D.3.3 ALGORITHMS FOR INCREMENTAL ... - SecureChange

18 F. Massacci and L.M.S. Tran
When propagated upward, depend on the kinds of predecessor nodes and the
kinds of connections among nodes, suitable operation (join or concat) will
be applied. join is used to generate the DAT of a compound node where the
semantic is that all child node are chosen. Whereas, concat is used to generate
the DAT of a goal node or observable node where the semantic is the selection of
one among its successor.
8 M “
map〈x,i,pi
〉 i)”
DAT(g
∀〈g i ,x,p i 〉∈E
>< M
DAT(c
DAT (x) ←
i )
∀〈c i ,x,1〉∈E
O
DAT(x i )
>:
∀〈x i ,x,p i 〉∈E
x is an observable node,
x is a goal node.
x is a compound node.
(9)
where map 〈x,i,pi 〉 DAT(x) = [ j
{〈S j , p i · mb j , 1 − p i · rr j , 〈x, i〉 ‖T j 〉}. The operator ‘‖’
denotes the string concatenation operation e.g., a‖ {b, c} = {ab, ac}.
We assume that there are only one top goal in the goal model. Even though it is
not the case in practice, we are always able to introduce a new phantom root goal
which is AND-decomposed to all existing top goals. This trick ensures that there
is only one root DAT generated. Once the DAT of root node is generated, it is used
to calculate the max belief and residual risk of an arbitrary configuration C.
To this end, given an evolutionary goal model eGM with root node is x 0 , the
following formulae calculate the max belief and residual risk of a configuration C.
where
MaxB(C) = max mb i
∀〈S i ,mb i ,rr i ,T i 〉∈SDA(C)
X
(10)
RRisk(C) = 1 −
rr i
∀〈S i ,mb i ,rr i ,T i 〉∈SDA(C)
∀ 〈S i , mb i , rr i , T i 〉 ∈ DAT(x 0 ).C ⊇ S i ∧∄ 〈·, ·, ·, T i 〉 ∈ SDA(C) ⇒ 〈S i , mb i , rr i , T i 〉 ∈ SDA(C)
Notice that two or more tuples in an DAT which have a same T i determine that
they are design alternatives fulfilling a same observable evolution possibility. Thus,
when calculating residual risk, only one of them is taken into account.
Algo. 1 presents the algorithm that generates DATs for every node in a given
evolutionary hypergraph. The algorithm comprise two procedures, generateDAT
and initializeDAT. The later (line 23–34) initializes DATs for every nodes
in accordance to Formula 5. This procedure also initializes two data structures,
REACH and Q. The later holds list of ready-to-process nodes which have their
successors DATs properly generated, whereas the former holds the number of unprocessed
child nodes of an arbitrary node. In other words, REACH[x] is 0 if and
only if x is ready to process. Initially, all leaf nodes are enqueued as they are ready
to process.
The former procedure, generateDAT, generates DATs of non-leaf nodes by
synthesizing successors’ DATs. The basic idea of the procedure is as follows. First,