Open source software is widely deployed for both academic and commercial purposes. However, failures and attacks against open source software are often reported. In contrast to traditional software, failures of open source software are reported by users and fixed by developers. Because of the overheads and cost of updates, users do not update their software as soon as the latest patch is released. We are attracted by the optimal maintenance problem for open source software from the users’ perspective. In this paper, we propose periodic and aperiodic maintenance management models with non-homogeneous bug-discovery/correction processes in terms of total expense. Also, according to a dynamic-programming algorithm, we numerically derive the optimal maintenance schedule under the aperiodic policy. In numerical examples, we investigate the efficiency of the proposed policies by mathematical experiments. And, based on bug reports of Hadoop MapReduce, we predictively illustrate the optimal maintenance scheduling for a real open source software product.
CavusogluHZhangJ. Security patch management: Share the burden or share the damage?Manage Sci2008; 54: 657–670.
2.
CavusogluH. Economics of security patch management. In: 5th workshop on the economics of information security (WEIS‘06), Cambridge, England, June 26–28, 2006.
3.
OkamuraHTokuzaneMDohiT. Optimal security patch release timing under non-homogeneous vulnerability-discovery processes. In: 20th international symposium on software reliability engineering, (ISSRE‘09), Mysuru, Karnataka, India, November 16–19, 2009, pp. 120–128. Piscataway: IEEE Press.
4.
LyuMR. Handbook of software reliability engineering. New York: McGraw-Hill, 1996.
5.
MusaJD. Software reliability engineering. New York: McGraw-Hill, 1999.
6.
GoelALOkumotoK.Time-dependent error-detection rate model for software reliability and other performance measures. IEEE Trans Reliab1979; R-28: 206–211.
7.
GoelAL. Software reliability models: assumptions, limitations, and applicability. IEEE Trans Reliab1985; SE-11: 1411–1423.
8.
YamadaSOhbaMOsakiS. S-Shaped reliability growth modeling for software error detection. IEEE Trans Reliab1983; R-32: 475–478.
9.
MusaJDIanninoAOkumotoK. Software reliability measurement, prediction, application. New York: McGraw-Hill, 1987.
10.
Abdel-GhalyAAChanPYLittlewoodB. Evaluation of competing software reliability predictions. IEEE Trans Software Eng1986; SE-12: 950–967.
11.
SchneidewindNF. Fault correction profiles. In: 14th international symposium on software reliability engineering, Denver, Colorado, November 17–21, 2003, pp. 257–267. Piscataway: IEEE Press.
12.
SchneidewindNF. Assessing reliability risk using fault correction profiles. In 8th international symposium on high assurance systems engineering, Tampa, Florida, March 25–26, 2004, pp. 139–148. Piscataway: IEEE Press.
13.
GokhaleSSLyuMRTrivediKS. Software reliability analysis incorporating fault detection and debugging activities. In: 9th international symposium on software reliability engineering, Paderborn, Germany, November 4–7, 1998, pp. 202–211. Piscataway: IEEE Press.
14.
GokhaleSSLyuMRTrivediKS. Analysis of software fault removal policies using a non-homogeneous continuous time Markov chain. Software Qual J2004; 12: 211–230.
15.
ShibataKRinsakaKDohiTOkamuraH. Quantifying software maintainability based on a fault-detection/correction model. 13th pacific rim international symposium on dependable computing (PRDC‘07), Melbourne, Victoria, Australia, December 17–19, 2007, pp. 35–42. Piscataway: IEEE Press.
16.
BolchGGreinerSMeerHTrivediKS. Queueing networks and Markov chains: Modeling and performance evaluation with computer science applications. New York: Wiley-Interscience, 1998.
17.
AroraATelangRXuH. Optimal policy for software vulnerability disclosure. In: 3rd annual workshop on economics of information security (WEIS‘04), Minnesota, May 13–14, 2004.
18.
BeattieSArnoldSCowanCWaglePWrightC. Timing the application of security patches for optimal uptime. In: 16th USENIX systems administration conference (LISA‘02), Philadelphia, November 3–8, 2002, pp. 233–242.
MarseguerraMZioE. Optimizing maintenance and repair policies via a combination of genetic algorithms and Monte Carlo simulation. Reliab Eng Syst Saf2000; 68: 69–83.
21.
XiaTJinXXiLNiJ. Production-driven opportunistic maintenance for batch production based on MAM–APB scheduling. Eur J Oper Res2015; 240: 781–790
22.
XiaTXiLZhouXLeeJ. Dynamic maintenance decision-making for series–parallel manufacturing system based on MAM–MTW methodology. Eur J Oper Res2012; 221: 231–240.
23.
XiaTXiLZhouXDuS. Modeling and optimizing maintenance schedule for energy systems subject to degradation. Comput Ind Eng2012; 63: 607–614.
24.
PhamH. Handbook of reliability engineering. London: Springer, 2003.
25.
OkamuraHDohiT. SRATS: Software reliability assessment tool on spreadsheet (experience report). In: 24th international symposium on software reliability engineering (ISSRE‘13), Pasadena, USA, November 4–7, 2013, pp. 100–107. Piscataway: IEEE Press.
OhbaM. Inflection S-shaped software reliability growth model. In: OsakiSHatoyamaY (eds) Stochastic models in reliability theory. Berlin: Springer-Verlag, 1984, pp. 144–165.
28.
OkamuraHDohiTOsakiS. EM Algorithms for logistic software reliability models. In: 22nd international conference on software engineering, 2004, pp. 263–268. Calgary: ACTA Press. February 17–19, 2004 Innsbruck, Austria
29.
AlhazmiOHMalaiyaYK. Application of vulnerability discovery models to major operating systems. IEEE Trans Reliab2008; 57: 14–22.
30.
AlhazmiOH. Measuring and enhancing prediction capabilities of vulnerability discovery models for Apache and IIS HTTP servers. In: 17th international symposium on software reliability engineering (ISSRE‘06), Raleigh, North Carolina, November 7–10, 2006, pp. 343–352. Piscataway: IEEE Press.
31.
WooSWAlhazmiOHMalaiyaYK. Assessing vulnerabilities in Apache and IIS HTTP servers. In: 2nd international symposium on dependable, autonomic and secure computing (DASC‘06), Indiana University-Purdue University, Indianapolis, USASeptember 29–October 1, 2006, pp. 103–110. Piscataway: IEEE Press.
32.
AlhazmiOHMalaiyaYK. Modeling the vulnerability discovery process. In: 16th international symposium on software reliability engineering (ISSRE‘05), Chicago, Illinois, November 8–11, 2005, pp. 129–138. Piscataway: IEEE Press.
33.
BellmanR. Dynamic programming. Princeton: Princeton University Press, 1957.
34.
PutermanM. Markov decision processes. New York: John Wiley & Sons, 1994.
35.
GottfriedBS. A stopping criterion for the golden-ratio search. Oper Res1975; 23: 553–555.
