First part of the presentation

1. RISCOSS: modelling and
reasoning

2. Examples of OSS adoption Risks
 Component selection risks
– Selection effort ill-estimation
– Risk of wrong component selection
 Component integration risks
– Integration effort ill-estimation
– Risk of component integration failure
– Security risk
 Legal risks
– Intellectual property risk
– Risk of license issues
– Liability risk
© RISCOSS Consortium 2

3. Examples of OSS Measures and Risk indicators
in OSS ecosystems
 Measures
– Long bug fix time: Critical & Blocker
– Long bug fix time: Total
– Commit frequency per week & Number of Commits
– Forum posts per day
– …
 Risk indicators
– Timeliness of the community
– Activeness of the community
– …
3© RISCOSS Consortium

4. Modeling Risks: entities
 Risk characterized by
– Event(1); “the OSS component not maintained”
Situation(2,3); “the community is not active”
 Measures & Risk Indicators
– Measure raw and derived evidences;
“number of bug fixed”
4
Event
Situation
measure
& Risk
indicator
1. Yudistira Asnar, Paolo Giorgini, and John Mylopoulos. Goal-driven risk assessment in requirements
engineering. Requir. Eng., 16(2):101–116, 2011.
2. Daniele Barone, Lei Jiang, Daniel Amyot, and John Mylopoulos. Reasoning with key performance indicators.
In The Practice of Enterprise Modeling, volume 92 LNBP, pages 82–96. 2011.
3. Alberto Siena, Ivan Jureta, Silvia Ingolfo, Angelo Susi, Anna Perini, and John Mylopoulos. Capturing
variability of law with Nomos 2. In ER’12, LNCS 7532, pages 383–396, 2012.

5. Modeling Risks: relationships
 Relationships between situations and events
– “expose”, “protect”
Tell when a situation makes it possible (or impossible) an
event
– “increase”, “mitigate”
Tell when a situation makes it critical (or not influential) an
event
 Relationship between risks events and goals / tasks
– “Impact” to connect the strategic model with the risk model
5
expose
impact
mitigate
© RISCOSS Consortium

6. Timeliness
Difficulty in code
refinement
people
on project
expose
expose
measure of
bug fixing time
impact
Maintain
software
OSS
Adopter
OSS
Commu
nity
OSS
component
Actor
Goal
Resource
RIsk events
situation
Risk driver
Levels of representation:
OSS ecosystems and risks together (in i*)
6
Layer 3
Business / Strategic
actors and goals of the
OSS Ecosystem
Layer 2
Situations and
risks events
Layer 1
measures and risk
drivers
Timeliness
Difficulty in code
refinement
people
on project
expose
expose
measure of
bug fixing time
impact
Maintain
software
OSS
Adopter
OSS
Commu
nity
OSS
component
Actor
Goal
Resource
RIsk events
situation
Risk driver
© RISCOSS Consortium

7. 7
Statistical analysis of OSS projects
and communities

8. Statistic: “Bug fix time”
8
300Bugs$Fix_time
count
1000 200
250
1000
1250
0
300
 Study the “behavior” of the community in the project
Statistical analysis of “Bug fix time” (in Xwiki
OSS community)
Date Range: August 6th 2012 to August 6th
2013
© RISCOSS Consortium

9.  Analysis of the “structure” of the OSS communities and of
their “evolution” via Social Network Analysis
– Centrality measures and Prestige measures to determine the
“connectivity” of nodes
 e.g., to infer possible “critical” events in the community (such as a fork, a
decrease in the activity)
Community network analysis
9

10. © RISCOSS Consortium 10
Risk and Business Models

11. License models
 The license risk model was constructed basing on
– literature review
– available information on license properties Open Source
Initiative (opensource.org), the copyfree initiative, the free
software foundation (www.gnu.org, www.fsf.org), the
github license finder (choosealicense.com) and from
discussions with expert project partners (Cenatic, Xwiki)
 Measures and Indicators are extracted
– from the Fossology or Maven risk data providers
• Number of different licenses, kind of licenses, …
– From experts advices
© RISCOSS Consortium 11

12. License risk model
© RISCOSS Consortium 12
M
E
A
S
U
R
E
S
SITUATIONS
EVENTS

13. License risk model
© RISCOSS Consortium 13
# files no lic.
val. of
exposure
AND / OR / …

14. License risk model
© RISCOSS Consortium 14

15. Result of the risk analysis
© RISCOSS Consortium 15

16. Risk exposure
 Contextual information
© RISCOSS Consortium 16
Context of the
Project in the
organisation
Value automatically
retrieved or
expert based

17. Licenses
 Permissive License
– BSD| MIT| EFL| CDDL| Apache| Python
 Copyleft
– GPL| AGPL| QPL| GFDL
 Copyleft, linking permitted
– LGPL| EPL| CPL| SPL| QPL| MPL| NPL| EUPL
 No License
– No license found| Unclassified License
 Source Code Required
– GPL| LGPL| CDDL| CPL| EPL| MPL| Sleepycat| Oracle-Berkeley-
DB| OpenGroup| SISSL| Interbase-PL| NPL| MS-RL| ErlPL
 Commercial license
– BEA | IBM-EULA | RealNetworks-EULA | Adobe-EULA |
MacroMedia | ATT-Source | Proprietary
© RISCOSS Consortium 17

18. The XML representation
© RISCOSS Consortium 18
…

19. Example: Risks analysis in model
1919
ACTORS
RESOURCES, TASKS, GOALS
© RISCOSS Consortium 19

20. Example: Risks analysis in model
2020
impact
300Bugs$Fix_time
count
1000 200
250
1000
1250
0
300
measures
20

21. © RISCOSS Consortium 21
Bayesian networks

22. Links between Measures and risks
using Bayesian networks
© RISCOSS Consortium 22
Bug Fix time
Critical Bug Fix time
Security Risk
1 day
10 days
100 days
1 day
3 days
10 days
Not sec. risk
Sec. risk
Expert evaluation to train the Bayesian Networks
Active community
A
B
C
Measures
correlation

23. Scenario for expert assessment
23
Scenario 1 Scenario 2 Scenario N
15 21 …
3 3 …
15 23 …
mostly
morning
mostly
night
…
mostly
weekdays
mostly
weekdays
…
never sometimes …
? ? ?
Expert assessment:
Evaluate how much the values of the Risk
drivers in the scenario impact the Timeliness of
the community (e.g., in the interval [1,5])
(Random) scenarios
Risk drivers and value of the intervals of their distributions
© RISCOSS Consortium

24. Links between Measures and risks
© RISCOSS Consortium 24
Bug Fix time
Critical Bug Fix time
Security Risk
1 day
10 days
100 days
1 day
3 days
10 days
Not sec. risk
Sec. risk
Expert evaluation to train the Bayesian Networks
75 %
20 %
5 %
60 %
30 %
10 %
65 %
35 %
Active community
A
B
C
X %
Y %
Z %
Measures
correlation

25. Links between Measures and risks
© RISCOSS Consortium 25
Bug Fix time
Critical Bug Fix time
Security Risk
1 day
10 days
100 days
1 day
3 days
10 days
Not sec. risk
Sec. risk
Expert evaluation and measures to use the Bayesian Networks for
predictions
55 %
40 %
5 %
60 %
10 %
30 %
45 %
55 %
Active community
A
B
C
X %
Y %
Z %
Measures
Prediction
correlation

26. Resulting Bayesian Network
26
 Bayesian network (BN)
– BN is a Directed Acyclic Graph (DAG)
– Enable an effective representation and computation of the joint
probability distribution over a set of random variables
© RISCOSS Consortium

27. Example: Risks analysis in model
2727
impact
300Bugs$Fix_time
count
1000 200
250
1000
1250
0
300
measures
27

28. 28
Reasoning on models

29. Risk and goal model reasoning
 Risk and Goal model analysis
– starting from the knowledge about values of
properties of some nodes of the model (Risk
events, Situations, Goals, Activities) infer
knowledge about values of properties of other
nodes
Specification of
models
• Goal and risk
models are
specified
Analysis of
models
• Logic based
• Label prop.
• …
Analysis of
results
• Analysis of the
possibility and
severity of a risk
© RISCOSS Consortium 29

30. Example: Risks analysis in model
3030
impact
300Bugs$Fix_time
count
1000 200
250
1000
1250
0
300
measures

31. Example: Risks analysis in model
3131
impact
300Bugs$Fix_time
count
1000 200
250
1000
1250
0
300
measures