Abstract
Software component plays a significant role in the functionality of software systems. Component of software is the existing and reusable parts of a software system that is formerly debugged, confirmed, and practiced. The use of such components in a newly developed software system can save effort, time, and many resources. Due to the practice of using components for new developments, security is one of the major concerns for researchers to tackle. Security of software components can save the software from the harm of illegal access and damages of its contents. Several existing approaches are available to solve the issues of security of components from different perspectives in general while security evaluation is specific. A detailed report of the existing approaches and techniques used for security purposes is needed for the researchers to know about the approaches. In order to tackle this issue, the current research presents a systematic literature review (SLR) of the present approaches used for assessing the security of software components in the literature by practitioners to protect software systems for the Internet of Things (IoT). The study searches the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The proposed study will benefit practitioners and researchers in support of the report and devise novel algorithms, techniques, and solutions for effective evaluation of the security of software components.
1. Introduction
The role of component-based software engineering (CBSE) is obvious in software development. Software is designed according to previous experiences and component reusability which can save a lot of time, effort, and resources [1, 2]. Its effort is to bring commercial, cost-effective, and quality system by integrating the existing components. A system is designed using available components which is cheap, already tested, and error-free [1, 3–6]. An individual component is a single part of a software system and is a unit to facilitate reputable functionality in the system. The functionality of such components is combined which forms a complete software system. Two types of interfaces are used in a component such as provided and required interfaces. Both of these interfaces are a source of communication inside the software system. A component can be replaced, modified, and changed according to the requirements of the system. The developments with the use of existing components can save about half of the complete developed software [7]. Compositional approaches have many benefits in the development of software systems from the appearance of development of components which has accordingly produced substantial attention in research and developments in business standards for architectures of domain-specific, component interaction, toolkits, and numerous other applicable fields.
A number of approaches exist for the security of systems [8–12]. The elementary prerequisites of security are demarcated in Availability, Integrity, and Confidentiality [10, 13–17]. Diverse reviews, frameworks, surveys, models, and analysis affecting the IoT security for security investigation are in use. Tekeoglu and Tosun [18] offered a framework of layer-based packet capturing for inspecting IoT devices’ privacy and security. Mazhelis and Tyrväinen [19] assessed platforms of IoT from application provider perceptions. Machine learning (ML) algorithms have exposed a substantial enactment in diverse applications and fields such as text recognition, facial recognition, and detection of spam. These applications of ML have understandable performance in different areas and domains [9, 12, 20–25]. The devices of the Internet of Medical Things (IoMT) are susceptible to quite a lot of security threats, attacks, and liabilities. IoMT devices are suffering commencing massive threats of security due to little costs and power, unlike typical mobile and desktop devices. The malware reproduces itself by negotiating the joining that links the devices of IoT [26]. Mao et al. [27] planned an approach for structuring dependencies of security to measure the implication of system security from an extensive perception. The consequence of small-world and power-law distribution for in- and out-degree in security dependence networks was observed. The authors in [28] planned a method to measure the performance and services’ evaluation of security for the cloud on the ground of a set of evaluation measures using Goal-Question-Metric. The authors in [29] conceived a framework for testing the security of interfaces of automotive Bluetooth with the help of a proof-of-concept tool for carrying out a test on a vehicle with the support of a planned framework. Nazir et al. [1] presented an approach for assessing software security of components via the analytic network process (ANP). The approach of ANP can work in a complex situation where the dependence arises among diverse network nodes.
The proposed research presents an SLR of the existing approaches used by practitioners to protect software systems. The protocol followed for conducting the proposed study is based on [3]. The study searches the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The following key contributions are achieved by the proposed study:(i)To study the security measures for assessing software security of components(ii)To identify the techniques and methods available for assessing software security of components(iii)To show how these techniques efficiently work for evaluating the security of components
The paper is structured as follows. Section 2 shows the research method focusing on SLR for showing the analysis of the current study. Section 3 shows the results and discussions of the paper with answers to the research questions. The conclusion is presented in Section 4.
2. Methodology
2.1. Research Plan and Process
The SLR is a formal way of searching the keywords, identifying the relevant materials associated with the research, organizing in an efficient way, and deriving meaningful information and derivations from the studies selected. Figure 1 represents the steps followed for the proposed research where firstly the review protocol is defined, then the search strategies are defined for the research, then the search strategies are documented, the relevant materials are included while the rest of the materials are excluded, the quality assessment is done for the selected papers, and lastly the data analysis is extracted from the included papers.
2.2. Research Questions
Below are the questions which were defined for the current study:(1)What can be the security measures for assessing software security of components?(2)What are the techniques and methods available for assessing the security of software components?(3)How efficiently the techniques work for evaluating component security?
2.3. Keywords and Libraries
The keywords (“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”) were defined to search the libraries. The following libraries were adopted for the process of search. Other libraries were skipped due to the reason that these libraries are publishing materials which are peer-reviewed, while Google Scholar has all of the materials.(i)ACM(ii)Hindawi(iii)IEEE(iv)ScienceDirect(v)Springer
The following are the details of the process of the search for each of the selected library.(i)ACM: [[[All: “software components”] OR [All: “components of software”]] AND [[All: “security”] OR [All: “protection”]] AND [All: (]] OR [All: (] OR [All: “evaluation”] OR [All: “assessment”] OR [All: “measuring”](ii)Hindawi: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(iii)IEEE: (“All Metadata”:Software components) OR “All Metadata”:components of software) AND “All Metadata”:security) OR “All Metadata”:protection) AND “All Metadata”:evaluation) OR “All Metadata”:assessment) AND “All Metadata”:measuring)(iv)ScienceDirect: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessment” OR “measuring”)”(v)Springer: “(“Software components” OR “components of software”) AND (“security” OR “protection”) AND (“evaluation” OR “assessments” OR “measuring”)”
Figure 2 shows the process of searching the keywords in the given libraries with the results of the search obtained. The filtering process of papers by title, abstract, and finally contents is also shown in the figure. The figure is initially based on the research questions defined and then the search process in the given libraries with the use of Boolean operators “AND” and “OR.”
Figure 3 shows the number of papers filtered by title and then by an abstract in the given libraries. Initially, huge numbers of papers were obtained during the search process. It was considered that the analysis of all the searched papers was difficult, so due to this reason, the papers were filtered by title for obtaining the relevant papers. After this, a total of 264 papers were obtained which was also difficult to analyze in one process, so these articles were then filtered by abstract, and a total of 198 articles were achieved.
The articles were filtered based on content, and a total of 117 articles were achieved for the given libraries which are shown in Figure 4.
The articles selected are shown in Figure 5.
After this, the details of each library were analyzed which are given hereinafter. The library of ACM was analyzed in the first step for the research article type and content type. This search was for the initial results of the search which is shown in Figure 6.
The article type for the ACM library is shown in Figure 7.
After the initial search process, the materials were filtered to extract only relevant studies. Figure 8 shows the articles published in the mentioned years.
The article types were viewed in the given year. Figure 9 depicts article types and the total number of articles in given years.
After searching the ACM library, the library of the Hindawi publisher was checked for relevant materials related to the proposed study. Figure 10 presents year-wise publication numbers in the library of Hindawi.
Figure 11 represents the total number of articles published in given years based on the types of publications.
The library of IEEE was searched for identifying relevant studies to the proposed research. Figure 12 shows initial search results for publications with publication types in the IEEE library.
The obtained papers from the searched process in the IEEE were then filtered to extract only relevant papers. Figure 13 shows the total number of articles in given years in the IEEE library.
Figure 14 presents publication types with publication numbers in given years in the same library.
The library of ScienceDirect was considered to find the relevant materials to the proposed research. During the initial search process, the publication types were checked which is shown in Figure 15.
The total number of articles was checked in given years. The total number of articles with the year of articles is presented in Figure 16.
The publication titles were also checked that where the papers are published. Figure 17 presents the titles of the articles with a total number of articles.
After filtering the process of papers in the ScienceDirect library, the number of articles in given years was reviewed. The details are given in Figure 18.
Figure 19 presents the total number of articles with the types of publications in given years.
Finally, the library of Springer was searched to obtain the associated material to the proposed research. The initial search results for the number of publications with article types are shown in Figure 20.
After filtering the process of papers, the results were analyzed to obtain meaningful results related to the proposed research. Figure 21 represents article numbers in the given year in the library of Springer.
Figure 22 represents the total number of publications with the type of publications in the given year in the Springer library.
2.4. Quality Assessment of the Selected Papers
The quality assessment process of the carefully chosen articles was done in order to know how much the paper is related to the proposed study. A score of “1” was given to the research paper which completely fulfills the research question, “0.5” was given to the paper somewhat satisfying the research question, and “0” was given to the paper not satisfying the research question. Figure 23 shows the quality score for each paper based on the defined research questions.
Figure 24 shows the sum of the overall score for each paper. The assigned values of the selected papers for all the research questions were summed and the total score is shown in the figure.
3. Results and Discussion
After individual analysis of the libraries, all the references were merged into a single Endnote file to analyze them. It was found that there is an increase in the year-wise number of publications related to the proposed research. Figure 25 shows the number of publications in the given years for the overall libraries collectively.
Figure 26 shows the number of publications along with the type of publications in the given years for all the libraries collectively.
3.1. What Can Be the Security Measures for Assessing the Security of Software Components?
Security features can play a significant role in the smooth running of a particular system. A number of features were identified from the literature based on which the security is evaluated. Table 1 shows the identified list of features from the literature presented by different researchers.
3.2. What Are the Techniques and Methods Available for Assessing the Security of Software Components?
Diverse approaches are presented by the researchers to tackle the issue of security evaluation of software and its components. These approaches work from different perspectives. Table 2 shows the summary of the existing techniques available for security evaluation.
3.3. How Efficiently the Techniques Work for Assessing the Security of Components?
There is high need of effective security evaluation techniques which can efficiently evaluate the security of software system. Such techniques can be useful for the success of software from a business perspective. Table 3 shows the summary of the efficiently used techniques for evaluating the security of software systems.
4. Conclusion
Components of software play an important role in the functionality of the activities of software systems. Components are considered to be reused due to the properties that are already tested, debugged, and experienced in practice. The security of components is important for its nature due to avoidance of happening of illegal or malicious activities that can harm the success of the software system. The security of component can be high if it has a higher level of security. Security of software components can save the software from the harm of illegal access and damages of its contents. Diverse approaches are available to tackle the issues of security of components from diverse perceptions. A detailed report of the existing approaches and techniques used for security purposes is needed through which the researchers should know the in-depth knowledge of approaches, tools, and techniques. The proposed research presents an SLR of the approaches used by practitioners to protect software systems for IoT. The study has searched the literature in the popular and well-known libraries, filters the relevant literature, organizes the filter papers, and extracts derivations from the selected studies based on different perspectives. The proposed research will help practitioners and researchers in presenting new algorithms, techniques, and solutions for efficient assessment of the software components from security perspectives.
Data Availability
No data were used to support this study.
Conflicts of Interest
The authors declare that they have no conflicts of interest.