Using Analytics to Improve Trust in Software Ecosystems

使用分析来提高对软件生态系统的信任

• 批准号: RGPIN-2020-06811
• 负责人: Shihab, Emad
• 金额: $ 3.5万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=741447
• 关键词: Using; Analytics; Improve; Trust; Software

A software ecosystem is the interaction of a set of actors (e.g., code contributors and consumers) on top of a common technological platform (e.g., Node.js) that results in a number of software solutions or services. These software ecosystems allow developers to easily share and reuse other's code, reducing development time. The openness of these ecosystems, which allows anyone to contribute and/or reuse code, is a major contributor to their success and rapid growth. For example, the node package manager (npm) hosts approximately 1.2 million packages. Although this openness is generally a positive trait, it also poses a major risk since it requires consumers to trust the ecosystem contributor's developers/organizations - people they generally know very little about. This notion of trust needs to be better understood and supported if ecosystems are to thrive in the future. Therefore, the objective of the proposed research is to improve trust in software ecosystems. Specifically, I plan to accomplish my objective by 1) empirically examining trust-related issues faced by ecosystem consumers; 2) developing actionable analytics and models to help warn about trust issues in ecosystem contributions; and 3) providing mitigations for trust-related issues facing ecosystem consumers. The successful completion of this program will enable ecosystem consumers better leverage software ecosystems. Consumers of the ecosystem will have novel analytics and models to gauge how well they can trust their dependencies. Also, ecosystem consumers will have potential mitigations that they can apply to help increase trust in the ecosystem contributions they depend on. Large-scale empirical studies will be performed to validate the effectiveness of the proposed analytics, models and mitigations. These empirical studies will be performed using many different ecosystems, analysis techniques and involve multiple stakeholders to to improve the generalizability of the program's outcomes. The proposed research will have a direct impact on the software engineering research and practice because it will advance the field by providing pragmatic techniques, based on novel, actionable analytics and models. Furthermore, the proposed research will expose, train and enable highly qualified personnel to learn and contribute to the state-of-the-art in the increasingly important topic of software ecosystems.

软件生态系统是一组参与者（例如，代码贡献者和消费者）的相互作用，在通用技术平台（例如Node.js）之上，它导致了许多软件解决方案或服务。这些软件生态系统使开发人员可以轻松共享和重复使用他人的代码，从而减少开发时间。这些生态系统的开放性，允许任何人贡献和/或重复使用代码，是他们成功和快速增长的主要贡献者。例如，节点软件包管理器（NPM）托管约120万包。尽管这种开放性通常是一个积极的特征，但它也带来了主要风险，因为它要求消费者信任生态系统贡献者的开发商/组织 - 他们一般不认识的人。如果生态系统将来要蓬勃发展，则需要更好地理解和支持这种信任的概念。因此，拟议的研究的目的是提高对软件生态系统的信任。具体而言，我计划通过1）实现生态系统消费者面临的与信任相关的问题来实现我的目标； 2）开发可行的分析和模型，以帮助警告生态系统贡献中的信任问题； 3）为生态系统消费者面临的与信任有关的问题提供缓解。该程序的成功完成将使生态系统消费者更好地利用软件生态系统。生态系统的消费者将拥有新颖的分析和模型，以评估他们能够信任自己的依赖性的程度。此外，生态系统消费者将具有潜在的缓解措施，以帮助增加对他们依赖的生态系统贡献的信任。将进行大规模的经验研究，以验证拟议的分析，模型和缓解的有效性。这些经验研究将使用许多不同的生态系统，分析技术进行，并涉及多个利益相关者，以提高计划结果的普遍性。拟议的研究将对软件工程研究和实践产生直接影响，因为它将通过基于新颖，可行的分析和模型提供实用技术来推进该领域。此外，拟议的研究将揭示，训练和使高素质的人员能够学习并为软件生态系统越来越重要的主题中的最先进做出贡献。