A Decision Support Model for Software Composition Analysis Tools

Abstract

Context: Software Composition Analysis (SCA) tools are essential for managing third-party dependencies in software development. These tools help identify and mitigate vulnerabilities in third-party dependencies. Given the increase in open-source soft-ware usage in software development, the importance of effective SCA tools also grows, making it crucial to choose the right tool for the specific project needs. Problem: Despite the availability of many SCA tools, a comprehensive selection model for a wide range of tools is lacking. Due to the variety of alternatives available and the specific needs of different projects, selecting the most suitable SCA tool can be formulated as a multi-criteria decision problem. Objective: The main objective of this study is to support decision-makers in selecting the right SCA tools by designing an efficient and effective decision-support model. Method: Using design science, this study proposes a multi-criteria decision model(MCDM) for the SCA tool selection problem. This MCDM is based on an existing framework that assists decision-makers with software selection problems in the software production industry. This model captures knowledge regarding the quality attributes and features of 29 SCA tools. The knowledge is gathered through literature study, expert interviews and document analysis. Result: This resulted in a MCDM consisting of approximately 64 features, and 29 SCA tools based on their support for these features, and 39 Quality attributes that assesses the impact of the features. Conclusion: The model supports decision makers by providing an overview of the tools and their supported features, helping to filter and compare options based on their specific requirements. By using the MoSCoW weighted decision-making method, the model assists organizations in prioritising their requirements and providing a short list of SCA tools. While the model provides valueable support, it should not be solely relied upon for final decisions. Decision makers are adviced to complement the MCDM model with deeper insights into the actual performance of the tool.