Recent statistics reveal that 56% of software attacks are caused by insider negligence and 26% are caused by malicious insiders. They also show that 67% of organizations experience at least 21 incidents per year. Most of these incidents require significant time and effort to contain them. In this regard, ensuring compliance with corporate policies, regulations, and industry best practices is paramount. This study investigates software compliance requirements, factors, and policies together with the challenges they address. By taking a wider perspective, this study aims at bringing an understanding of existing research foci, evolving issues, and research directions. The study uses a systematic literature review and keyword analysis, to identify relevant studies that address the derived research questions. Considering scholarly articles published in the last decade, 4,772 results were retrieved and checked through an initial screening. A thorough screening is then conducted to further reduce the results to 77 primary articles. The requirement on security of end users is gaining more attention. There is an emphasis on the gap between domain and compliance experts on the one side and software engineers on the other side. The review also identified 55 factors (and their underlying theories) that impact behavioral compliance with a majority of them focusing on individuals. Our results also list nineteen policies and compliance challenges they address. No distinction is found between open-source and proprietary software among the reviewed studies. The most mentioned policies are security education, training, and awareness (SETA), compliance automation, and organizational climate. The evolving topics in the field are: theory of workarounds, compliance and privacy by design, policy as code, security stress, and home-office users. The review provides 9 recommendations, comprising practical implications for decision makers, theoretical implications for future research, and potential enhancement of the underlying theories.

Based on a comprehensive literature survey, the constructs of the cybersecurity information sharing ecosystem have been defined in detail. Using this ecosystem, the interrelationships among the stakeholders with respect to cybersecurity information sharing are analyzed, the value parameters are determined, the value functions are defined, and the values obtained by the stakeholders through simulation are calculated. Furthermore, it is investigated whether the stakeholders involved in this ecosystem can create sufficient value to sustain in the market. The outcome of this research includes an economic model for evaluating the value creation and distribution among the stakeholders. This model is a critical step forward to better align the values (i.e., utilities and profits) of stakeholders. The simulation results of the model show that end users are the main source of value generation. Cybersecurity solution providers and cybersecurity information providers get benefits from a growing installed base of end users. However, in saturated markets, there is a risk of un-sustainability of the ecosystem, as the cost of cybersecurity solutions and cybersecurity information cannot be recovered through their fees. The simulation model and the findings of this study can help business managers to make better decisions related to business strategies, sustainability, and pricing schemes for cybersecurity solution and cybersecurity information. Moreover, a working cybersecurity information sharing ecosystem is essential for the adoption of cloud computing and, especially, edge computing. It allows capturing, disseminating, and aggregating cybersecurity information from a large number of computing devices and computing providers reliably and accurately.

We examine whether a time lag exists before the network position of a software service affects its performance. Moreover, we analyze different time lags, using empirical data about software services and their usage for creating composite services. Our results show that software services in central positions (i.e., high betweenness centrality) attract users the most. The highest effect exhibits, if the time lag is 26–32 months. Our findings are relevant, as they can guide developers in marketing their software services and are expected to impact innovation studies regarding the importance of considering time lags and analyzing complementary knowledge.

Within a closed ecosystem, end-users cannot interoperate with other platforms or port their software and data easily without a cost for interface integration or data re-formatting. The customers of these closed software service platforms are locked-in. Potential customers, who are aware of this lock-in issue, are hesitant to adopt a closed software service platform, slowing down the wide deployment of the software service platform. This paper applies an economic perspective to investigate the value creation for providers and users at different levels of interoperability. For the analysis, a value creation model for software service platforms within a software service ecosystem has been developed. Simulations of the value creation model show that, even if investments in interoperability and portability are aimed at addressing user requirements, their impact also drives the providers’ profitability. Furthermore, emerging providers require investing more than market leading providers, as they have less power to set de facto standards. The simulation results also show that there is an optimal level of investments, with respect to profit and return on investments. Overall, from these results, platform providers cannot only obtain an understanding on how investments in interoperability and portability impact cost, enable cost-effective service integration, and create value, but also design new strategies for optimizing investments. • Design of a model for analyzing portability and interoperability of software service platforms. • Simulation of the impact of interoperability and portability on provider revenue and user utility. • Design of a method for evaluating investments in interoperability and portability of platforms.

In this study, we explore the emergence of cooperative behavior in the prisoner's dilemma evolutionary game. In particular, we investigate the effect of bounded rationality of individuals on the networking topology (i.e., the individuals' personal networks). For this, we highlight the evolutionary dynamics of cooperation on top of different graph topologies with respect to their baseline properties such as average shortest path length and clustering coefficient. In addition, we test the effect of a new variable, called memory of interactions, on the changes in behavior and decision-making of the players as well as the networking outcome. For this purpose, we use agent-based modeling, which allows studying how changes in the environment or changes of properties of networked actors affect the evolutionary dynamics of cooperation among them. The results of our analysis confirm that the networking topology and the memory duration are important in affecting the emergence of cooperative behavior of players. They also impact the total utility that can be obtained from playing the Prisoner's Dilemma evolutionary game. Although the Prisoner's Dilemma game simulations tend towards full cooperation, if they are run over graph topologies with short average shortest path lengths and low clustering coefficients, the number of steps needed to reach equilibrium increases. This new result provides an understanding of the interactions of actors in a game.

An employee profile record within a human resource management department includes information about the employee's past activities within the enterprise. These profile records are valuable sources of information for any enterprise. Using this information requires an intelligent enterprise information system. In this study, we emphasize the importance of having detailed analyses on the employees' knowledge base within an enterprise by applying dynamic social impact theory. We argue that the richer the knowledge base within an enterprise with respect to its human and social capital is, the more it can empower its employees to be creative and innovative during group works. We propose a framework for effectively modeling the ever-changing knowledge bases of big enterprises for delivering optimal and automated team composition techniques. Our discussions cover the complete pipeline from data management and knowledge modeling, via graph analysis, to decision support services.

Person-to-person interactions within an organization form a network of people. Changes of the structural properties of these networks are caused through a variety of dynamic processes among the people. We argue in this paper that there is a feedback loop between individual actions and the network structure. Therefore, a proper interaction model is needed to explain the emerging structural changes among networked individuals. According to our proposed interaction model, which is based on a complex adaptive system approach, changes in the network properties are consequences of four factors: (1) the initial underlying network structures; (2) the process of network growth; (3) the adoption of strategic responses to what other individuals do in the network; and (4) the network visibility. The experimental results show that all of these factors have influence. If the process of network growth triggers strategic responses of all direct neighbors, we observe a heavy drop in the average shortest path length between the individuals. The value of the average shortest path length shrinks to three, even independently of the visibility of the global network topology. We observe the same trend for the clustering coefficient. Fluctuations in the clustering coefficients are not significant, if visibility of the network topology is set to a high value. However, in the presence of only small number of strategic responses and a high network visibility, a short average shortest path length and a high clustering coefficient can be observed.

In this study, we provide an interaction model based on complex adaptive system theory, to explain how different methods of network growth and strategic responses of existing network members towards them impact the outcome of networked individuals (i.e., utility gain at the individual level or a society's collective utility known as social welfare). The proposed interaction model allows us to perform our experiments with dynamic utility computation, while individuals act strategically in response to what other individuals do in the network. We utilized the formulation of the co-author model, as it augments the concept of network structure for modeling individuals' utilities. The experimental results show that different methods of a network growth lead to different networking outcome for its members. We observed that total networking outcome is the highest (with respect to the co-author model), if newly entered individuals establish their links strategically to other existing members in a way to maximize their own payoffs. We believe that reduction in the total utility due to strategic responses within the network is acceptable in exchange of having a homogenous utility distribution within the population. Our observations give us the idea that, with the help of strategic responses, central network members can be prevented from gaining very high utilities compared to others. Furthermore, network structures can be prevented, in which the utilities of network members are widely dispersed. In such a setting, individuals experience no discrimination in utility gain against other people in their community.

One of the notable trends in the software industry is that software vendors provide their software on a platform as a service. Software users consume those software services or compose new services by combining those existing software services. The software vendors, their services, software users, and the platform represent an open innovation system. Collective intelligence is the underlying mechanism for the cooperation between the users of the system, i.e. their continuous reuse of existing software services for the creation of new services. A successfully working software services system (i.e. collective intelligence system) is a system that is continuously adapted by its users to meet their needs. The evolution of this software-as-a-service (SaaS) innovation system and the behavior of SaaS users within this system are still unknown. In this paper, we describe the evolution of a SaaS network. The SaaS network consists of nodes (i.e. software services with open interfaces) and links (i.e. the co-development relationships of software services with open interfaces). The results suggest that the SaaS network has gradually grown into a scale-free network with a slight concavity in its cumulative degree distribution. The results also suggest that the topology characteristics are invariant over time except for the early time periods. Furthermore, the results suggest that the SaaS network is not as open (i.e. inter-operable) as its technology let us expect. Considering these results, we imply that SaaS innovation is achieved by platform providers striving to capture users with a few, leading SaaS services. That means, SaaS innovation is not achieved through the possibilities of potential combinations between any kind of SaaS services as could be expected theoretically. These findings are expected to stir further research on the actual structure of open innovation systems that are driven by collective intelligence.

In terms of intercarrier compensation traffic flows are measured to allocate the costs between networks. This method provides a poor basis for sharing any costs. In this work we analyze the benefits of the traffic differentiation on the interconnection charges in unilateral and bilateral arrangements. We determine an original initiator of a transmission and compensate differently for the distinguished traffic flows. The presented approach was compared with the existing solutions, which perform cost compensation based on the traffic flows.

This paper investigates the impact of determination of an original initiator of transmission on demand as well as profits of the providers. For that purpose we present a new model, called differentiated traffic-based interconnection agreement (DTIA) that differentiates traffic into two types, referred to as native and stranger in order to determine a transmission initiator. In comparison to the existing financial settlement, under which the payments are based on the net traffic flow, the proposed model governs cost compensation according to the differentiated traffic flows. In addition, a traffic management mechanism that supports the presented approach was described. Analytical studies were provided using Nash bargaining solution to explore how the proposed strategy affects the outcome of providers' negotiation. The key consequence of the obtained results showed that determination of an initiator of transmission induces providers to receive higher profits.

Service Level Agreements (SLAs) is currently one of the major research topics in Grid Computing. Among many system components for the supporting of SLA-aware Grid-based workflow, the SLA mapping module receives important positions. Optimizing execution time is an important task of the mapping module as it helps in finding out afeasible solution when the Grid is busy or by eliminating the negative effects of the error. With the previously proposed algorithm for optimizing the execution time of the workflow, the mapping module may, when many requests come in a short period of time, become the bottleneck of the system. This paper presents a parallel mapping algorithm for optimizing the execution time of the workflow, which can cope with the problem. Performance measurementsdeliver evaluation results on the quality of the method.

This paper investigates the role of providers' market shares for consumers and websites on interconnection settlements between networks. We proposed to differentiate traffic into two types, referred to as native and stranger in order to determine an original initiator of transmission in the IP network and to compensate the interconnection costs. In comparison to the existing financial settlement, under which the payments are based on the net traffic flows, the proposed model governs cost compensation according to the differentiated traffic flows. Analytical studies were provided using Nash bargaining solution to explore how the presented approach affects the providers' payments. The key consequence of the obtained results shows that symmetry of the costs is not required prerequisite for peering, and asymmetric providers can arrange interconnection without monetary transfers.

Service level agreements (SLAs) are currently one of the major research topics in grid computing. Among many system components for supporting of SLA-aware Grid jobs, the SLA mapping module holds an important position and the capability of the mapping module depends on the runtime of the mapping algorithm. With the previously proposed mapping algorithm, the mapping module may develop into the bottleneck of the system if many requests come in during a short period of time. This paper presents a parallel mapping algorithm to map heavy communication SLA-based workflow onto Grid resources which can cope with the problem. Performance measurements thereby deliver evaluation results showing the quality of the method.

Service level agreements (SLAs) are currently one of the major research topics in Grid Computing. Among many system components for supporting of SLA-aware Grid-based workflows, the SLA mapping module receives an important position. Mapping light communication workflows is one main part of the mapping module. With the previously proposed mapping algorithm, the mapping module may become the bottleneck of the system when many requests come in a short period of time. This paper presents a parallel mapping algorithm for light communication SLA-based workflows, which can cope with the problem. Performance measurements deliver evaluation results on the quality of the method.

The error recovery mechanism receives an important position in the system supporting service level agreements (SLAs) for the grid-based workflow. If one sub-job of the workflow is late, a group of directly affected sub-jobs should be re-mapped in a way that does not affect the start time of other sub-jobs in the workflow and is as inexpensive as possible. With the distinguished workload and resource characteristics as well as the goal of the problem, this problem needs new method to be solved. This paper presents a mapping algorithm, which can cope with the problem. Performance measurements deliver good evaluation results on the quality and efficiency of the method.

Network identity management system, in theory, is conceived as the solution to many identity-related issues burgeoning day-to-day. These issues, which need to be addressed, range from managing the outburst of user identities to protecting user interests as well as business interests. This paper proposes a framework for network identity management on the Internet that addresses these issues from a user-centric point of view. After discussing the challenges and opportunities of a user-centric identity management system, we describe the architecture of our framework called UNIQuE in detail. The architecture comprises components such as a security infrastructure, a trust subsystem, an inter-provider communication system, and a repository system. In essence, the goal of this framework is to specify a comprehensive, user-centric solution to all identity-related issues, which also vouches for effortless maintenance. The fundamental difference to existing systems is its integrating approach to many usually separately considered, identity-related issues

In this paper, we present an Internet transaction management system for sender/receiver payment schemes. This system allows an arbitrary split of transaction charges between two communication partners. Using this kind of system, new business models can be implemented on the Internet. The new system provides more flexibility than existing charging schemes. Under these new business models, service providers can pick up a share of the cost for the transaction with any of their customers; offer collect-call type of services; or provide services such as the 900 services on the telephone network. This paper describes in detail the transaction management protocol (TMP), its implementation, and the transaction management service platform (TMS). The TMP specifies the protocol state diagram as well as the process of how the costs for resource usage can be allocated to communicating end-users. The TMS platform defines the architecture and the modules, simplifying the implementation of the TMP on the Internet. The TMS provides a module-based transaction management environment, carrying transaction signals such as message schema, accounting policy information, communication reference information, and end-user agreement information. In addition to this, an application of the TMS within the framework of bandwidth broker interconnection networks and a short evaluation of the proposed transaction management system are given.

We propose a market-managed QoS (quality of service) interconnection model for heterogeneous networking environments. The deployment of this model will help autonomous systems to reduce the cost of their network services as well as increase social welfare. We describe a technical solution for a next generation Internet, where networks are managed based on either technology requirements (QoS networks) or market principles (market-managed networks). Our solution requires two technologies: BMP (bandwidth management point) and a modified version of BGP (border gateway protocol). The modified version of BGP, as proposed in this paper, provides additional routing exchange information such as price and QoS level specifications. Both technologies are discussed with regard to the impact on routing, QoS provisioning, and charging. In order to show the benefit of our approach for inter-domain routing and interconnection, we present some analytical and simulation results, showing the significant increase in network service revenue as well as the increase in social welfare. These results draw important implications for designing the next generation Internet with regard to investment in QoS networks.

This paper describes a control mechanism for a future Internet. It is an economic mechanism that enables users to choose different pairs of price/QoS priority levels for network services at the user time scale. The user time scale means that prices vary at a rate suitable for human beings to respond to those price changes. The changes might happen on an hourly, daily, or weekly basis. We believe that such an economic control mechanism at a medium time scale, which is coupled with a technical rate control mechanism at a short time scale, is a simple and cost-reducing system that can provide quality of service to end-users. We show that the approach proposed enables network service providers to react to network congestion appropriately and provide end-users with high flexibility in service selection. After discussing different Internet pricing principles, we describe the market-managed test network, the QoS pricing and charging software for network services, and the experiments run on a DiffServ network. We present a theoretical model based on Markov chains that can represent the proposed market-managed network. Finally, we present results from the analysis of the theoretical model as well as measurement results from the DiffServ network. We show that the behavior of such a system depends on the user's net benefit, the prices for the network services, as well as on the heterogeneity of the user pool.

The current Internet Service Provider market does not offer \ndifferent types of service plans for Internet access. The predominant \npricing plan is a flat-rated plan. Since the number of new Internet users is \nstill growing very fast, there is no real competition in the Internet market. \nConsequently, there is no incentive for Internet Service Providers (ISPs) \nto focus on certain user groups by offering more attractive pricing plans \nin order to differentiate themselves. However, as soon as the number of \nnew Internet users stagnats, ISPs have to specialize on certain market segments. \nThen, the question raises what is an attractive service plan that is \nattractive for users, but allows ISPs to build a sustainable business. \nBased on empirical results of the INDEX project, we discuss a service \nplan for Internet access that might be appreciated by Internet users as \nwell as by ISPs. This service plan combines the advantages of flat-rate \npricing and usage-based pricing. Using this service plan, users will benefit \nby receiving a basic service, but are given the choice of higher quality \nwhenever they demand. From the ISP perspective, it will help to focus on \ncertain user groups and limit the peak load on their network.

The proliferation of electronic commerce has emphasized \nthe need for multiple qualities of service (QoS) that meet \nuser requirements for, e.g., best-eort services, transactional \nguarantees, prioritized services, and bandwidth reservations. \nWhen Internet users will be able to choose from a large selection \nof network services, an important question is whether \nthis \nexibility will be appreciated by the user and how much \nvalue is placed on network resources. This paper focuses on \nuser acceptance of dierent usage-based pricing models for \nnetwork services as well as on which users benet from dynamic \npricing. The analytic results presented here are based \non pricing experiments conducted within the INternet Demand \nEXperiment (INDEX). The pricing experiments comprise \nper-minute and byte-volume pricing. After describing \nthe experimental design and characterizing our subject pool \nusing demographic data, we analyze user demand for Internet \naccess by comparing the three experiments in terms of \ntraÆc generation, QoS selection, and expenditure. Finally, \nwe show which user groups will benet from such services.