改进的基于属性的软件可信性度量模型

改进的基于属性的软件可信性度量模型 An Improved Attributes Based Software Trustworthiness Metric Model 1 first-author 陶红伟，男，博士，副教授，现从事软件可信性度量、认知计算和密码学方面的研究. E-mail:tthhww_811@163.com 陶红伟，男，博士，副教授，现从事软件可信性度量、认知计算和密码学方面的研究. E-mail: tthhww_811@163.com tthhww_811@163.com 2 郑州轻工业学院 计算机与通信工程学院, 河南 郑州 450002 郑州轻工业学院 计算机与通信工程学院, 河南 郑州 450002 School of Computer and Communication Engineering, Zhengzhou University of Light Industry, Zhengzhou 450002, Henan, China School of Computer and Communication Engineering, Zhengzhou University of Light Industry, Zhengzhou 450002, Henan, China 郑州轻工业学院 思想政治理论课教学研究部, 河南 郑州 450002 郑州轻工业学院 思想政治理论课教学研究部, 河南 郑州 450002 Ideological and Political Theory Course Teaching and Research Department, Zhengzhou University of Light Industry, Zhengzhou 450002, Henan, China Ideological and Political Theory Course Teaching and Research Department, Zhengzhou University of Light Industry, Zhengzhou 450002, Henan, China 对基于属性的软件可信性度量需要满足的性质集进行了扩充，提出了一种改进的软件可信性度量模型，并通过证明其满足扩充后度量性质集对其进行了理论验证.相关工作比较表明相对于常用的两种基于属性的软件可信性度量模型以及作者之前所提出的3个模型，该模型对扩充后的度量性质满足程度方面更优. In this paper, we propose an improved metric model for software trustworthiness by extending the property set and giving the formal description of the properties, and we will validate this model from the theory by proving that it complies with the property set. Compared with the models we once introduced and two popular attributes based software trustworthiness metric models, our moded is proved to be better. 可信软件评估 可信性度量性质 公理化方法 软件可信性度量 trustworthy software evaluation software measurement properties axiomatic approaches software trustworthiness measurement 引言 1 软件可信性是软件行为和结果满足用户预期的能力 [ 1 1 ] , 而软件行为和结果可以通过一系列的属性来刻画 [ 2 2 ~ 18 18 2~18 ] .软件可信性度量是对软件可信性的量化评估, 通过量化评估可以为增加软件研发的可信性提供依据.“可信软件基础研究”重大研究计划将软件的可信性度量与评估作为其重要的核心问题之一 [ 1 1 ] .人们已经提出了不少基于属性的软件可信性度量模型和方法, 代表性的有动力学统计分析 [ 9 9 ~ 11 11 9~11 ] , 证据理论 [ 12 12 , 13 13 ] , 缺陷分析 [ 14 14 ] , 数据挖掘 [ 15 15 ] , 不确定理论 [ 16 16 , 17 17 ] , 贝叶斯网络 [ 18 18 ] .然而很少有学者注意到用更严格的方法来对软件可信性进行度量并对度量模型进行理论验证.严格的软件可信性度量能够为软件可信性的评估和改进提供重要的帮助, 而理论验证是定义一个合理的度量模型或者方法的必须要做的事情, 也是对模型进行实验验证的一个必要步骤.公理化方法通过定义期望的软件度量性质来形式化描述对软件属性的经验理解 [ 19 19 , 20 20 ] , 该方法多被用于诸如软件复杂性等内部属性的度量和度量验证中 [ 21 21 ~ 26 26 21~26 ] .为了更加严格的度量软件可信性, 我们曾经将公理化方法用于软件可信性度量当中, 提出了基于属性的软件可信性度量需要满足的4条性质：单调性、凝聚性、灵敏性和替代性, 给出了3个满足这些性质的度量模型：PBSTM1 [ 27 27 ] ，PBSTM2 [ 28 28 ] 和PBSTM3 [ 29 29 ] .在本论文中对上述性质集进行了扩充, 添加了用来表示可信性为非负值的非负性、用来表示可信性是各可信属性组合结果的空值性、用来避免某些属性值过高或过低等极端情况导致可信度量不准确的可信属性比例合适性3条新性质，引入了与人主观性相关的可期望性，作为对文献[ 30 30 ]中所提出的稳定性的改进，并给出了这些性质通常情况下的形式化描述和软件可信性度量作为连续可导函数情况下的形式化表示方式.模型PBSTM1，PBSTM2和PBSTM3虽然满足前期提出的4条性质，但均不满足空值性、可信属性比例合适性和可期望性；再者，这3个模型也没有考虑属性间替代性的大小关系.鉴于此，本文提出了一种改进的软件可信性度量模型. 基于属性的软件可信性度量性质 1 我们把软件可信性属性分为关键属性和非关键属性，所谓的关键属性是指一个软件是可信的所必须具备的属性，非关键属性是指不同的软件根据自身的特点除了必须具备关键属性外可能还需要具备的其他属性 [ 27 27 ] .设关键属性有 m 种，非关键属性有 s 种，即软件可信性属性共有 m + s 种，并设它们所对应的属性值依次为 y 1 , …, y m + s .假设所有关键属性组成的集合在所有属性中所占的权重为 α ，所有非关键属性组成的集合在所有属性中所占的权重为 β ，它们需要满足0≤ β ＜0.5＜ α ＜1， α + β =1；各个关键属性在整个关键属性中所占的权重依次为 α 1 , …, α m ，且它们需要满足0≤ α i ≤1(1≤ i ≤ m )， http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458008&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458008&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458008&type=middle ；并假设各个非关键属性在整个非关键属性中所占的权重依次为 β m +1 , …, β m + s 且它们也需要满足0≤ β j ≤1( m +1≤ j ≤ m + s )， http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458009&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458009&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458009&type=middle .设 T 是关于 y 1 , …, y m + s 的用来表示软件可信性的函数.为方便起见，在本论文以下部分，称所有关键属性中属性值最小的属性为最小关键属性，并记其所对应的下标为min，类似的可以定义最大关键属性、最小非关键属性和最大非关键属性，并记它们所对应的下标依次为max、min′和max′.用Δ y i 表示属性 y i 的变化值，用Δ T 表示可信性T的变化值，ℝ + 为正实数组成的集合.基于属性的软件可信性度量需要满足非负性、空值性、可信属性比例合适性、单调性、凝聚性、灵敏性、替代性、可期望性等性质，其中非负性、空值性、可信属性比例合适性为新扩充的性质，可期望性为对文献[ 30 30 ]中所提出的稳定性的改进，其余性质为在文献[ 27 27 ]中已提出的性质.具体如下： 性质1     非负性  T ≥0. 非负性用来描述软件可信性为非负值. 性质2     空值性 如果存在1≤ i ≤ m + s 使得 y i =0，则 T =0. 空值性用来刻画软件可信性是各可信属性组合的结果，由单一的可信属性不能得到软件可信性的性质. 性质3     可信属性比例合适性 存在常数 c 1 , c 2 ∈ℝ + 使得 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458012&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458012&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458012&type=middle , 1≤ i , j ≤ m + s . 可信属性比例合适性是指各可信属性应该有合适的比例假设.比如假定关键属性包含可靠性和可维护性，可信的软件既要有高的可靠性又要有好的可维护性，可靠性很高而可维护性差或者可维护性很好而可靠性低都不是很合适，因此各属性要有合适的比例假设. 性质4     单调性 对于任意的1≤ i ≤ m + s ，有 T ( y 1 , …, y i +Δ y i , …, y m + s )- T ( y 1 , …， y i ，…， y m+ s )≥0，如果 T 是连续可导度量函数，则有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458014&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458014&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458014&type=middle . 单调性是用来刻画软件可信度量关于可信属性是单调增加的性质. 性质5     凝聚性 对于任意的1≤ i ≤ m + s ，有 (Δ T ( y 1 , …, y i +Δ y i , …, y m + s )-Δ T ( y 1 , …, y i , …, y m + s ))/Δ y i ≤0，如果 T 是连续可导度量函数，则有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458015&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458015&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458015&type=middle . 凝聚性是用来表示随着属性y i 值的增加，其对可信性的贡献效率越来越少的性质. 性质6     灵敏性 对于任意的1≤ i ≤ m + s ，有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458017&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458017&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458017&type=middle ，如果T是连续可导度量函数，则有， http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458019&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458019&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458019&type=middle ，其中 w i 是属性 y i 的权重， f 是关于 y i 和 w i 的函数. 灵敏性是用来描述可信属性的百分比比例变化所导致的软件可信性的变化，为正值并与各属性值以及各属性所对应的权重相关.再者，基于对最小关键属性的改进能够对软件可信性有较大提高的事实，软件可信性关于最小关键属性更灵敏. 性质7     替代性 存在常数 c 3 ， c 4 ∈ℝ + 使得 c 3 ≤ σ ij ≤ c 4 (1≤ i , j ≤ m + s , i ≠ j )，其中 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458021&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458021&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458021&type=middle ，如果 T 是连续可导函数，则有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458024&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458024&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458024&type=middle . 替代性是指可信属性间可以发生一定程度的替代.属性间的替代是用来描述在保持软件可信性和其他属性值不变的情况下， y i 和 y j 两种属性之间的变化关系.虽然Δ y i /Δ y j 一定程度上也可以用来度量属性间的替代难易程度，但因为用来度量不同属性的单位可能不同，为了能够对属性间的替代难易程度进行比较，所以采用无单位度量 σ ij 来描述各属性间的替代难易程度. 性质8     可期望性 如果假设 c 5 ∈ℝ + 是用户关于所有可信属性的最低预期，则 c 5 ≤ T ，并且 T ≤max{ y 1 , y 2 , …, y m + s }. 可期望性是指如果所有可信属性均达到用户预期，则最后得到的可信性也要满足用户预期. 注：关于属性间的替代性需要做如下说明.显然 σ ij 满足0≤ σ ij ≤∞， σ ij 的值越大，则表示两种属性之间越容易替代，当 σ ij =∞时表示两种属性间是完全可替代的，当 σ ij =0时表示两种属性间是完全不能替代的.无论两种属性间是完全可替代还是完全不可替代都与实际情况不符，因此都不是所需要的. 改进的软件可信性度量模型及其理论验证 1 本节给出一个改进的软件可信性度量模型，并对其进行理论验证.假设如果任一可信属性值低于由用户提供的预期阈值 y 0 ( > 0)，就认为该软件不可信，且规定此时 T =0.因此这里只讨论所有属性值均大于用户提供的预期阈值情形. 定义1     [改进的软件可信性度量模型PBSTM4]: http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457945&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457945&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457945&type=middle 其中 ① 0≤ ε ≤min{1- α min , α max }是用来控制最小关键属性对软件可信性影响的参数， ε 值越大，则最小关键属性对软件可信性的影响就越大； ② 0 < ρ 是一个与关键属性和非关键属性间替代性相关的参数，其值越大，则关键属性与非关键属性之间的替代性越难； ③ -1 < ρ 1 ≤ρ是一个与非关键属性间替代性相关的参数，其值越大，则非关键属性间的替代性越难; ④ 0 < y 0 ≤ y i ≤10(1≤ i ≤ m + s ). 由假设和T的定义易证断言1和断言2成立. 断言1      T 满足非负性. 断言2      T 满足空值性. 断言3      T 满足可信属性比例合适性. 证     因为0 < y 0 ≤ y i ≤10(1≤ i ≤ m + s )，所以对于所有的1≤ i , j ≤ m + s 有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457947&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457947&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457947&type=middle 从而结论可证. 证毕. 断言4      T 关于每一个 y i (1≤ i ≤ m + s ) 是单调递增函数. 证     由 T 、 z 1 和 z 2 的定义可知它们为连续可导函数，对其求偏导数可得 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457950&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457950&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457950&type=middle 因为 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458026&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458026&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458026&type=middle 所以可以得到 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458028&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458028&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458028&type=middle .结论得证. 证毕. 断言5      T 满足凝聚性. 证     通过对 T 关于 y i 求二阶偏导数可以得到 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457953&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457953&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457953&type=middle 因为0≤ α ≤1，1+ ρ > 0， α z 1 - ρ T ρ -1≤0，所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458030&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458030&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458030&type=middle . 又因为0 < y 0 ≤ y i ≤10 (1≤ i ≤ m ), 0≤ α i ≤1 (1≤ i ≤ m )，0≤ ε ≤min{1- α min , α max }，所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457955&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457955&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457955&type=middle 从而有，当1≤ i ≤ m 时有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458032&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458032&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458032&type=middle . 同理，当 m +1≤ i ≤ m + s 时 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457956&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457956&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457956&type=middle 因为0≤ β ≤1, 1+ ρ > 0, α z 2 - ρ T ρ -1≤0，所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458034&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458034&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458034&type=middle . 又因为当 m +1≤ i ≤ m + s 时，0 < y 0 ≤ y i ≤10，0≤ β i ≤1，0 < 1+ ρ 1 ， β i ( y i ) - ρ 1 z 2 ρ 1 -1≤0，所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458036&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458036&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458036&type=middle http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457958&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457958&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457958&type=middle 从而有，当 m +1≤ i ≤ m + s 有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458038&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458038&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458038&type=middle . 综上所述，结论得证. 证毕. 断言6      T 关于所有可信属性具有灵敏性. 证     经过计算易得 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457960&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457960&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457960&type=middle 因为 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457963&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457963&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457963&type=middle 所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458040&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458040&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458040&type=middle ，并且 T 关于各属性的灵敏性与相应属性值和权重相关.此外，最小关键属性相对其权重而言对整个软件可信性的影响更大. 证毕. 断言7      T 中各可信属性之间具有替代性，并且 T 中关键属性与非关键属性之间的替代性既难于关键属性之间的替代性又难于非关键属性之间的替代性. 证     通过计算易得关键属性之间的替代性为 σ ij =1(1≤ i , j ≤ m , i ≠ j )，非关键属性之间的替代性为 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458042&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458042&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458042&type=middle .关于关键属性与非关键属性之间的替代性有如下结论 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457966&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457966&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457966&type=middle 其中 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457969&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457969&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457969&type=middle 因为 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457971&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457971&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457971&type=middle 所以 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457975&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457975&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457975&type=middle 从而有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457979&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457979&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457979&type=middle 综上所述，结论得证. 证毕. 断言8      T 满足可期望性. 证     由断言4中的证明可知，当1≤ i ≤ m 时， z 1 关于每一个 y i 是单调递增函数，此外，0≤ α i ≤1， http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458043&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458043&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458043&type=middle ，则 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457983&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457983&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457983&type=middle http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457987&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457987&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457987&type=middle 因为当 m +1≤ j ≤ m + s 时, z 2 关于每一个 y j 是单调递增函数，且0≤ β j ≤1， http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458046&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458046&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458046&type=middle ，因此有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457990&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457990&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457990&type=middle 又因为 T 关于 z 1 和 z 2 是单调递增函数，从而有 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458050&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458050&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458050&type=middle . 综上所述， T 满足可期望性. 证毕. 由断言1~8可知PBSTM4满足第2节中所给出的基于属性的软件可信性度量性质集，从而完成了对该模型的理论验证.一般而言，关键属性与非关键属性之间的替代性既要难于关键属性间的替代性又要难于非关键属性间的替代性，由断言7可知PBSTM4满足该结论.但在文献[ 27 27 ~ 29 29 27~29 ]中提出的3个模型均不能满足这一结论，并且它们也均不满足空值性，可信属性比例合适性和可期望性，因此该模型优于这3个模型. 实例 1 本节以实例来说明如何利用PBSTM4进行软件可信性的度量.白盒测试是进行测试的一种重要手段，白盒测试的工具化对于测试效率和测试正确性的提高都非常重要.影响白盒测试工具的关键属性主要有可靠性、正确性和性能，非关键属性主要有易用性和可维护性，因此 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457993&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457993&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457993&type=middle 对于一个给定的白盒测试工具，假设其关键属性和非关键属性的权重分别为 α =0.9， β =0.1.下面根据文献[ 28 28 ]中给出的基于合理排序方法求权重向量的组合方法对模型中出现的各属性的权重进行估计.假设关于关键属性和非关键属性的正互反矩阵分别为： http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457996&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457996&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457996&type=middle 依据文献[ 28 28 ]所提出的组合方法，对于矩阵 A 1 ，由对数最小二乘法求得权重向量为最优向量，其为 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457999&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457999&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4457999&type=middle 对于矩阵 A 2 ，由 χ 2 最小二乘法求得权重向量 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458003&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458003&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458003&type=middle 为最优向量，分别选择上述两权重向量作为相应属性的权重.假设 ρ =0.5， ρ 1 =-0.5. 表 1 表 1 给出了4个度量模型利用上述参数所得到的可信性度量值，即PBSTM1，PBSTM2，PBSTM3和PBSTM4列所对应的数值.假设在Sim.2中用户期望值 http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458006&type= http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458006&type=small http://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=4458006&type=middle 2 Sim. 2 y 1 2 y 2 2 y 3 2 y 4 2 y 5 2 ε 4 可信性度量值 PBSTM1 PBSTM2 PBSTM3 PBSTM4 2 1 8 8 6 8 8 0.001 6.79 6.65 6.81 7.71 8 8 6 8 8 0.01 6.58 6.43 6.76 7.69 2 2 8 8 7 8 8 0.001 6.90 6.76 6.93 7.86 8 8 7 8 8 0.01 6.69 6.54 6.91 7.85 则度量模型PBSTM1，PBSTM2，PBSTM3关于Sim.2中 y 1 , y 2 , y 3 , y 4 , y 5 的两组赋值，最后计算出来的可信性度量值均小于7，因此它们均不满足可期望性. 与已有模型比较 1 本节从度量模型是否满足第2节所给出的8条性质的角度，选择两种常用的从属性角度对软件可信性进行度量的模型：基于证据推理的软件可信性度量模型ERBSTE [ 13 13 ] 和基于模糊理论的度量模型FTBSTE [ 16 16 ] 同PBSTE1，PBSTE2和PBSTE3与PBSTE4进行比较.比较结果见 表 2 表 2 ，其中×表示不满足某条性质，√表示满足某条性质.从 表 2 表 2 可以看出只有PBSTE4满足所有8条性质，因此从基于属性的软件可信性度量性质满足程度而言，PBSTE4更优. 模型 非负性 空值性 可信属性比例合适性 单调性 凝聚性 灵敏性 替代性 可期望性 ERBSTE √ √ × √ × √ × √ FTBSTE √ √ × √ × √ × √ PBSTE1 √ × × √ √ √ √ × PBSTE2 √ × × √ × √ √ × PBSTE3 √ × × √ √ √ √ × PBSTE4 √ √ √ √ √ √ √ √ 结论 1 在本论文中我们扩充了基于属性的软件可信性度量性质集，给出了这些性质的形式化描述，提出了一种改进的软件可信性度量模型PBSTE4，并对其合理性进行了理论验证，同时和两个常用的软件可信性度量模型以及文献[ 27 27 ~ 29 29 27~29 ]中提出的度量模型进行了比较，结果表明PBSTE4从基于属性的软件可信性度量性质满足程度方面而言更优. 我们所提出的软件可信性度量性质是软件可信性度量需要满足的必要条件而不是充分条件，一些重要的性质可能没有包含进来，在将来的工作中我们将进一步扩充该性质集.基于属性的软件可信性度量模型如果不满足软件可信性度量性质集，则需进一步改进，若满足度量性质集，则可作为候选模型，等待进一步检验.对所提出模型中相关参数的估计以及实验验证是将来我们要做的又一个工作.此外，我们将继续利用所提出的可信性度量性质对有代表性的基于属性的软件可信性度量模型进行理论验证. 参考文献 刘克, 单志广, 王戟, 等.可信软件基础研究重大研究计划综述[J].中国科学基金, 2008, 22(3): 145-151. LIU K, SHAN Z G, WANG J, et al . Overview on major research plan of trustworthy software[J]. Bulletin of National Natural Science Foundation of China , 2008, 22(3): 145-151 (Ch). 陈火旺, 王戟, 董威.高可信软件工程技术[J].电子学报, 2003, 31(12A): 2-7. CHEN H W, WANG J, DONG W. High confidence software engineering technologies[J]. Acta Electronica Sinica , 2003, 31(12A): 2-7 (Ch). WILHELM H, RALF R. Toward trustworthy software systems[J]. IEEE Computer , 2006, 39(4): 91-92. KIROVSKI D, DRINIC M, POTKONJAK M. Enabling trusted software integrity[J]. ACM SIGOPS Operating Systems Review , 2003, 36(5): 108-120. QIAN H B, ZHU X J, JIN M Z. Research on testing-based software credibility measurement and assessment[C]// Proceedings of World Congress on Software Engineering . Washington D C: IEEE Computer Society, 2009: 59-64. VOAS J. Trusted software's holy grail[J]. Software Quality Control Journal , 2003, 11(1): 9-17. LARRY B. Trustworthy software systems[J]. SIG SOFT Software Engineering Notes , 2005, 30(1): 4-5. STEFFEN B, WILHELM H, ALEXANDRA P, et al . Trustworthy software systems: a discussion of basic concepts and terminology[J]. ACM SIGSOFT Software Engineering Notes archive , 2006, 31(6): 1-18. ZHENG Z M, MA S L, LI W, et al . Complexity of software trustworthiness and its dynamical statistical analysis methods[J]. Science in China Series F: Information Sciences , 2009, 52(9): 1651-1657. ZHENG Z M, MA S L, LI W, et al . Dynamical characteristics of software trustworthiness and their evolutionary complexity[J]. Science in China Series F: Information Sciences , 2009, 52(8): 1328-1334. ZHANG X, LI W, ZHENG Z M, et al . Optimized statistical analysis of software trustworthiness attributes[J]. Science China Information Sciences , 2012, 55(11): 2508-2520. 杨善林, 丁帅, 褚伟.一种基于效用和证据理论的可信软件评估方法[J].计算机研究与发展, 2009, 46(7): 1152-1159. YANG S L, DING S, CHU W. Trustworthy software evaluation using utility based evidence theory[J]. Journal of Computer Research and Development , 2009, 46(7): 1152-1159 (Ch). DING S, YANG S L, FU C. A novel evidential reasoning based method for software trustworthiness evaluation under the uncertain and unreliable environment[J]. Expert Systems with Applications , 2012, 39(3): 2700-2709. 李晓红, 王翔宇, 张涛, 等.基于缺陷分析与测试评审的软件可信性评价方法[J].清华大学学报 (自然科学版), 2011, 51(10):1287-1293. LI X H, WANG X Y, ZHANG T, et al . Software trustworthiness evaluation based on weakness analysis and testing assessment[J]. Journal of Tsinghua University (Science and Technology) , 2011, 51(10): 1287-1293 (Ch). YUAN Y Y, HAN Q. A data mining based measurement method for software trustworthiness[J]. Chinese Journal of Electronics , 2012, 21(1): 13-16. SHI H L, MA J, ZOU F Y. Software dependability evaluation model based on fuzzy theory[C]// Proceedings of IEEE International Conference on Computer Science and Information Technology . Washington D C: IEEE Computer Society, 2008: 102-106. LI B, CAO Y. An Improved comprehensive evaluation model of software dependability based on rough set theory[J]. Journal of Software , 2009, 4(10): 1152-1159. FENTON N, LITTLEWOOD B, NEIL M, et al . Assessing dependability of safety critical systems using diverse evidence[J]. IEE Proceedings Software , 1998, 145(1): 35-39. MORASCA S. Fundamental aspects of software measurement[C]// Proceedings of International Summer Schools (ISSSE 2009-2011) . Berlin: Springer-Verlag, 2013: 1-45. SRINIVASAN K., DEVI T. Software metrics validation methodologies in software engineering[J]. International Journal of Software Engineering and Applications (IJSEA) , 2014, 5(6): 87-102. WEYUKER E J. Evaluating software complexity measures[J]. IEEE Transactions on Software Engineering , 1988, 14(9): 1357-1365. LAKSHMANAN K B, JAYAPRAKASH S, SINHA P K. Properties of control-flow complexity measures[J]. IEEE Transactions on Software Engineering , 1991, 17(12): 1289-1295. BRIAND L C, MORASCA S, BASILI V R. Property-based software engineering measurement[J]. IEEE Transactions on Software Engineering , 1996, 22(1): 68-86. MORASCA S. Refining the axiomatic definition of internal software attribute[C]// Proceedings of the Second ACM-IEEE International Symposium on Empirical Software Engineering and Measurement . New York: ACM, 2008: 188-197. RAJNISH K. Theoretical validation of inheritance metrics for object-oriented design against Briand's property[J]. International Journal of Information Engineering and Electronic Business , 2014, 6(3): 28-33. TAO H W, CHEN Y X. Complexity measure based on program slicing and its validation[J]. Wuhan University Journal of Natural Sciences , 2014, 19(6): 512-518. TAO H W, CHEN Y X. A metric model for trustworthiness of softwares[C]// Proceedings of the 2009 IEEE/WIC/ACM International Joint Conference on Web Intelligence and Intelligent Agent Technology . Washington D C: IEEE Computer Society, 2009: 69-72. http://ieeexplore.ieee.org/abstract/document/5284935/ TAO H W, CHEN Y X. A new metric model for trustworthiness of softwares[J]. Telecommunication system , 2012, 51(2-3): 95-105. TAO H W, CHEN Y X. Another metric model for trustworthiness of softwares based on partition[C]// Proceedings of the 2010 Quantitative Logic and Soft Computing . Berlin: Springer-Verlag, 2010: 695-705. http://link.springer.com/chapter/10.1007/978-3-642-15660-1_70 ZHANG L W, CHEN Y X, ZHOU Y, et al . Stability of software trustworthiness measurements models[C]// Proceedings of 2013 IEEE 7th International Conference on Software Security and Reliability-Companion (SERE-C) . Washington D C: IEEE Computer Society, 2013: 219-224. http://ieeexplore.ieee.org/abstract/document/6616347/ 10.14188/j.1671-8836.2017.02.008 TP311 whdxxblxb-63-2-151 国家自然科学基金资助项目 (91118007) 2016-05-01 2017-04-24 2020-12-09 版权所有© 2017 《武汉大学学报 (理学版)》编辑部 Copyright © 2017 Journal of Wuhan University (Natural Science Edition). All rights reserved. 2017 武汉大学学报 (理学版) 2 63