Using Analytics to Improve Trust in Software Ecosystems

使用分析来提高对软件生态系统的信任

• 批准号: RGPIN-2020-06811
• 负责人: Shihab, Emad
• 金额: $ 3.5万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=750125
• 关键词: Using; Analytics; Improve; Trust; Software

A software ecosystem is the interaction of a set of actors (e.g., code contributors and consumers) on top of a common technological platform (e.g., Node.js) that results in a number of software solutions or services. These software ecosystems allow developers to easily share and reuse other's code, reducing development time. The openness of these ecosystems, which allows anyone to contribute and/or reuse code, is a major contributor to their success and rapid growth. For example, the node package manager (npm) hosts approximately 1.2 million packages. Although this openness is generally a positive trait, it also poses a major risk since it requires consumers to trust the ecosystem contributor's developers/organizations - people they generally know very little about. This notion of trust needs to be better understood and supported if ecosystems are to thrive in the future. Therefore, the objective of the proposed research is to improve trust in software ecosystems. Specifically, I plan to accomplish my objective by 1) empirically examining trust-related issues faced by ecosystem consumers; 2) developing actionable analytics and models to help warn about trust issues in ecosystem contributions; and 3) providing mitigations for trust-related issues facing ecosystem consumers. The successful completion of this program will enable ecosystem consumers better leverage software ecosystems. Consumers of the ecosystem will have novel analytics and models to gauge how well they can trust their dependencies. Also, ecosystem consumers will have potential mitigations that they can apply to help increase trust in the ecosystem contributions they depend on. Large-scale empirical studies will be performed to validate the effectiveness of the proposed analytics, models and mitigations. These empirical studies will be performed using many different ecosystems, analysis techniques and involve multiple stakeholders to to improve the generalizability of the program's outcomes. The proposed research will have a direct impact on the software engineering research and practice because it will advance the field by providing pragmatic techniques, based on novel, actionable analytics and models. Furthermore, the proposed research will expose, train and enable highly qualified personnel to learn and contribute to the state-of-the-art in the increasingly important topic of software ecosystems.

软件生态系统是一组参与者（例如，代码贡献者和消费者）在公共技术平台之上（例如，Node.js），产生了许多软件解决方案或服务。这些软件生态系统允许开发人员轻松共享和重用他人的代码，从而缩短开发时间。这些生态系统的开放性，允许任何人贡献和/或重用代码，是其成功和快速增长的主要贡献者。例如，节点包管理器（npm）托管约120万个包。虽然这种开放性通常是一个积极的特征，但它也带来了重大风险，因为它要求消费者信任生态系统贡献者的开发人员/组织-他们通常对这些人知之甚少。如果生态系统要在未来蓬勃发展，就需要更好地理解和支持这种信任的概念。因此，所提出的研究的目标是提高软件生态系统的信任。具体来说，我计划通过以下方式实现我的目标：1）实证研究生态系统消费者面临的信任相关问题; 2）开发可操作的分析和模型，以帮助警告生态系统贡献中的信任问题; 3）为生态系统消费者面临的信任相关问题提供缓解措施。该计划的成功完成将使生态系统消费者能够更好地利用软件生态系统。生态系统的消费者将有新的分析和模型来衡量他们对依赖关系的信任程度。此外，生态系统消费者将有潜在的缓解措施，他们可以应用这些措施来帮助增加对他们所依赖的生态系统贡献的信任。将进行大规模的实证研究，以验证拟议的分析、模型和缓解措施的有效性。这些实证研究将使用许多不同的生态系统，分析技术进行，并涉及多个利益相关者，以提高该计划成果的普遍性。拟议的研究将对软件工程研究和实践产生直接影响，因为它将通过提供基于新颖的，可操作的分析和模型的实用技术来推进该领域。此外，拟议的研究将暴露，培训和使高素质的人员能够学习和促进国家的最先进的软件生态系统的日益重要的主题。