (semi-) automated manner was explored.[124]Pattern-based methodIn this paper, for establishing a cloud-specific information security management system (PACTS), a pattern-based method was presented.[125]Temporal hierarchical attack representation modelIn this article, network changes were systematically formalized and categorized on the basis of their causes of the change.[126]Stochastic modelingFor the security metrics quantitative assessment, a state-based stochastic model was proposed in this paper.[127]Experimental assessmentIn the presence of denial of service (DoS) attacks for the assessment of the security of web service frameworks, an experimental approach was proposed in this article.[128]Hash power distribution analysis modelIn this article, a hash power distribution analysis model for the profitability of miner measurement was proposed based on various incentives toward an evaluation of Bitcoin security.[129]mHealth apps security framework (MASF)To secure the execution of mHealth apps and their users’ data, the mHealth apps security framework (MASF) was proposed in this article.[130]Abstract modelIn this article, for the support of single sign-on (SSO) development, an abstract model was provided.[131]A proactive approachTo quantitatively assess the security of network systems, a proactive approach was addressed in this paper for validating, formulating, and identifying a number of essential features that mostly affect its security.[132]Trust modeling and evaluationFor a component-based software system, an autonomic trust management solution was introduced in this paper.[133]Static analysisFor the security static analysis tools, an evaluation framework was introduced in this paper.[134]SecuWear platformThis paper presents a multicomponent research platform, called SecuWear, for mitigating, analyzing, and testing vulnerabilities in software and hardware.[135]One-to-many bilateral e-trade negotiation frameworkA mobile agent-based secure one-to-many bilateral e-trade negotiation framework was presented in this paper.[136]Model integrated computingFor rapidly deploying cyberphysical system (CPS) attack experiments, a model-based software development framework integrated with a hardware-in-the-loop (HIL) testbed was presented in this work.[137]Concise binary object representation (CBOR)This paper reports instantiated architecture for verification and secure measurement of dynamic runtime information for Linux-based OS.[138]Multidomain networksIn this article, a framework was proposed for leveraging service function chaining (SFC) and software-defined networking (SDN) to improve collaboration among security service functions (SSFs).[139]Security-informed safetyThis paper talks about security-informed safety.[140]Trust modelIn this article, for cloud-edge-based data-sharing infrastructure, a 5 level trust model was proposed.[141]Security and risk assessmentThis paper gives suggestions about unmasking the uncertainty of risk assessment and facilitating oversight of its practice by public actors, judicial and legislative.[142]Software security vulnerabilitiesIn this work, for recurring software vulnerabilities, an empirical study was reported.[143]Self-destructive tamper responseIn this paper, a method for tamper-resistant software was created, so as to be resistant to dynamic analysis as well as static analysis.[144]Model of virtual machine (VM)Based on memory introspection, a model of VM security monitoring was proposed in this article.[145]Software-defined networking (SDN)This paper reports the NOSArmor, which contains various security mechanisms, such as a security building block (SBB), into a consolidated SDN controller.[146]Binary-level patch analysis frameworkSPAIN which is a patch analysis framework was proposed in this paper for summarizing patch patterns, security patches identification, and their corresponding vulnerability patterns.


## 3.1. What Can Be the Security Measures for Assessing the Security of Software Components?

Security features can play a significant role in the smooth running of a particular system. A number of features were identified from the literature based on which the security is evaluated. Table1 shows the identified list of features from the literature presented by different researchers.Table 1
Identified list of security features presented by researchers.
ReferencesFeatures[30]Maximum signal rangeVariety of network topologiesSafety and security of data transferReliability and dependability of WCTThroughput and data rateApplicability of WCTWireless power transferMinimum latency[17]ConfidentialityAvailabilityIntegrityAuthenticationAccess controlAuthorizationAuditingTrustPrivacyReputation meteringAccountabilityReplay protectionAnonymizationResilience to attacksFault toleranceNonrepudiation[31]ConfidentialityIntegrityAvailabilityFault toleranceAccountabilitySystem trust[32]Privacy and securityTechnologyCommunicationCultureJobLegal regulation[33]Privacy protectionNode information certificateSecure cloud computingEncryption mechanismAnti-DDoSPlatform securitySecure multiparty computationInformation application securityAntiattack securityHeterogeneous network recognition


## 3.2. What Are the Techniques and Methods Available for Assessing the Security of Software Components?

Diverse approaches are presented by the researchers to tackle the issue of security evaluation of software and its components. These approaches work from different perspectives. Table2 shows the summary of the existing techniques available for security evaluation.Table 2
Existing approaches for evaluating security.
CitationTechniqueDescription[34]Quantitative assessment approachThis approach evaluates the component security level quantitatively and identifies efficiently the component security vulnerabilities.[35]Secure multiparty computation (SMC)This paper revisits the history of developments to SMC that completed the years and studies the opportunity of coupling reliable hardware with SMC.[36]Software-defined networking (SDN)The analysis demonstrated that SDN appears to be the most attractive developmental structure for upcoming networks.[37]Conventional security mechanismsThey focus on emerging security threats aiming at vulnerabilities, human errors, and defects of a mobile device structure in existing schemes.[38]Abstract network modelThe analysis shows that the abstract network model is a valuable method for attack graph-based assessments.[39]Logic programmingIn this article, model-based testing and logic programming was introduced for detecting accessible SQL injection (SQLI) and cross-site scripting (XSS) of web applications.[40]Cognitive dimensions questionnaireResults revealed that the usability issues of security application programming interfaces (APIs) may be determined using this methodology with significantly good reliability and validity.[28]Goal-question-metric (GQM) methodThe proposed assessment methodology might help cloud service providers (CSPs) to practice a security self-evaluation and is suitable for the level of their security services within the cloud market.[29]Threat modelThis model is helpful for the evaluation of the Bluetooth interface on a range of built-in automotive infotainment systems.[41]Security assessmentThis study presents the cybersecurity associated principles for the smart grid which address the issue in different ways and to various extents.[42]Semantic modelIn this paper, a semantic model for structuring and risk visualization implemented into the metric visualization system (MVS) was presented.[43]NIST national vulnerability database (NVD) combined with EBIOS risk analysis and evaluation methodologyThe finding of this research has demonstrated that virtual networks, SDN controllers, and hypervisors continue to present new attack capabilities that are continually being exposed, further escalating the security risk of modern data centers.[44]Security behaviorThe research findings show that psychological ownership, descriptive norm, response cost, self-efficacy, and perceived vulnerability all were significant in determining personal computing security intentions and behavior for both the mobile device and home computer users.[45]Countermeasure-cantered approachIn this article, a prototype implementing such a security management system is described.[46]Threat modelThis work presents a quantitative study on the security solutions for communication quality used in robotics, while security capabilities are enabled.[47]Supervisory control and data acquisition (SCADA) systems securityThis provides an insight into developing a framework that can be used to assist critical infrastructure sectors.[48]Innovative ontology and graph-based approachFor network security evaluation, an innovative approach that uses ontology was proposed. The ontology is intended to illustrate security knowledge such as that of attacks, vulnerabilities, assets, and the relationships between them.[49]Information-theoretic modelFor the computer systems security analysis, the entropy concept was utilized and a quantitative model was derived. The assessment process consists of dynamic and static phases.[50]International symposium on formal methods (FM 2012)This short paper is intended to accompany a talk at the 18th international symposium (FM 2012). It discusses software security with a highlight on formal aspects, defenses, and low-level attacks.[51]Security metrics and risk analysisIn this work, formal analysis of associations between risk and security metrics and formal definition of risk were provided.[52]Security information and event management (SIEM) systemsThe article proposed a general framework for the visualization of SIEM which permits integration of different visualization approaches and expands simply the application functionality.[53]Big data frameworkA framework for big data in this work was proposed to build up the security capability of small enterprises.[54]Usability of security softwareThis article addresses the usability of security alerts across a wider range of security products.[55]Security evaluation using Bayesian belief networksThis article demonstrates parts of the gap, in particular the challenges associated with variable quality of information, lack of empirical information, limited budget, short time-to-market, and lack of resources.[56]Multimetrics approach for securityThis article presents a multimetric approach jointly with a methodology to estimate the system security, privacy, and dependability (SPD) level throughout both the running and design process.[57]Ontology-based model for security assessmentIn this article, the ontology-based framework was classified in five dimensions for assessing attack effect; they are defense, vulnerability, attack target, attack vector, and attack impact.[58]Vulnerability-centric requirements engineering frameworkThis paper gives an engineering framework to maintain the elicitation of security requirements and analysis based on vulnerabilities.[59]Evaluation and assessment of the security of wearable devicesThis paper examined the usefulness and design of SecuWear platform for recognizing vulnerabilities in these areas and assists wearable security research to mitigate them.[60]Assessment of platformsThis paper explains how the PRIME platform trust can enhance trust and manager operates.[61]Software-defined security frameworkFor protecting the distributed cloud, a software-defined security framework was proposed in this paper.[62]Software-defined mobile network securityThis article gives a survey of software-defined mobile network (SDMN) and its related security issues.[63]Reputation modelIn this article, the most critical as well as essential security threats for a utility-based reputation model in grids were assessed.[64]IoT monitoring solutionA monitoring tool based on the extension of the Montimage network monitoring tools for IoT systems was presented in this paper.[65]A comprehensive pattern-driven security methodologyASE—a comprehensive pattern-driven security methodology intended particularly for (common) distributed systems—focuses on the early life cycle phases and particularly the design phase.[66]Contract-based security assertion monitoringThis article demonstrates how in a live environment on Linux a contract-based security assertion monitoring can be attained.[67]Network security visualizationFor the security visualization systems evaluation such as ranking and rating, a framework was proposed in this paper.[68]Empirical studyThis article empirically examines how refactoring can progress the security of an application by removing code bad smells.[69]Computational approachFor the standardization of the software development process, a computational approach was proposed in this work.[70]Multitarget approachIn this paper, for the estimation of scores and vulnerability characteristics from the technical description, a model of the combination of multitarget classification and text analysis approaches was created.[71]A new threat identification approachIn this paper, for the assessment of security threats quantitatively, a new approach was adopted, which is modular, extendable, and systematic.[72]Regression modelFor the identification of security requirements, a linear based approach was proposed in this work.[73]Problem-oriented security patternsBased on the problem frames technique, a systematic approach was proposed in this work for the iterative development of software architectures and requirements analysis.[74]A framework for semiautomated coevolutionFor the security maintenance and support, a model-based framework was addressed in this paper for a software system during the long-term evolution.[75]A manual approachThe legal and security risks were discussed in this paper which arise from reuse.[76]A coarse approach to quantitative modeling and analysisFor the integrated vulnerability assessment, a methodology using a coarse approach to quantitative analysis and modeling was discussed in this paper.[77]Cyberdefense and cloud vulnerability assessmentIn order to decrease, evaluate, and assess the vulnerability level of distributed computing systems (DCIs), an IT security audit framework was created in this paper.[1]Analytic network process (ANP)For the component security evaluation, an ANP was proposed in this paper.[78]Distributed security systemsDistributed security systems were examined in this paper with devoted server modules that perform client modules’ monitoring and managing.[79]Threatened-based software security evaluation methodIn software security literature, for the software security assessment, a new concept was introduced in this paper: the threatened-based method.[80]Measurement frameworksThis paper reports a measurement framework for software development.[81]A cloud data monitoring systemBased on autonomic computing, a data security monitoring approach was proposed in this paper for the feasibility verification through simulation.[82]Hybrid reputation modelBased on both explicit definition of reputation and implicit reputation calculation, a hybrid reputation model is presented in this article.[83]Security architectureIn this paper, the implementation and design of a security framework to FPGA-based heterogeneous systems developed on top of MAC-based OS/Hypervisors was presented.[84]Website security analysisA model-based website security testing method was proposed in this paper.[85]Methodology for enhancing software securityFor enhancing software security in the development life cycle, a methodology was proposed in this paper.[86]Dynamic disassembly of machine instructionsThis paper talks about a novel concept RECSRF, consisting of the runtime execution complexity (REC) and its evaluation method security risk factor (SRF).[87]Protection of IoT devices using Berkeley packet filtersThis paper reports a practical approach which is an easy-to-use framework to protect IoT devices against attacks.[88]Software security knowledgeFor the secure software development that incorporates an artifact and a knowledge-based management system, a case-based management system (CBMS) was proposed in this work.[89]Security analysis of android applicationsThis paper addresses a mobile app security investigation tool StaDART that merges dynamic and static examination to present the existence of dynamic code update.[90]Surveys and overviewsThis paper summarizes the field of software vulnerability examination and discovery that uses machine learning and data mining approaches.[91]Security and privacyThis paper talks about safe patch fingerprinting.[92]Text miningThis paper focuses on text mining approaches and their different classification techniques (support vector machines, neural networks, and decision trees).[93]Software security engineeringThis paper described an attempt to benchmark and baseline the state of company software and also incorporates state of software reliability data across the company's products.[94]Quantitative measurementIn this paper, for software engineering service bus (EngSB) platform assessment, a set of quantitative metrics was proposed.[95]Common vulnerability scoring systemThis article reports which information cues decrease or increase vulnerability evaluation by humans.[96]Automatic approachIn this article, an automatic approach was proposed for detecting the software vulnerabilities on multiple systems using/sharing API libraries or similar code.[97]Software and application securityThis paper talks about the software vulnerabilities by means of descriptions only via deep learning and word embedding approaches.[98]Threat analysisThis paper talks about the threat agent approach.[99]Machine learning techniquesThis paper reports a lightweight dynamic and static features approach for the software vulnerability testing detection by means of machine learning methods.[100]Models of computationIn this paper, a cryptographically secure attestation scheme was proposed, which detects direct memory access (DMA) attacks.[101]Understanding security requirements and challengesThis work describes the state-of-the-art efforts in ensuring security in the IoT network.


## 3.3. How Efficiently the Techniques Work for Assessing the Security of Components?

There is high need of effective security evaluation techniques which can efficiently evaluate the security of software system. Such techniques can be useful for the success of software from a business perspective. Table3 shows the summary of the efficiently used techniques for evaluating the security of software systems.Table 3
Summary of the existing techniques for evaluating security.
CitationTechniqueDescription[102]A framework for the comparison of security adaptation approachesFive security adaptations were compared in this framework. The framework includes three perspectives that are life cycle, security, and adaptation. The evaluation illustrated that in each adaptation approach the monitor and analysis phase is described.[103]Information security risk assessmentThe analysis showed that this method gets more scientific evaluation and reliable and stable results on the evaluation of the risk of the control systems of industry.[104]State fusion finite state machine modelIn this paper, an SF-FSM model was proposed to recognize a legitimate application to evaluate its vulnerabilities and illegal behavior of unauthorized parties for an industrial control system.[105]Core unified risk framework (CURF)This approach is suitable for the qualitative comparison of activities and processes in each method of information security risk assessment (ISRA) and presented a measure of completeness.[106]Complexity metrics for software security improvementFor the security level of computer-based systems, improving software security is essential.[107]Security vulnerability assessment, prevention, and prediction (SVAPP)The proposed SVAPP methodology exploits an active security barrier approach and adapts it to suit the security facet.[108]Security quality requirements engineering (SQUARE) methodIn this paper, SQUARE effectiveness was evaluated in terms of its artifacts (attack tree, security templates, system architecture diagram and use-case diagram, and scenarios), a set of security goals, vulnerabilities, threats, and prioritized and categorized security requirements.[109]SODAIn this paper, SODA was introduced, which leverages integrate virtual network functions (VNFs) and software-defined networking (SDN) to realize service management and security policy for IoT environments.[110]Evaluating of security risks frameworkIn this article, the security risks for IEC 61850 network, intelligent electronic devices (IEDs), and distributed denial of service (DDoS) attack assessment within an SDN-enabled smart grid communication network.[111]Security analysis and security rulesThis analysis investigates four in-app payments’ implementation and also summarizes a series of security rules.[112]Formal frameworkIn this paper, a formal framework for the strength of software obfuscation evaluation was proposed. It is used for the protection of secret data or control-flow graphs (CFGs) of a program.[113]Machine learning methodsThe contribution of this paper is a methodology for analyzing features from C source code to classify functions as vulnerable or nonvulnerable.[114]UML or SysML languageIn this article, the state of the art associated with quantification, verification, and security specification for systems and software that are modeled by means of UML or SysML language is reviewed.[115]Security diagnosis as a service (SDaaS)The scalability, performance, and accuracy of the framework were evaluated. The results of the evaluation reveal that SDaaS demonstrates information flow vulnerabilities with not merely scalability, performance, and accuracy, but furthermore lightweight footprint on resource utilization.[116]Calculus IoT-LySaThis article presents a methodology, based on the process calculus IoT-LySa, to infer quantitative measures on the evolution of systems.[117]Framework for modeling and assessing the security of the Internet of Things (IoT)The IoT is facilitating innovative applications in a variety of domains. The key contributions of this article were to assess the framework using three scenarios, including environment monitoring, wearable healthcare monitoring, and smart home.[118]Broadcasting serviceThis article describes and records all probable threats to broadcasting services[119]Security in software evolutionIn this chapter, four challenges including relevant knowledge, the impact of available knowledge, reestablishing, and reactions of security were addressed.[120]Framework for security testingIn this article, the proposed framework is used for security testing subsequent to the system implementation.[121]Multiperspective security managementThe projected modeling approach for managing and designing IT security in institution account used for diverse perceptions is based on multiperspective enterprise modeling.[122]Embedded device design and verificationThis paper focused on the approaches for verification and design of information systems with embedded devices.[123]Automotive security assuranceIn this article, a systematic security assessment to specify undesirable behaviors, enabling the assignment of severity ratings in a (semi-) automated manner was explored.[124]Pattern-based methodIn this paper, for establishing a cloud-specific information security management system (PACTS), a pattern-based method was presented.[125]Temporal hierarchical attack representation modelIn this article, network changes were systematically formalized and categorized on the basis of their causes of the change.[126]Stochastic modelingFor the security metrics quantitative assessment, a state-based stochastic model was proposed in this paper.[127]Experimental assessmentIn the presence of denial of service (DoS) attacks for the assessment of the security of web service frameworks, an experimental approach was proposed in this article.[128]Hash power distribution analysis modelIn this article, a hash power distribution analysis model for the profitability of miner measurement was proposed based on various incentives toward an evaluation of Bitcoin security.[129]mHealth apps security framework (MASF)To secure the execution of mHealth apps and their users’ data, the mHealth apps security framework (MASF) was proposed in this article.[130]Abstract modelIn this article, for the support of single sign-on (SSO) development, an abstract model was provided.[131]A proactive approachTo quantitatively assess the security of network systems, a proactive approach was addressed in this paper for validating, formulating, and identifying a number of essential features that mostly affect its security.[132]Trust modeling and evaluationFor a component-based software system, an autonomic trust management solution was introduced in this paper.[133]Static analysisFor the security static analysis tools, an evaluation framework was introduced in this paper.[134]SecuWear platformThis paper presents a multicomponent research platform, called SecuWear, for mitigating, analyzing, and testing vulnerabilities in software and hardware.[135]One-to-many bilateral e-trade negotiation frameworkA mobile agent-based secure one-to-many bilateral e-trade negotiation framework was presented in this paper.[136]Model integrated computingFor rapidly deploying cyberphysical system (CPS) attack experiments, a model-based software development framework integrated with a hardware-in-the-loop (HIL) testbed was presented in this work.[137]Concise binary object representation (CBOR)This paper reports instantiated architecture for verification and secure measurement of dynamic runtime information for Linux-based OS.[138]Multidomain networksIn this article, a framework was proposed for leveraging service function chaining (SFC) and software-defined networking (SDN) to improve collaboration among security service functions (SSFs).[139]Security-informed safetyThis paper talks about security-informed safety.[140]Trust modelIn this article, for cloud-edge-based data-sharing infrastructure, a 5 level trust model was proposed.[141]Security and risk assessmentThis paper gives suggestions about unmasking the uncertainty of risk assessment and facilitating oversight of its practice by public actors, judicial and legislative.[142]Software security vulnerabilitiesIn this work, for recurring software vulnerabilities, an empirical study was reported.[143]Self-destructive tamper responseIn this paper, a method for tamper-resistant software was created, so as to be resistant to dynamic analysis as well as static analysis.[144]Model of virtual machine (VM)Based on memory introspection, a model of VM security monitoring was proposed in this article.[145]Software-defined networking (SDN)This paper reports the NOSArmor, which contains various security mechanisms, such as a security building block (SBB), into a consolidated SDN controller.[146]Binary-level patch analysis frameworkSPAIN which is a patch analysis framework was proposed in this paper for summarizing patch patterns, security patches identification, and their corresponding vulnerability patterns.


## 4. Conclusion

Components of software play an important role in the functionality of the activities of software systems. Components are considered to be reused due to the properties that are already tested, debugged, and experienced in practice. The security of components is important for its nature due to avoidance of happening of illegal or malicious activities that can harm the success of the software system. The security of component can be high if it has a higher level of security. Security of software components can save the software from the harm of illegal access and damages of its contents. Diverse approaches are available to tackle the issues of security of components from diverse perceptions. A detailed report of the existing approaches and techniques used for security purposes is needed through which the researchers should know the in-depth knowledge of approaches, tools, and techniques. The proposed research presents an SLR of the approaches used by practitioners to protect software systems for IoT. The study has searched the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The proposed research will help practitioners and researchers in presenting new algorithms, techniques, and solutions for efficient assessment of the software components from security perspectives.



---

*Source: 6677867-2021-02-15.xml*