Software Development Risk Research Articles

Enhancing Security in Industrial Application Development: Case Study on Self-Generating Artificial Intelligence Tools

The emergence of security vulnerabilities and risks in software development assisted by self-generated tools, particularly with regard to the generation of code that lacks due consideration of security measures, could have significant consequences for industry and its organizations. This manuscript aims to demonstrate how such self-generative vulnerabilities manifest in software programming, through a case study. To this end, this work undertakes a methodology that illustrates a practical example of vulnerability existing in the code generated using an AI model such as ChatGPT, showcasing the creation of a web application database, SQL queries, and PHP server-side. At the same time, the experimentation details a step-by-step SQL injection attack process, highlighting the hacker’s actions to exploit the vulnerability in the website’s database structure, through iterative testing and executing SQL commands to gain access to sensitive data. Recommendations on effective prevention strategies include training programs, error analysis, responsible attitude, integration of tools and audits in software development, and collaboration with third parties. As a result, this manuscript discusses compliance with regulatory frameworks such as GDPR and HIPAA, along with the adoption of standards such as ISO/IEC 27002 or ISA/IEC 62443, for industrial applications. Such measures lead to the conclusion that incorporating secure coding standards and guideline—from organizations such as OWASP and CERT training programs—further strengthens defenses against vulnerabilities introduced by AI-generated code and novice programming errors, ultimately improving overall security and regulatory compliance.

Quantum software development risks

In the last five years we have witnessed the emergence of numerous quantum computers, as well as dozens of quantum programming languages, platforms, etc... But it must be borne in mind that quantum computing is still in a state of technological flux, so it is essential to carry out a good risk assessment. Furthermore, it is necessary to try to mitigate the risks to safeguard the investments that organisations are starting to make in quantum software development. We identify some of the major risks associated with quantum computing, and specially quantum software and we also show a real case of risk mitigation based on technology. In the last five years we have witnessed the emergence of numerous quantum computers, as well as dozens of quantum programming languages, platforms, etc... But it must be borne in mind that quantum computing is still in a state of technological flux, so it is essential to carry out a good risk assessment. Furthermore, it is necessary to try to mitigate the risks to safeguard the investments that organisations are starting to make in quantum software development. We identify some of the major risks associated with quantum computing, and specially quantum software and we also show a real case of risk mitigation based on technology.

Monte Carlo Simulation for Risk Management in ِِِAgile Software Development

Agile development methodologies are becoming increasingly popular in agile development projects due to their iterative nature and adaptability. The Monte Carlo method is distinguished by its statistical technique of using random samples to obtain many satisfactory results for solving uncertainty. It can be used in agile software development by building different scenarios and measuring their impact on the project results through statistical operations. Its ability to meet significant challenges in managing risk and uncertainty mitigation. In this study, we propose a Monte Carlo simulation-based approach to measure and analyze risks in the agile development process. It provides a probabilistic framework for risk assessment by integrating the Monte Carlo simulation methodology to model the various development process variables. It was addressed by identifying the main risk factors within agile projects, such as tasks, availability of resources, and external dependencies. The proposed approach contributes to mitigating potential risks in agile software development using Monte Carlo theory, which provides a systematic framework that enables work teams and management to overcome risk and uncertainty associated with the agile development process in dynamic project environments.

Multi-Head CNN-based Software Development Risk Classification

Agile methodology for software development has been in vogue for a few decades, notably among small and medium enterprises. The omission of an explicit risk identification approach turns a blind eye to a range of perilous risks, thus dumping the management into strenuous situations and precipitating dreadful issues at the crucial stages of the project. To overcome this drawback a novel Agile Software Risk Identification using Deep learning (ASRI-DL) approach has been proposed that uses a deep learning technique along with the closed fishbowl strategy, thus assisting the team in finding the risks by molding them to think from diverse perspectives, enhancing wider areas of risk coverage. The proposed technique uses a multi-head Convolutional Neural Network (Multihead-CNN) method for classifying the risk into 11 classes such as over-doing, under-doing, mistakes, concept risks, changes, differences, difficulties, dependency, conflicts, issues, and challenges in terms of producing a higher number of risks concerning score, criticality, and uniqueness of the risk ideas. The descriptive statistics further demonstrate that the participation and risk coverage of the individuals in the proposed methodology exceeded the other two as a result of applying the closed fishbowl strategy and making use of the risk identification aid. The proposed method has been compared with existing techniques such as Support Vector Machine (SVM), Multi-Layer Perceptron (MLP), Generalized Linear Models (GLM), and CNN using specific parameters such as accuracy, specificity, and sensitivity. Experimental findings show that the proposed ASRI-DL technique achieves a classification accuracy of 99.16% with a small error rate with 50 training epochs respectively.

نموذج مقترح لإدارة المخاطر في الشركات ذات المشروعات المتعددة

Recently, the importance of risk management has increased in the field of project management, especially software projects. The importance of risk management is because it has direct effects on the success of the project. Therefore, software organizations face a major challenge in achieving effective and efficient risk management. Therefore, measuring risks in software development is a key activity to be undertaken in risk management. Risk measurement is also one of the important topics that need more effort, especially in a work environment with multiple software projects. A multi-project environment involves multiple projects sharing the same available resources. This research aims to conduct a literature review to discover patterns or trends in software development to measure project risks and to reveal aspects of the measurement process, risk indicators, and various metrics for software projects. This research also aims to present a proposed framework for assessing risks in a multi-project work environment with shared resources for different levels in organizations with different capabilities.

An Empirical Study on Code Smell Introduction and Removal in Deep Learning Software Projects

With increasing popularity of Deep Learning (DL) software development, code quality issues arise in DL software development. Code smell is one of the factors which reduce the quality of source code. Several previous studies investigated the prevalence of code smell in DL software systems to evaluate the quality of DL source code. However, there is still a lack of understanding of the awareness of individual DL developers in code smell. To more deeply understand the code smell risk in DL software development, it is needed to investigate the code smell awareness of DL developers. In this paper, we present an empirical study on code smell practices of DL developers. Specifically, we performed a quantitative analysis on code smell introduction and removal practices of DL developers. We collected a dataset of code smell introduction and removal history of DL developers from several open source DL software GitHub repositories. We then quantitatively analyzed the collected dataset. As a result of the quantitative analysis, we observed the following three findings on code smell introduction and removal practices of DL developers. First, DL developers tend to perform code smell introduction practice more than code smell removal practice. Second, DL developers have slightly broader code smell introduction scope than code smell removal scope. Third, regular and irregular DL developers have less difference in both code smell introduction and removal practices. The results indicate that DL developers have very poor awareness on code smell risk. Our findings suggest that DL software development project managers should provide a helpful guideline that makes DL developers actively participate code smell removal tasks.

Identifying and Addressing Risks in the Early Design of a Sociotechnical System through Premortem

Anticipating risks in software development is always challenging, but particularly so when the software application is part of a novel sociotechnical system with various human and physical components. Our interdisciplinary team of software engineering and human factors researchers is designing such a system. In order to identify and mitigate the risks latent in this previously unexplored space, we have used the premortem method at an early stage in system design. In the premortem, the team ideated failure scenarios across the range of system use, then collaborated on ways to eliminate, mitigate, or monitor the risks of these failures. We have found the premortem method valuable in recognizing and mitigating previously unanticipated risks and in enriching team communication.

Perhitungan Estimasi Upaya Pengembangan Software Pulsa Online dengan Fuzzy C-Means dan Fuzzy K-Means

Top-up can be done by prepaid and postpaid. Top-up at this time can also be done by way of online purchases. Credit with a prepaid system is a real-time top-up. Payments are made before the customer uses credit. Prepaid credit is different from postpaid which is not real-time and is done after the customer uses credit. Before credit can be used, it is necessary to create a credit server first. In this case, limited resources become an obstacle in completing the credit server creation which will later be used by credit users. Therefore, it is necessary to estimate the effort in the development of the server application, so that the estimation can be known, both in terms of resources, and processing time to estimates in terms of costs. In this case, the appropriate method should be used to overcome the obstacle and reduce the risk of software development. There are several ways to use the Fuzzy K-Mean and Fuzzy C-Means methods to complete the creation of impulse servers, perform analysis and interpretation, and provide information and actions for the quality of research output, education, and evaluation research. The result of the grouping comparison is to produce a derivative formula for the Fuzzy K-Mean and Fuzzy C-Means algorithms.

MCBRank Method to Improve Software Requirements Prioritization

Software Requirements Prioritization is an important issue that has a more profound effect on the overall quality of software development. Application of software requirements prioritization provides benefits to minimize risks in software development so that the most important and most impactful requirements are given priority. This paper presents a proposed software requirements prioritization method named MCBRank, which incorporates renowned MoSCoW Method and Case-Based Ranking to improve prioritization correctness. It elaborates on the implementation of MCBRank in an empirical investigation to determine software requirements prioritization for a potential e-library system. The investigation allows the software requirements prioritization process to be implemented by using the proposed MCBRank method. A role-playing empirical investigation with 30 respondents prioritized 31 software requirements, and the results were measured by Cohen Kappa. The kappa results show that MCBRank achieves a better agreement towards the Gold Standard with kappa value of 0.60. Therefore, the investigation results support that MCBRank improves the importance of ranking correctness, representing the stakeholders’ wants and the organization's actual needs for the potential e-library system.

Developing a risk assessment model for banking software development projects based on rough-grey set theory

PurposeRisk management is one of the most influential parts of project management that has a major impact on the success or failure of projects. Due to the increasing use of information technology in all fields and the high failure rate of software development projects, it is essential to predict the risk level of each project effectively before starting. Therefore, the main purpose of this paper is proposing an expert system to infer about the risk of new banking software development project.Design/methodology/approachIn this research, the risk of software developing projects is considered from four dimensions including risk of cost deviation, time deviation, quality deviation and scope deviation, which is examined by rough set theory (RST). The most important variables affecting the cost, time, quality and scope of projects are identified as condition attributes and four initial decision systems are constructed. Grey system theory is used to cluster the condition attributes and after data discretizing, eight rule models for each dimension of risk as a decision attribute are extracted using RST. The most validated model for each decision attribute is selected as an inference engine of the expert system, and finally a simple user interface is designed in order to predict the risk level of any new project by inserting the data of project attributesFindingsIn this paper, a high accuracy expert system is designed based on the combination of the grey clustering method and rough set modeling to predict the risks of each project before starting. Cross-validation of different rule models shows that the best model for determining cost deviation is Manual/Jonson/ORR model, and the most validated models for predicting the risk of time, quality and scope of projects are Entropy/Genetic/ORR, Manual/Genetic/FOR and Entropy/Genetic/ORR models; all of which are more than 90% accurateResearch limitations/implicationsIt is essential to gather data of previous cases to design a validated expert system. Since data documentation in the field of software development projects is not complete enough, grey set theory (GST) and RST are combined to improve the validity of the rule model. The proposed expert system can be used for risk assessment of new banking software projectsOriginality/valueThe risk assessment of software developing projects based on RST is a new approach in the field of risk management. Furthermore, using the grey clustering for combining the condition attributes is a novel solution for improving the accuracy of the rule models.

ARP–GWO: an efficient approach for prioritization of risks in agile software development

Risk management is considered as a critical project management activity that needs to be performed for successful software development. Within risk management, risk prioritization is an important process which helps the software team to effectively manage the risks at early stage of the project. In agile-based software environment, it is necessary to prioritize the risks in an effective manner in order to address the risks in shorter duration of time. In recent times, swarm intelligence techniques are widely popular in solving various optimization problems in software development process. The main reason is due to its convergence accuracy toward global optimal solution and faster computational time. In this study, an efficient risk prioritization technique termed as ARP–GWO (agile risk prioritization–grey wolf optimization) has been proposed for prioritizing the risk factors present in the agile software development using grey wolf optimization (GWO). The proposed ARP–GWO method helps the organization to mitigate the risks and ensures successful delivery of software products with good quality, in lesser cost and time. The effectiveness of ARP–GWO is analyzed using two performance metrics, namely Index of Integration and Usability Goals Achievement Metric, for which case studies are performed on five industrial projects from two different organizations. The experimental results indicate that ARP–GWO is most effective in prioritization of risks and offers better enhancement with high degree of satisfaction among developers and users as compared with the existing agile process.

Assessing the Risk of Software Development in Agile Methodologies Using Simulation

Agile methodologies aim to reduce software development risk using short iterations, feature-driven development, continuous integration, testing automation, and other practices. However, the risk of project failure or time and budget overruns is still a relevant problem. The aim of this paper is to present and discuss a new approach to model some key risk factors in agile development, using software process simulation modeling (SPSM), which can complement other approaches, and whose usage is particularly suited for agile development. We introduce a new approach to modeling some key risk factors – namely project duration, number of implemented issues, and key statistics of issue completion time – using a simulator of agile development, which we developed to this purpose. The approach includes modeling the agile process, gathering data from the tool used for project management, and performing Monte Carlo simulations of the process, to get insights about the expected time and effort to complete the project, and to their distributions. The model’s parameters that can cause risk are errors in effort estimation of the features to develop, variations in developers’ assignment to these features, impediments related to developers’ availability and work completion. To validate the simulator, and to demonstrate how the method can be used, we analyzed three open source projects, gathering their data from JIRA repositories. We ran Monte Carlo simulations of these projects, showing that the simulator can well approximate the progress of the real project, then varying the identified risk factors and statistically evaluating their effects on the risk parameters. The proposed approach is relevant for project managers, being able to quantitatively evaluate the risks, provided that the process and the project’s data are properly modeled and gathered. As for the future, we are working to improve our risk assessment method, evaluating it on more case studies, scaling the model from a single team to multiple teams involved in one or more projects.

Do scaling agile frameworks address global software development risks? An empirical study

Driven by the need to coordinate activities of multiple agile development teams cooperating to produce a large software product, software-intensive organizations are turning to scaling agile software development frameworks. Despite the growing adoption of various scaling agile frameworks, there is little empirical evidence of how effective their practices are in mitigating risk, especially in global software development (GSD), where project failure is a known problem.In this study, we develop a GSD Risk Catalog of 63 risks to assess the degree to which two scaling agile frameworks–Disciplined Agile Delivery (DAD) and the Scaled Agile Framework (SAFe)–address software project risks in GSD. We examined data from two longitudinal case studies implementing each framework to identify the extent to which the framework practices address GSD risks.Scaling agile frameworks appear to help companies eliminate or mitigate many traditional risks in GSD, especially relating to users and customers. However, several important risks were not eliminated or mitigated. These persistent risks in the main belonged to the Environment quadrant highlighting the inherent risk in developing software across geographic boundaries. Perhaps these frameworks (and arguably any framework), would have difficulty alleviating, issues that appear to be outside the immediate control of the organization.

Short term Predication of Risk Management Integrating Artificial Neural Network ANN

The IT industry has boomed in the past few years with an ever increasing number of risk management applications being developed. There are inherent risks in software development projects and failure to deliver software projects within deadline or failure to develop software according to specifications can be costly. The software risks may occur during the project process. The management process of software risks consists the risk refinement, risk identification, risk monitoring, risk maintenance, risk estimation and risk mitigation. Neural Network has ability to stimulate hidden pattern recognition skill. The primary study of this paper is to focus on various risk management models and how risk tools may help in mitigating software risks during the project development. With the application of Neural Network, We propose short term risk management model which can predict the risk involvement with the upcoming project risks, analyzing from the previous projects causing serious loss in the IT project in terms of values on certain risk factors. Neural Network model can also ability to evaluate the assessment of risks in software development and acts as an effective instrument in analysis and minimizing risks that enable continuous improvement in software processes and products.

A Novel Case Base Reasoning and Frequent Pattern Based Decision Support System for Mitigating Software Risk Factors

Software risk management is crucial for the success of software project development. The existing literature has models for risk management, but is too complex to be used in practice. The information in the existing studies is scattered over different articles which makes it difficult to find relevant knowledge to establish relationship between risk factors and mitigations. This paper presents a novel model which identifies the relationship between risk factors and mitigations automatically by using intelligent Decision Support System (DSS). The proposed model has four steps. Firstly, the input of the system has been designed where risk factors and mitigations have been inputted into it. Secondly, rule based machine learning approach has been used for mining of associations between risks and mitigations. Thirdly, Case Based Reasoning (CBR) approach has been used to determine the previous cases as rules. Finally, automated rules have been generated to develop an intelligent DSS to mitigate the software risks. The proposed technique copes with the highly cited existing limitations of risk handling like, lack of generic DSS and intelligent relationship between software risks and mitigations. Automated rules have been discovered with a novel idea of CBR and frequent pattern. The proposed model is capable of mitigating upcoming risks in future. Star schema has been implemented to support our proposed DSS. Moreover, from highly cited literature 40 studies were identified from which 26 risk factors, 57 mitigations, 14 questions and 26 automated rules have been extracted. According to the validation of IT industry experts, the average of the effectiveness of DSS is 51-55%. The novelty of the proposed research is that it uses two state of the art methods (Rule Based Machine Learning and CBR) to identify software risk mitigations. The results of the proposed model show that the chances of risks in software development have been reduced significantly.

A comparative study of meta-heuristic optimisation techniques for prioritisation of risks in agile software development

A comparative study of meta-heuristic optimisation techniques for prioritisation of risks in agile software development

A comparative study of meta-heuristic optimisation techniques for prioritisation of risks in agile software development

Risks are in general termed as threats or uncertainties that influence the project performance and its outcomes to the greater extent. To ensure software quality and project success, every organisation should enforce a proper mechanism to efficiently manage the risks irrespective of the development model they follow. Risk prioritisation is a most critical step in risk management process that helps the organisation to resolve the risks in shorter duration of time. In this paper, a comparative study about different meta-heuristic optimisation techniques for prioritising the risks in agile environments is presented. The five most effective meta-heuristic optimisation algorithms such as Genetic Algorithm (GA), Particle Swarm Optimisation (PSO), Ant Colony Optimisation (ACO), Grey Wolf Optimisation (GWO) and Analytical Hierarchy Process (AHP) are considered and the results are evaluated based on four key criterion attributes such as error rate, accuracy, reliability, and running time. The result proves that GWO outperforms other four meta-heuristic optimisation techniques for the prioritisation of risks in agile environment.

A Recommendation Approach Based on Bayesian Networks for Clone Refactor

Reusing code fragments by copying and pasting them with or without minor adaptation is a common activity in software development. As a result, software systems often contain sections of code that are very similar, called code clones. Code clones are beneficial in reducing software development costs and development risks. However, recent studies have indicated some negative impacts as a result. In order to effectively manage and utilize the clones, we design an approach for recommending refactoring clones based on a Bayesian network. Firstly, clone codes are detected from the source code. Secondly, the clones that need to be refactored are identified, and the static and evolutions features are extracted to build the feature database. Finally, the Bayesian network classifier is used for training and evaluating the classification results. Based on more than 640 refactor examples of five open source software developed in C, we observe a considerable enhancement. The results show that the accuracy of the approach is larger than 90%. We believe our approach will provide a more accurate and reasonable code refactoring and maintenance advice for software developers.

Effort Estimation For Software Development On Mobile Application Of 'Tangkap Reptil'

An essential aspect of planning and management of software design projects is to estimate work time, costs, and human resources. The calculation solution made in this study aims to assist in calculating the estimated time of developing a reptile capture application using the Use Case Point (UCP) method. The UCP method is a software effort estimation method that shows better performance compared to other methods. The result of this research is the risk of software development on the mobile application of 'Tangkap Reptil' has a small chance, can be done in a relatively short time, and does not require a lot of resources.

Agile risk management for multi‐cloud software development

Industry in all sectors is experiencing a profound digital transformation that puts software at the core of their businesses. In order to react to continuously changing user requirements and dynamic markets, companies need to build robust workflows that allow them to increase their agility in order to remain competitive. This increasingly rapid transformation, especially in domains like IoT or Cloud computing, poses significant challenges to guarantee high quality software, since dynamism and agile short-term planning reduce the ability to detect and manage risks. In this paper, we describe the main challenges related to managing risk in agile software development, building on the experience of more than 20 agile coaches operating continuously for 15 years with hundreds of teams in industries in all sectors. We also propose a framework to manage risks that considers those challenges and supports collaboration, agility, and continuous development. An implementation of that framework is then described in a tool that handles risks and mitigation actions associated with the development of multi-cloud applications. The methodology and the tool have been validated by a team of evaluators that were asked to consider its use in developing an urban smart mobility service and an airline flight scheduling system.