Queensley C Chukwudum
email: queensleyv@yahoo.com

Reinsurance Pricing of Large Motor Insurance Claims in Nigeria: An Extreme Value Analysis

Keywords: Extreme value theory, Generalized Pareto distribution, Risk Management, XL Reinsurance, Negative Binomial, Monte Carlo simulation

Insurers that undertake high risk profiles usually exceed their financial capabilities, hence the importance of reinsurance. This allows the insurance company to cover risks that they, under normal circumstances, would not be able to cover on their own. An insurer needs to be able to evaluate his solvency probability and consequently, adjust his retention levels appropriately because the insurer's retention level plays a vital role in determining the premiums he will pay to the reinsurer. To illustrate how Extreme Value theory can be applied, this study delves into modeling the probabilistic behavior of the frequency and severity of large motor claims from the Nigerian insurance sector (2013)(2014)(2015)(2016) using the Negative Binomial-Generalized Pareto distribution (NB-GPD). The annual loss distribution is simulated using the Monte Carlo method. Pricing of the Excess-of-loss (XL) reinsurance is also examined to aid insurers in optimizing their risk management decision in regards to the choice of their risk transfer position.

Introduction

In the face of extreme risks, an insurer can suddenly fall into ruins. This is because of the lowfrequency, high-severity nature of such occurrences. To manage these types of risks, an insurer needs to be well equipped beforehand, having the required knowledge and tools that will enable him to accurately gauge the magnitude of losses that may be experienced and to put appropriate measures in place in case such an event takes place. Extreme Value theory (EVT) provides us with a solid theoretical foundation upon which we can build statistical models that describe extreme events.

As highlighted by [START_REF] Embrechts | Extreme Value Theory in Finance and Insurance[END_REF], modeling claim-size distributions in non-life insurance; stress testing of catastrophe insurance portfolios; pricing of multi-line, multi-year, rare event (high layer) reinsurance products and pricing of catastrophe triggered bonds are some of the gains that can be made when EVT is applied.

Extreme modeling-based inference is a very valuable source of information in the insurers' decisionaiding manual. As stated by Perez-Fructuoso et. al. (2010), the application of EVT to modelling large claims will help the insurer to correctly measure the risks and select the optimal capital requirements. Furthermore, he is able to price the policy appropriately and choose the most favourable reinsurance layer. This important point is re-echoed by [START_REF] Paldynski | Modelling Large Claims in Property and Home Insurance -Extreme Value Analysis[END_REF] who argued that for the company to remain solvent in cases of extremely large insurance claims a combination of capital buffers and reinsurance must be present. This will help to absorb the unexpected losses. Even more important is the fact that such capital shortfalls have a significant impact on the company's existence, thus the need to assess the probability of such occurrences. On reinsurance, [START_REF] Paldynski | Modelling Large Claims in Property and Home Insurance -Extreme Value Analysis[END_REF] gives some reasons for the need for it. It can be used to hedge against say, catastrophic weather in a given geographical region or as a means of sharing risks especially for policies that incur large losses. Reinsurance is also a way of reducing the variance of underwriting results and can enable an insurance company increase their geographical presence in a regulated industry. [START_REF] Embrechts | Extreme Value Theory in Finance and Insurance[END_REF] give an introduction to EVT and showcase its use with the aid of examples involving financial and loss data. [START_REF] Mcneil | Estimating the Tails of Loss Severity Distributions Using Extreme Value Theory[END_REF] used EVT to model the tails of loss severity distributions while [START_REF] Rootzén | Extreme Value Statistics and Wind Storm Losses: A Case Study[END_REF] employed the EVT technique in a study of wind storm losses. Corradin and Verbrigghe (2001) estimated the loss frequency and loss severity of large fire claims. They also examined the impact of a quota and an XL reinsurance on the distribution of the total loss. An EV analysis on the Spanish motor liability insurance market data was carried out by Perez-Fructuoso et al. (2010). They show how the decision-making process, relating to the pricing of reinsurance, is optimized when considering a risk transfer position. [START_REF] Brazauskasa | Modeling Severity and Measuring Tail Risk of Norwegian Fire Claims[END_REF] modeled the severity and the tail risk associated with the Norwegian fire claims while that of Taiwan was fitted using the Generalized Pareto distribution (GPD) [START_REF] Lee | Fitting the Generalized Pareto Distribution to Commercial Fire Loss Severity: Evidence from Taiwan[END_REF].

With reference to insurance companies or sectors within Africa, Wainaina and Watitu (2014) modeled Kenya's fire industrial insurance class of business using EVT. They estimated the VaR at different confidence intervals. [START_REF] Karobia | Modelling Extreme Claims using Generalized Pareto Distributions Family in Insurance Company[END_REF] modeled extreme claims for a selected insurance company using GPD. In the assessment of the Nigeria's motor industrial class of business by [START_REF] Adesina | Using Extreme Value Theory to Model Insurance Risk of Nigeria's Motor Industrial Class of Business[END_REF] using EVT, the main purpose was to compare the different methods for estimating VaR. Their results reveal that extreme VaR is the most suitable.

This study contributes to literature specifically in the aspect of reinsurance pricing in which little or no study has been done so far using an African-based data.

The rest of this paper is structured accordingly: the theoretical framaework is covered in section 2 and XL reinsurance in section 3. The data is analyzed and the results obtained are discussed in the 4th section. Finally, conclusions are made in the 5th section.

The foundations of EVT were developed by Fisher and Tippet (1928). Coles (2001) gives a very detailed presentation of the theoretical background of EVT. Classical EVT techniques consist of the Block maxima (BM) and the GPD approaches. This study makes use of the GPD method.

The Generalized Pareto distribution and the threshold approach

This method considers more of the most extreme observations. This is one of the main advantage it possesses when compared to the BM approach. The threshold model is one of the methods for choosing what data to incorporate into the analysis for greater precision. This technique is due to [START_REF] Pickands | Statistical Inference using Extreme Order Statistics[END_REF].

Theorem 1: Let X 1 , X 2 , ... be a sequence of independent random variables with common distribution function F and let

M n = max{X 1 , X 2 , ..., X n }
Let us denote an arbitrary term in X i sequence by X and suppose that X satisfies the Generalized extreme value conditions so that for large n

IP[M n ≤ z] ≤ z → G(z)
as n → ∞

For a non-degenerate distribution function G given as

G(z) = exp -1 + ξ z -µ σ -1 ξ +
for some µ, σ > 0 and ξ then for large enough u the distribution function of X conditional on X > u can be approximated as

IP[X ≤ y|X > u] → H(y) as u → ∞
where

H(y) = 1 -1 + ξ y -u σ u -1 ξ + y > u (2.1)
H(y) is the GPD with the modified scale parameter σ u = σ + ξ(u -µ) corresponding to the excess of the threshold u. z + = max(z, 0). For X > u we can set X = X -u and thus rewrite the equation as

IP[X ≤ y|X > u] → H (u) (y) as u → ∞
where

H (u) (y) = 1 -1 + ξ y σ u -1 ξ + y > u
Again, z + = max(z, 0) and σ u = σ + ξ(u -µ)

In general we have the GPD as

IP(X < y|X > u) =      1 -1 + ξ y-u σu -1 ξ + ξ = 0 1 -exp -y-u σu + ξ = 0 (2.2)

Modeling frequency and severity: NB-GPD model

The GPD model alone accounts for the magnitudes of the extreme events but to obtain a more exact inference, it is important to take into account the times at which the events occur. Thus the large claims are modeled using a frequency-severity approach. The NB-GPD model which is one of the ways to achieve this, combines the peak-over-threshold (POT) with the NB distribution. This model is closely connected to the claim process in the CramérLundberg model. The CramérLundberg model is a very popular model in early ruin theory -a study of how insurance companies are exposed to insolvency risks.

The GPD model is used to model the severity of the losses while the NB model is fitted to the number of losses above the selected threshold to model the frequency. The NB is used because for the sample provided, the variance is greater than the mean which implies that over dispersion is evident.

Thus, using the Poisson model in this case may lead to an underestimation of the standard errors.

A mix of the poisson and gamma distributions gives the NB distribution. In essence we assume that the Poisson parameter λ is gamma distributed making it very useful especially when incorporating parameter uncertainty into the Poisson parameterization.

The frequency-severity model falls under the framework of the loss distribution approach (LDA) where the claim severity is assumed to be independent of the claim frequency and they are both modeled separately. We therefore, have the aggregate loss S as:

S = N i=1 X i (2.3)
X i is the ith claim (which is assumed to be strictly positive) and N is the number of claims. This is the collective risk model. The assumptions are as follows: the X i 's are independent and identically distributed (iid) and they are independent of N which is a discrete random variable representing the number of losses.

Quantities such as the distribution function, the expected value and the variance of the aggregate loss, S, are usually of interest to the insurer.

Distribution function and generating functions of S

Proposition 1: The distribution function of S is

F S (x) = ∞ n=0 IP(N = n)F * n X (x)
where

F * n X (x) = IP(X 1 + X 2 + ... + X n ≤ x) is the nth fold convolution power of F X Proof. F S (x) = IP(S ≤ x) = ∞ n=0 IP(S ≤ x|N = n)IP(N = n) = ∞ n=0 IP(X 1 + X 2 + ... + X n ≤ x)IP(N = n) = ∞ n=0 F * n X (x)IP(N = n)
For most distributions, F S (x) can only be evaluated using numerical methods. Recursively, F * n X (x) is given by

F * n X (x) = x 0 F * (n-1) X (x -y)f X (y)dy with F * 0 X (x) =    1 x ≥ 0 0 x < 0
An alternative way of representing a probability distribution is through its moment generating function (mgf). Apart from providing us with an easy way of calculating the moments of a distribution, we are also able to characterize the distribution of the sum of independent random variables and the sum of a random number of independent random variables.

Proposition 2: The moment generating function of S is given by

M S (z) = P N [M X (z)]
where P N [.] denotes the probability generating function (pgf).

Proof.

We recall the the pgf of S is:

P S (z) = E(z S ) = ∞ n=0 E[z S |N = n]IP(N = n) = E[z 0 ]IP(N = 0) + ∞ n=1 E[z X 1 +X 2 +...+Xn |N = n]IP(N = n) = IP(N = 0) + ∞ n=1 E[Π n j=1 z X j ]IP(N = n) = ∞ n=1 IP(N = n)[P X (z)] n = P N [P X (z)]
Hence the mgf of S is

M S (z) = E(e zS ) = P S (e z ) = P N [P X (e z )] = P N [M X (z)]
We can now simply obtained the mean and variance of S from the derivative of its mgf. This gives

E(S) = M S (0) = E(N )E(X) V ar(S) = M S (0) -(M S (0)) 2 = E(N )V ar(X) + V ar(N )[E(X)] 2
Specifically in the case of reinsurance, the losses above a retention level R is considered. The distribution of losses above R is also an interesting quantity to study.

Distribution of excess losses

Drawing from Antal's (2009) study, one can determine the distribution for both the number of excess losses above R and the excess loss burden.

Proposition 3: Suppose the number of the excess losses be given by

N R = N i=1 I [X i >R]
where

I [X i >R] is the indicator function and N ∼ N B(r, p) with π = IP(X > R). Then the distribution of N R is given as N B(r, p p+π(1-p) ).
Proof.

A convenient way to prove this is to use the mgf technique, and the two important properties that will be made use of are stated below.

Property 1: Let X and Y be independent random variables. Let Z be equal to X with probability p and equal to Y with probability 1 -p. Then the mgf of Z is

M Z (s) = pM X (s) + (1 -p)M Y (s)
Property 2: Let X 1 , X 2 , ... be a sequence of iid random variables. Let N be another independent random variable that takes nonnegative integer values.

Let Y = N i=1 X i . Then the mgf of Y is M Y (s) = M N (logM X (s)).
The mgf of N can easily be shown to be

M N (z) = p 1 -(1 -p)e z r Let Y = I [X>R] =    1 X > R 0 X ≤ R
This means Y takes on the value 1 with probability π and 0 with probability 1 -π. Therefore mgf of

Y is M Y (z) = E[e z.I [X i >R] ] = (1 -π)E[e z.0 ] + πE[e z.1 ] (f rom property 1) = 1 -π + πe z
From property 2 , the mgf of N R = N i=1 Y i will be

M N R (z) = M N [log(M Y (z))] = p 1 -(1 -p)e logM Y (z) r = p 1 -(1 -p)M Y (z) r = p 1 -(1 -p)(1 -π + πe z ) r = p p + (1 -p)π -(1 -p)πe z r =   p p+(1-p)π p+(1-p)π-(1-p)πe z +pe z -pe z p+(1-p)π   r =   p p+(1-p)π 1 -1 - p p+(1-p)π e z   r ⇒ N R ∼ N B(r, p p+π(1-p) )
Next, let us look at the distribution of the excess loss burden N i=0 (X i -R) + .

Proposition 4: Given R and N R (as defined in proposition 3) then

N i=0 (X i -R) + has same distribution as N R i=0 (Y i -R) + .
where Y i are iid random variables with distribution IP[.|X > R] that are independent of N R Proof.

Let the probability measure of model (N, X) be P and that of model (Y, N R ) be P.

P N i=1 (X i -R) + ≤ s = ∞ n=0 P N i=1 (X i -R) + ≤ s|N R = n P[N R = n] = ∞ n=0 P n i=1 (X i -R) + ≤ s|X 1 , ...X n > R P[N R = n] = ∞ n=0 P n i=1 (Y i -R) + ≤ s P[N R = n] = P N R i=1 (Y i -R) + ≤ s

Tail risk management measures

A key issue in risk management is the definition of risk as well as the definition of relevant risk measures. The most commonly used risk measures are value at risk (VaR) and expected shortfall (ES). VaR describes the amount of extreme loss which is exceeded only with a certain small probability within a given time frame.

V aR q = inf {u : F (u) ≥ q}

To obtain VaR using GPD, we consider a threshold u. The distribution of the excesses above u is

F u (y) = IP(X -u ≤ y|X > u) = F (y + u) -F (u) 1 -F (u)
for some underlying distribution F describing the series X i . 0 ≤ y < x F -u. x F is the right end point of F . From theorem 1, we know that F u (y) can be well approximated using the GPD distribution.

That is, F u (y) ∼ = H (ξ,σ) (y) as u → ∞. Thus the underlying distribution becomes

F (x) = F (u) + [1 -F (u)]H (ξ,σ) (x -u)
for x > u and the empirical estimate for F (u) is

F (u) = n -N u n
where n is the total number of observations and N u is the number of observations above the threshold u. Therefore, the tail estimate can be written as

F (x) = N u n 1 -H (ξ,σ) (x -u) + 1 - N u n = 1 - N u n 1 + ξ x -u σ -1 ξ +
By inverting the tail estimate formula we obtain VaR

V aR q = u + σ ξ n N u (1 -q) -ξ -1 (2.4)
The ES which can be described as the expected value of the size of the loss exceeding the VaR with some level of probability conditioned on the fact the loss actually exceeds the VaR is

ES q = V aR q + E[X -V aR q |X > V aR q ] = V aR q 1 - ξ + σ -ξu 1 - ξ (2.5)

XL Reinsurance

Let X represent the loss incurred and suppose we have an insurance policy with retention level R, then, the payment made by the reinsurer will be g(X) where

g(X) =    0 if X < R X -R if X ≥ R (3.1)
Hence the reinsurance premium (RP) will be the expected value of the claims, E[g(X)].

When we factor in the frequency of claims into the computation, the expected total (aggregate) loss according to the classical risk theory hypothesis becomes

RP = E(S) = E(N ) * E(g(X)) (3.2)
Therefore under the NB-GPD model, it implies that:

E(N ) = rq p and E((g(X)) = E(H ξ,σ,u (x)) = E(H)
where rq p denotes the average number of claims and E(H (ξ,σ,u) (x)) is the expected value of the GPD with parameters ξ, σ and retention u. We assume that the occurrence moments and the loss amounts fulfill the conditions of a compound NB process. That is, the collective risk model where N follows a NB distribution given by

S = N i=1 X i N ∼ N B(r, p)
Parametrically, we will estimate the reinsurance risk premium as

RP = rq p * E(X|X > u) = rq p * ∞ u (x -u)dH (u) (x) (3.3)
with dH (u) (x) = h (u) (x)dx being the density function of the GPD. To be more specific, the reinsurance layer may not coincide with the threshold u, of the optimized GPD, hence we have to compute IP(X > R|X > u).

We recall that the expected random amount (X -R) + which concerns the reinsurer can also be written as

RP = E((X -R) + = x * R (1 -F (y))dy
and since the mean excess function (MEF), e(R) is

e(R) = E(X|X > R) = x * R (1 -F (y))dy 1 -F (R)
It implies that, in terms of the MEF

RP = e(R) F (R) (3.4)
where F (R) = 1 -F (R) is the survival function. In order to obtain a simpler expression for the integral of the reinsurace premium for an unlimited cover which is

RP = rq p * ∞ R (x -R)h (u) (x -u)dx (3.5) we note that IP(X > R|X > u) = IP(X > R) IP(X > u)
Furthermore, the asymptotic behavior of the tail properties provides us with the formula to estimate the tail probability when x → ∞ given that certain conditions hold.

IP( F (x)) ∼ E[N ] F (x) as x → ∞ Thus, we can approximate IP(X > R) = F (R) by F (R) ∼ F (u) 1 + ξ R -u σ -1 ξ u → ∞, R > u
when the tail is fitted with the GPD.

From first principles, the formula of the MEF of the GPD is

e(u) = σ 1 -ξ + ξ x -u 1 -ξ ⇒ under the condition R > u, ξ < 1 and u is large e(R) ∼ σ 1 -ξ + ξ R -u 1 -ξ = σ 1 -ξ + ξ σ(R -u) σ(1 -ξ) = σ 1 -ξ 1 + ξ R -u σ Therefore, RP = e(R) F (R) = F (u) 1 + ξ R -u σ -1 ξ σ 1 -ξ 1 + ξ R -u σ = rq p σ 1 -ξ 1 + ξ R -u σ 1-1 ξ (3.6) If we set u = X n-k,n
where k is the suitable choice made for the number of upper statistics, we can then estimate the net RP for an unlimited XL layer above R as

RP = k n σ 1 -ξ 1 + ξ R -X n-k,n σ 1-1 ξ
Here, the exceedance probability has been estimated empirically by k n .

However, if we have a bounded layer (R, R * ) with u < R < R * in excess of our threshold u, then

RP = rq p * R * R (x -R)h (u) (x -u)dx + (R * -R)(1 -H (u) (R * -u)) (3.7)
and the explicit formula to compute the integral will be

I = rq p σ ξ 1 + ξ σ (R * -u) 1-1 ξ -1 + ξ σ (R -u) 1-1 ξ ξ = 0 (3.8)
4 Data description and analysis

The data used in this study are the large claims (3.5 million naira and above) of Nigeria's motor industrial class of business. It covers the years 2013 to 2016. The four years of data gives a total of 1,324 claims. Analyzing these motor claims will provide the insurance industry with useful insights given that, according to [START_REF] Ademunigbohun | Risk Attitude and Demand for Motor Insurance: An Examination of selected Motorist in Lagos State[END_REF], it (specifically, third party motor insurance)

is the major driver of the non-life insurance market in Nigeria.

The histogram of the the claims (on the log scale) is stongly skewed towards the right (figure 1).

This suggests that there is a frequent occurrence of smaller motor claims while larger losses take place occasionally. From the plot we can observe that more of the losses fall between 3.5 and 6 million naira.

Inflation is not taken into account in this analysis. ,245,000 21,765,289 19,000,000 21,802,500 20,124,610 23,302,148 19,885,000 23,900,000 23,479,720 24,752,550 51,810,400 28,215,

Fitting the NB-GPD model

The shape of the plot (figure 1) and the increasing MEF (figure 2 right) indicate that the data is heavy tailed. Thus the sample is fitted to a GPD distribution to model the severity of claims. First we determine the threshold u. A useful tool for this is the mean excess plot (MEP) as seen below. 3. The parameters are estimated using the maximum likelihood method with the respective standard errors given in the braces. The diagnostic plots in figure 3 indicate that GPD is a good fit. To model the frequency of the claims using the NB, the number of losses per year above the given threshold is taken. The estimated parameters are displayed on table 3. We can easily obtain the probability of success, p, for the NB distribution from the size and mean parameters with this simple formula p = size size + mu = 24.25 24.25 + 282 = 0.079

Risk measures

After fitted the data to GPD, the VaR and ES values are estimated together with their respective confidence intervals. It indicates that 99% of claims that occur result in a loss below 18,990,729 naira, and in the case where a claim results in a loss larger than this amount, the expected loss will be 28,180,720 naira (table 4).

Simulating the annual loss distribution

The annual aggregate loss distribution is simulated using the Monte Carlo technique. This involved making use of the parameter values that were obtained from the frequency and severity analysis above.

That is, the interest here is in the distribution S = N i=1 X i where N ∼ N B(r, p). To visualize how the distribution looks like, a histogram depicting this is shown if figure 4.

Computing the XL reinsurance risk premium

After selecting a priority level R, an insurer may not want to insure all the risk that exceeds that level rather he may choose a layer of reinsurance corresponding to the interval (R, R * ]. Hence, to replicate this sort of scenario, 3 different layers of limited coverages are assumed. Also, one XL with an unlimited cover (20mill, ∞) is also considered. The 3 levels of limited-cover reinsurance are 2mill xs 10mill (10,12]mill, 3mill xs 12mill (12,15]mill and 5mill xs 15mill (15,20]mill. Here mill represents million.

In table 5, the survival probabilities of exceeding the lower limit in each layer and their respective reinsurance net premium results are displayed. that roughly about 20 of these claims will exceed 15 million naira costing the motor class of business on average, about 1.9 million naira net premium to have a reinsurance cover in excess of 15 million naira with a limited cover of 20 million naira.

The trend indicates that the higher the layer of reinsurance, the lower the probability of survival and the lower the net premium the insurer will pay. This will imply less profit for the insurer if he picks the lowest layer and although the probability that the losses exceeding his retention limit will be higher, his probability to ruin will be smaller.

Conclusion

This paper showcases how powerful EVT is for modeling the tail of very large losses. Extreme losses were analyzed using a frequency and severity based approach because the survival of an insurance company critically depends on this. It was shown that the GPD served as a good fit to the tails of the motor claims. The importance of having good estimates of the tails of the claims was made evident in the pricing of the XL reinsurance from the perspective of the insurer. Solvency probabilities were calculated for the considered layers of reinsurance coverage to help the insurer in deciding whether to assume or cede certain risks and to have an idea of the risk premium he will be paying in the case of ceding. These analyses bring to the fore a major issue constantly faced by an insurer when deciding on his retention level, which is, balancing the trade-off between profit and security. This can serve as a scope for further study.

Another interesting direction for future research will include taking inflation into account and studying its effect on the pricing process. The pricing of different reinsurance structures and their various combinations based on the simulated loss distribution is also a research area one can examine.

Figure 1 :

 1 Figure 1: Histogram of claims on the log scale

Figure 2 :

 2 Figure 2: Scatterplot (left) and MEP (right) of motor claims

Figure 3 :

 3 Figure 3: Diagnostic plots to assess the GPD's goodness of fit

Figure 4 :

 4 Figure 4: Simulated annual loss distribution

Table 1

 1

			: Summary statistics
	Min.	1st Qu.	Median	Mean	3rd Qu.	Max.
	3,247,500 4,050,000 4,680,000 5,708,460 6,075,000 51,810,400

Table 2 :

 2 The 3 largest claims and sample size in each year

	Year	2013	2014	2015	2016
	16

Table 3

 3

			: Parameter estimation
		GPD parameters		NB parameters
	threshold	nexc	ξ	σ	size	mu
	3,800,000	1128	0.3115441	1,578,755	24.24950	282.00000
			(0.03060106)		( 18.53834)	( 29.83875)

Table 4 :

 4 VaR and ES at the 0.99 quantile

	VaR	ES
	Lower CI Estimate Upper CI Lower CI Estimate Upper CI
	16850881 18990729 21979944 23291490 28180720 35956244

Table 5

 5 Assuming that only large claims above 3.5 million naira are in the portfolio, there is a 0.02 (2.4%) probability that the claims will exceed 15 million naira given that it has exceeded 3.8 million naira (table 5, third row). In other words, approximately 980 out of the next 1000 claims (1 -0.0237 = 0.9763) that exceed the 3.8 million naira threshold will remain under 15 million naira. This implies

	: XL reinsurance layer and premium
	Reinsurance layer (r,R) Survival probability Net Premium
	(10,12]mill*	0.0769	9,390,099
	(12,15]mill	0.0455	4,641,891
	(15,20]mill	0.0237	1,886,666
	greater than 20mill	0.0100	964.7832
	*mill means million

Author: Lecturer at the University of Uyo, Department of Insurance, Akwa Ibom Nigeria. Currently a doctoral student in financial mathematics at the Pan African University of Basic Sciences, Technology and Innovation Kenya.


Kristina Milanović
email: kristina.milanovic08@imperial.ac.uk

Jeremy Pitt
email: j.pitt@imperial.ac.uk

The Social Construction of "Shared Reality" in Socio-Technical Systems

Keywords: Trust, Forgiveness, Norms, Socio-Technical Systems, Social Constructivism

As the size, complexity and ubiquity of socio-technical systems increases, there is a concomitant expectation that humans will have to establish and maintain long-lasting 'relationships' with many types of digital artefact: for example with humanoid robots, driverless cars or software agents running on 'smart' devices. Rather than being limited to oneoff interactions, these relationships will continue over longer time frames, correspondingly increasing the likelihood of errors occurring from numerous causes. When digital errors occur, often complete human mistrust and distrust is the outcome. The situation is exacerbated when the computer can make no act of reparation and no avenue of forgiveness is open to the human. In the pursuit of designing long-lasting socio-technical systems that are fit-for purpose, this position paper reviews past work in relevant social concepts and, based on the sociological theory of social constructivism, proposes a new approach to the joint human-computer construction of a "shared reality".

Introduction

In a world of increasing interconnectivity, socio-technical systems, which are defined as any multi-agent system where there is a mix of human and computational agents working together to achieve a common goal [START_REF] Nallur | Increasing Information in Socio-Technical MAS Considered Contentious[END_REF], are becoming increasingly prevalent in every day life. Agents can be human, physical computers (including robots) or digital (software). The digital or computational agents can be working with the human agents in any combination. This includes facilitating human-human communication/interaction via smart devices, a number of computational agents and human overseers such as a network of driverless cars or smart meters being monitored remotely and a human agent interacting with multiple digital agents in the form of digital home assistants in a smart home.

The 'relationships' here between the various computer, digital and human agents will not be one-off interactions, such as the purchase of an item on the internet with the help of a digital shopping assistant, where a single task needs to be accomplished and the agents either do not interact again, or do not interact until a long time period has passed. They will need to be maintained through multiple interactions in order for the goal of the system to be achieved. Continuing with the preceding examples, this includes optimal energy pricing for neighbouring households in a smart energy network, safe operation of smart cars in traffic flow and efficient operation of devices within the home.

Like any device these computational and digital agents inherently have some level of error and humans occasionally make mistakes too. As the longevity and size of the system of agents increases, the likelihood of errors occurring also increases. This can be in the form of system faults or misunderstandings between the human and computational or digital agents. Since the agents in the system will need to interact over long time periods, agents will need to have mechanisms to enable these relationships to last over time in the face of these errors. One method of doing this is to apply concepts of trust and forgiveness which have enabled human society to maintain long-term relationships, to systems which include computational and digital agents. In order to use socio-cognitive theories, where trust is a mental state of a social cognitive agent (i.e.: an agent with goals and beliefs) [START_REF] Castelfranchi | Social Trust : A Cognitive Approach[END_REF], the non-human agents need to interact with the human agents in a manner akin to other humans.

In this position paper past work in computational models of trust, forgiveness, norms and values is reviewed. A new theory for how these concepts can be combined together addressing and how, specifically, the effect of system errors may be mitigated is proposed. The paper is split into two parts, the first section covers previous work on human relationship building mechanisms in computing while the second section outlines how the proposed new theory fits within this already established framework.

Pulling from sociology to apply utilise the trust and forgiveness mechanisms already well established in human society, the new proposal follows on from the theory of social constructivism. An artificial form of social constructivism is suggested which can be applied to socio-technical systems to created a "shared reality" based on shared experiences [START_REF] Hardin | Shared Reality: How Social Verification Makes the Subjective Objective[END_REF], in this case shared social norms and values. This will allow for the creation of more fit-for purpose models of socio-technical systems which should enable long-lasting 'relationships' between agents.

Social Concepts in Socio-Technical Systems

Socio-technical systems in particular are useful for their ability to model inherent human attributes which can have profound effects on the system. Concepts of trust, forgiveness and social norms have long been studied in sociology, psychology and evolutionary biology and their adaptation into the field of computing, to analyse network behaviour, has an advantage over simpler Game theoretic approaches as they are better able to take into account human attributes such as deception. Game theoretic models tend to simplify observed behaviour in order to model it, for example, they reduce the trust decision to a probability [START_REF] Castelfranchi | Social Trust : A Cognitive Approach[END_REF]. This form of modelling is insufficient when attempting to create a model that accurately represents human decision making, thus socio-cognitive approaches are better suited to it. This section covers previous work key human traits which may be applied to socio-technical systems to assist with modelling and analysis and how they fit into the overarching framework of social capital.

Social Capital

Social capital encompasses concepts which are established as part of institutions of individuals such as trust, forgiveness and social norms and values. It was defined by Ostrom as "an attribute of individuals that enhances their ability to solve collective action problems" [START_REF] Ostrom | Foundations of Social Capital[END_REF], where a collective action problem is one that requires the cooperation of multiple individuals to achieve a shared goal. Trust is the method, or "glue", which enables the solving of these collective action problems [START_REF] Pitt | The Reinvention of Social Capital for Socio-Technical Systems[END_REF].

Social capital can broken down into three general categories: trustworthiness, social networks and institutions. The definition of institutions here is synonymous with the most generic of social norm definitions. According to Ostrom, institutions outline allowed and forbidden actions, or "collections of conventional rules by which people mutually agree to regulate their behaviour " [START_REF] Petruzzi | Experiments with Social Capital in Multi-Agent Systems[END_REF]. Recent developments in the field have include the theory of electronic social capital [START_REF] Petruzzi | Electronic Social Capital for Self-Organising Multi-Agent Systems[END_REF], and upholds the idea that it can be used to solve collective action problems in a digital environment. [START_REF] Petruzzi | Experiments with Social Capital in Multi-Agent Systems[END_REF] Trust The concept of trust has been defined many times. From sociology, one often cited definition is that trust "is the subjective probability by which an individual, A, expects that another individual, B, performs a given action on which its welfare depends" [8]. Another definition, also from sociology, is that trust can be used to reduce complexity of social interactions [START_REF] Luhmann | Trust and Power[END_REF]. Applying this definition to computational networks can used to simplify behaviour in complex networks and it is this aspect in particular that is relevant to the proposal outlined here.

Computational trust has been a topic of increasing research over the past two decades since one of the first models was presented by Marsh in 1994. [START_REF] Marsh | Formalising Trust as a Computational Concept[END_REF] Marsh proposed that incorporating trust into artificial intelligence would assist with social decision making by the agents. Following on from this, one of the earliest cognitive trust models [START_REF] Pinyol | Computational Trust and Reputation Models for Open Multi-Agent Systems: A Review[END_REF] was outlined by Castelfranchi and Falcone [START_REF] Castelfranchi | Social Trust : A Cognitive Approach[END_REF] in 2001. They proposed that only agents with goals and beliefs, in other words cognitive agents, are capable of trust. Another proposal from Jones in 2002 suggested that trust has two components, a belief in another agent and the expectation that the agent would perform some action, or attain a desired goal [START_REF] Jones | On The Concept of Trust[END_REF].

Since then there have been a proliferation of trust models in multiple fields [START_REF] Cho | A Survey on Trust Modeling[END_REF] where the concept of trust has which have been expanded to include extended definitions and situations. Concepts of mistrust (misplaced trust), distrust (how much the truster believes the trustee will consciously work against them in a given situation) and untrust (the truster does not believe the trustee will work with them in a given situation) have been postulated [START_REF] Marsh | Trust, Untrust, Distrust and Mistrust An Exploration of the Dark(er) Side[END_REF]. Specific models for use in areas as diverse as ecommerce systems [START_REF] Mcknight | The Impact of Initial Consumer Trust on Intentions to Transact with a Web Site: A Trust Building Model[END_REF] and multi-agent systems have developed. These models have been compared and contrasted at length in recent years [START_REF] Pinyol | Computational Trust and Reputation Models for Open Multi-Agent Systems: A Review[END_REF][START_REF] Yu | A Survey of Multi-Agent Trust Management Systems[END_REF]. Overall the key concept these models have in common is that there is a need for systems which mimic human social interactions, so that the agents are able to make decisions about who and how much to trust, without external input from human operators.

In terms of modelling, in large socio-technical systems, cognitive models of trust have advantages over more simplistic game theoretic models [START_REF] Pinyol | Computational Trust and Reputation Models for Open Multi-Agent Systems: A Review[END_REF]. Game theory tends to assume that all system agents are rational, however this may not be the case in a system involving humans, where the agents may deceive each other or act in a (seemingly) irrational manner. [START_REF] Nallur | Increasing Information in Socio-Technical MAS Considered Contentious[END_REF] Models such as those proposed by Axelrod in the 1980's [START_REF] Axelrod | An Evolutionary Approach to Norms[END_REF], are less able to represent the complicated relationships between agents when humans are involved. This is particularly relevant when errors in the system occur. Errors can come in broadly two categories, malfunctions and mistakes. Malfunctions are where there is a bug in the code or a physical breakdown of some sort leading to agents not behaving in the expected manner. Mistakes occur where there has been some kind of misunderstanding between what the agent was expected to do and what they actually did. One way this has been addressed previously is through reputation mechanisms which aggregate past behaviour over time [START_REF] Pinyol | Reputation-Based Decisions for Logic-Based Cognitive Agents[END_REF] or trusted third parties which act as a guarantee of trustworthiness [START_REF] Rea | Engendering Trust in Electronic Environments[END_REF]. The most visible application of this is in ecommerce, for example the in the form of ratings and reviews for online buyers and sellers.

Forgiveness When there has been a trust breakdown in human relationships, forgiveness is often used as a mechanism for rebuilding trust after a breakdown has occurred. It is not unconditional and is governed by a number of motivating factors. These factors include offence severity and frequency, as well as the offender's previous behaviour towards the victim, and the offender's intent (was there deliberate or accidental error) and subsequent efforts to reconcile or repair the relationship. [START_REF] Vasalou | In Praise of Forgiveness: Ways for Repairing Trust Breakdowns in One-Off Online Interactions[END_REF] Forgiveness is a mechanism which allows the victim to replace their formerly negative feelings towards the offender with positive ones which would allow them to reconcile and maintain their relationship. [START_REF] Mccullough | Forgiveness: Who Does It and How Do They Do It?[END_REF] In fact, it may have evolved specifically in humans to allow valued social relationships to be maintained over time [START_REF] Mccullough | Beyond Revenge: The Evolution of the Forgiveness Instinct[END_REF].

A socio-cognitive model, where social agents have cognisant goals and objectives, therefore may provide the basis for agents which are able to repair relationships, through forgiveness, when there has been a breakdown. This is something which can be seen even using game theoretic approaches. Axelrod found that in a series of iterated prisoner's dilemmas forgiving strategies were the most robust over time. [START_REF] Axelrod | How to Cope with Noise in the Iterated Prisoner's Dilemma[END_REF] Additionally, in games where the structure of the agents was fixed, where agents had the same neighbours throughout the iterations, cooperative strategies dominated and agents were more forgiving and friendlier to their neighbours. [START_REF] Cohen | The Role of Social Structure in the Maintenance of Cooperative Regimes[END_REF] Mechanisms for facilitating forgiveness have been proposed which allow offenders not only to apologise but also to validate their apology with some kind of reparation action. [START_REF] Vasalou | Is an Apology Enough ? How to Resolve Trust Breakdowns in Episodic Online Interactions[END_REF] Without reparations, it has been found that victims in online interactions took revenge against the offender where their apology was not seen as costly enough by the victim. [START_REF] Vasalou | Is an Apology Enough ? How to Resolve Trust Breakdowns in Episodic Online Interactions[END_REF] Apologies need to be costly to the offender in order to facilitate forgiveness. [START_REF] Lenaerts | Conditions for the Evolution of Apology and Forgiveness in Populations of Autonomous Agents[END_REF] This serves two purposes as it punishes the offender for their offence and makes reparations towards the victim.

Another part of the forgiveness process is that the offender admits that they are guilty of a transgression. The victim is more likely to forgive the offender if they believe the offender is less likely to repeat the transgression in future interactions. [START_REF] Mccullough | Beyond Revenge: The Evolution of the Forgiveness Instinct[END_REF] The acknowledgement of guilt itself is an intangible cost for breaking a social norm [START_REF] Ostrom | Collective Action and the Evolution of Social Norms[END_REF] and in face to face interactions, humans have emotional and physical reactions which who the victim if they are regretting, or feeling ashamed or embarrassed by their actions, for example by blushing. [START_REF] Pitt | Digital Blush: Towards Shame and Embarrassment in Multi-Agent Information Trading Applications[END_REF] Since physical cues are difficult to transmit in socio-technical systems mechanisms enabling apology, admission of guilt and suitable reparations to the victim are key in order to facilitate forgiveness.

Social Norms and Values

Although social norms and social values tend to be used interchangeably, social norms are specific guidelines which members of a society are expected to uphold in given situations, whereas social values are much broader [START_REF] Mondal | Difference between Norms and Values of Society[END_REF]. They are the general ideas which a society holds true and include concepts such as trusting and forgiving each other [START_REF] Pitt | From Trust and Forgiveness to Social Capital and Justice[END_REF].

Human interactions are governed by many social norms of behaviour which are learnt in childhood [START_REF] Binmore | Social Norms or Social Preferences?[END_REF] and dictate what is and is not acceptable in society. It is so ingrained in human society, that is has been shown that humans unconsciously and automatically apply them to computer agents in social situations [START_REF] Nass | Computers are Social Actors[END_REF]. Examples of this include following politeness norms when interacting with a computer agent [START_REF] Reeves | The Media Equation[END_REF], showing empathy to virtual characters [START_REF] Paiva | Caring for Agents and Agents that Care: Building Empathic Relations with Synthetic Agents[END_REF] and considering the computer agent as part of a team despite the agent showing no physical human attributes [START_REF] Reeves | The Media Equation[END_REF]. In the context of building relationships with agents, it has been found that in situations where there errors have occurred, humans are friendlier and more positive to robots who blame themselves rather than their human counterparts, even if the blame should be equally distributed [START_REF] Groom | Critic, compatriot, or Chump?: Responses to Robot Blame Attribution[END_REF].

In multi-agent systems norms are usually set up as a series of permissions and sanctions [START_REF] Artikis | Specifying Norm-Governed computational Societies[END_REF]. Over time, two issues can emerge. Firstly, how to enforce the current norms and secondly how to allow the norms to evolve (to create new norms or modify existing ones) as the system evolves [START_REF] Posner | Creating and Enforcing Norms, with Special Reference to Sanctions[END_REF]. There have been a number of suggestions for resolving these issues. One proposal is to establish leader and follower behaviour amongst agents to enable new joiners to the system to know who to look to for guidance [START_REF] Savarimuthu | Role Model Based Mechanism for Norm Emergence in Artificial Agent Societies[END_REF]. Another method is to enable agents to log histories of interactions and identify "special events" which they then confirm with the rest of the system to see if other agents also exhibit the same behaviour [START_REF] Savarimuthu | Obligation Norm Identification in Agent Societies[END_REF]. Machine learning, leadership, imitation and data mining have all been used in multi-agent normative systems to study the creation, identification and propagation of norms [START_REF] Savarimuthu | Norm Creation, Spreading and Emergence: A Survey of Simulation Models of Norms in Multi-Agent Systems[END_REF][START_REF] Savarimuthu | Aspects of Active Norm Learning and the Effect of Lying on Norm Emergence in Agent Societies[END_REF].

Constructing a Social Socio-Technical System

Increasingly generalised norms, or values, are being used to assist with designing technology and systems. The concept of value sensitive design [START_REF] Friedman | Value Sensitive Design: Theory and Methods[END_REF] is becoming increasingly relevant as society shapes technology and vice versa and the threat of breakdown or malicious attacks of systems increases. One way in which systems breakdowns may be combated is to create a socio-technical system which encompasses key social norms and educates the agents in it to create values which correspond to similar values in human society, thus establishing a "shared reality" between agents.

Before considering how to imbue social values in a socio-technical system, it must first be considered how social values are created in human society. Sociology allows analysis of how human society develops. It also considers how to create a society based on social interactions. One theory in particular which is useful when considering this, is the concept of social constructivism.

Social Constructivism

The starting point of the proposal is the theory of social constructivism. Social constructivism was initially proposed in the 1960's by the sociologists Berger and Luckmann in their book "The Social Construction of Reality" [START_REF] Berger | The Social Construction of Reality[END_REF]. It remains a key work in sociology and has inspired a number of diverging theories in the social sciences [START_REF] Knoblauch | The Common Denominator: The Reception and Impact of Berger and Luckmann's The Social Construction of Reality[END_REF].

Berger and Luckmann proposed that it is "knowledge that guides conduct in everyday life" [43, p33]. One of the main ways in which humans communicate is through language. How we define the objects around us is part of our reality, the very action of talking to one another allows humans to pass on key ideas which then form part of their reality. Our use of language is therefore how knowledge is transferred over time, between generations and cultures. Since we need to communicate to other members in our society to pass on this knowledge, this means that our reality is actually a social construct which we have developed over time. They proposed that reality is composed of two parts, the objective and the subjective. The objective part of reality is the part external to us, the part that as a society we have defined and we all understand to be true. The subjective part of reality is each person's individual experience of this reality.

To give an example of this, in a global context the term "father" is given to the male parent of a child, every individual reading a newspaper article about a father understands this to be true. The definition of father might have preexisted them, but as part of their objective reality they nevertheless understand what it means. The subjective reality is that the individual understands that the article is not about their father. The link between these two realities is the knowledge that all individuals have the same understanding of the term.

Knowledge is key to being able to function within a socially constructed reality. Individuals need to know current norms of behaviour but also the definitions of objects and ideas which already exist in society. Berger and Luckmann proposed that institutions (or norms) are created through a process called habitualisation-"all human activity is subject to habitualisation. Any action that is repeated frequently becomes cast into a pattern, which can then be performed again in the future in the same manner and with the same economical effort" [43, p70-71]. These repeated patterns of actions introduces institutions, or norms, into society which "control human conduct by setting up predetermined patterns of conduct" [43, p72]. According to this theory institutions are not created instantaneously but over time and it is this continual repetition of human actions and interactions which is passed on through language that builds human society.

This concept of habitualisation, learning from patterns over time and then using it to inform future behaviour, is also something which is already extensively used in computing in the form of machine learning.

Artificial Social Constructivism

Since it is possible to create a shared reality based on social interaction between humans, it is proposed that by imbuing socio-technical systems with human social concepts it is possible to create a shared social reality between the human, computational and digital agents in the network. This could be done by enabling the computational and digital agents access to digitised versions of trust and forgiveness mechanisms seen in human society and by allowing them to learn from each other to establish norms of behaviour which, over time, would develop into values. Although this is more complicated than building up a model of the user and programming it into agents, this method allows the agents to interpret human behaviour more accurately and react accordingly.

Using sociological theories is advantageous in this situation since sociology, which is based on real observed human behaviour, would allow computational and digital agents in the network to better interpret the behaviour of the most irrational agents, humans. This would allow the computational and digital agents to more accurately react and conform to expected human norms. This is particularly important in the occurrence of errors which lead to relationship breakdown.

It is proposed that a computational form of social constructivism, termed artificial social constructivism,is required which encompasses both human, computational and digital agents in a socio-technical system. Artificial social constructivism has three core principles: norms, education and values. The agents will first need to establish norms over time. Then they will need to pass on these established, or changing, norms to both existing and new agents in the system, so that all agents learn how to behave when interacting with one anther. Similar to the same way a child brought up in a certain manner comes to view the system's successes and failures as its own [START_REF] Dewey | Democracy and Education[END_REF] it is posited that through learning, maintaining and enforcing the norms of the system, the agents become invested in it and thus more motivated to uphold it as a whole. In this way the agents will establish key values (generalised norms) which the whole system will adhere to, effectively establishing what in human terms we would call a society.

Conclusion

By applying sociological theory to the network in this way, the computational or digital agents should behave as the human agents would expect other humans to behave. The resulting interactions between humans and computers may then be the same as interactions between humans themselves. This has multiple advantages, for example better understanding by agents of other agents' behaviour increases the likelihood of system longevity, but in this position paper we specifically considered the benefit in overcoming relationship breakdowns which occur as a result of errors. As humans automatically respond to computers if they exhibit the same social cues as a human would [START_REF] Reeves | The Media Equation[END_REF], shared values between agents should lead to a more predictable system from the agents perspectives. The computational and digital agents should be able to better anticipate how the human agents will respond in interactions, while, from the point of view of the human agents, the computer or digital agents will better conform to expected behavioural patterns as part of the human's own social network. The creation of a "shared reality", based on shared experience of social norms and values between the agents in the system, should therefore allow the system to more easily overcome errors by using human traits like trust and forgiveness to repair 'relationships' after faults or misunderstandings between agents occur. This position paper put forward a review of the relevant literature in trust, forgiveness, norms, values and social capital in socio-technical systems and put forward for a theory which ties these concepts together. Social constructivism introduces a method by which reality is created by human social interactions. Artificial social constructivism, proposed here, is a way of applying this concept to a socio-technical system which uses digital versions of trust, forgiveness, norms, values to create a "shared reality" between humans and computers. The theory aims to address the question of how we can ensure that relationships with, and mediated by, computers are the same as those with other humans. This will in turn allow for the creation of long-lasting socio-technical systems which are better at overcoming errors, and maintaining 'relationships' between the agents, by using already established relationship management mechanisms from sociology.

Acknowledgements

The authors would like to thank the reviewers for their valuable insights and suggestions.


Christian Damsgaard Jensen

Michael Bøndergaard Nielsen

CodeTrust Trusting Software Systems

Introduction

We are increasingly dependent on software in all the systems and infrastructures that weave the fabric of our everyday life. From the systems that we rely on to do our work, the social media that occupy much of our spare time and the Internet of Things that provides the data and control necessary to support the intelligence and convenience that we expect from our modern way of life. As software becomes ubiquituous and we all need more software systems to function normally, there is an increasing pressure to reduce costs, e.g. through the integration of free (as in gratis) open source software in commodity products. The urgency of this problem is probably best illustrated by the HeartBleed [START_REF]The heartbleed bug[END_REF] vulnerability discovered in the Open SSL library (e.g. used in the popular Apache web server) or the GNU Bash remote code execution vulnerability Shellshock [START_REF] Cerrudo | Why the shellshock bug is worse than heartbleed[END_REF], both discovered in 2014. In both cases, software failures had a crippling effect on popular software systems. The HeartBleed vulnerability in Open SSL was present in several versions of the security protocol library, which meant that many manufacturers, who had relied on Open SSL in their software systems, were unable to determine which of their products were actually vulnerable. Analysis of the Gnu Bash source code, showed that the Shellshock vulnerability in the popular Bash command interpreter had existed since September 1989. These examples show that software vulnerabilities may exist in code for a long time before they are discovered, even in otherwise well respected software like OpenSSL and GNU Bash.

Software systems are often based on components and services that integrate externally developed software libraries and execution engines. Establishing the trustworthiness of the components and services that are integrated into a software system is therefore of vital importance to software developers. This requires a consideration of both directly observable software quality attributes, such as size and complexity, and reputation factors, such as the history of vulnerabilities found in the software components and services and the track record of the software developers. In this paper we propose the CodeTrust software trust metric to evaluate the trustworthiness of a given software system. CodeTrust considers the vulnerability history of the specific software (both number and severity of vulnerabilities), the track record of the software's developers and several directly observable software quality attributes.

We have developed a prototype that implements CodeTrust and used this prototype to evaluate a number of well known Open Source Software (OSS) systems. The evaluation shows a significant variation in the CodeTrust metric for different OSS projects, but that missing data leads to some uncertainty, which suggests that it would be interesting to include a confidence score in the CodeTrust metric.

The rest of this paper is organized as follows. Section 2 presents the Heartbleed vulnerability to illustrate several of the concepts that we consider and provide an overall motivation for our work. Related work on software trust metrics and trust systems used in software development is examined in Section-3. We propose the CodeTrust metric in Section 4, where we also discuss different software quality attributes. We implemented a simple prototype to allow a preliminary evaluation of CodeTrust; this evaluation is presented in Section 5. Finally, we present conclusions and directions for future work are presented in Section 6.

Motivation

The HeartBleed vulnerability, mentioned in the Introduction, is one of the best known software vulnerabilities in recent years. HeartBleed was caused by a flawed implementation of the Heartbeat Extension [START_REF] Seggelmann | Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension[END_REF] in OpenSSL, 1 which supports keep-alive functionality without performing a renegotiation. The vulnerable code allocates a memory buffer for the message to be returned by the heartbeat based on the length field in the requesting message with no length check for this particular memory allocation. The vulnerable implementation allocates this memory, without regard to the actual size of that message's payload, so the returned message returned consists of the payload, possibly followed by whatever else happened to be in the allocated memory buffer on the server. Heartbleed is exploited by sending a malformed heartbeat request with a small payload and large length field to the vulnerable party in order to elicit the victim's response. This allows an attacker to read up to 64 kilobytes of the victim's memory that was likely to have been used previously by OpenSSL, e.g. this memory could include passwords of other users who had recently logged onto the webserver. HeartBleed was first disclosed in April 2014, but the bug was introduced in 2012, when the TLS Heartbeat Extension was first standardised. The flaw was introduced by a single programmer, who implemented the extension, and reviewed by one of OpenSSL's four core developers before being integrated into OpenSSL v. 1.0.1; the bug remained unnoticed in subsequent releases of OpenSSL, until OpenSSL v1.0.1g, which corrected the mistake. An article in the online media The Register indicates around 200,000 Internet sites still vulnerable to HeartBleed in January 2017 [START_REF] Pauli | It's 2017 and 200,000 services still have unpatched heartbleeds[END_REF] and a quick search for the vulnerability in the search-engine Shodan indicates that more than 150,000 Internet sites are still vulnerable a year later.

The HeartBleed vulnerability is not only interesting because it affected an important and popular Internet security component, but mostly because it demonstrates how a small mistake in a software component can have major repercussions for global Internet security, i.e. we place a lot of trust in software, which is delivered for free and without warranty.

Related Work

Deciding whether code can be trusted has a long history, e.g. in his Note on the Confinement Problem from 1973 [START_REF] Lampson | A note on the confinement problem[END_REF], Butler Lampson examines the problem of externally sourced software libraries leaking confidential data. Subsequent efforts to address this problem include a number of software evaluation criteria that were especially developed for military use [START_REF]The Department of Defense (DoD): Trusted Computer System Evaluation Criteria (TCSEC), TCSEC Rainbow Series Library[END_REF][START_REF]Commission of the European Communities: Information Technology Security Evaluation Criteria (ITSEC): Preliminary Harmonised Criteria[END_REF], which inspired the development of common criteria for security evaluation of software [START_REF]Common Criteria for Information Technology Security Evaluation[END_REF]. Common to these evaluation criteria is that they introduce a well defined hierarchy of increasingly secure systems (encoded in a Security Level2 ) and that they do not apply to the software in itself, but to installed systems, e.g. the Common Criteria [START_REF]Common Criteria for Information Technology Security Evaluation[END_REF] introduces the notion of a Target of Evaluation(ToE) which defines the set of systems and services considered in the evaluation. Moreover, the official certification process according to these criteria requires significant efforts, resources and time, so they are not widely used outside high security environments, such as defence, aerospace or financial services.

Software quality has been studied from many different aspects over the years, such as reliability and fault tolerance [START_REF] Randell | System structure for software fault tolerance[END_REF] to the notion of dependability [START_REF] Avizienis | Fundamental concepts of dependability[END_REF] and the necessary consideration of the full tool-chain [START_REF] Thompson | Reflections on trusting trust[END_REF]. In the following, we limit our presentation to a few efforts that have influenced our work the most.

The Trusted Software Methodology (TSM) [START_REF] Amoroso | A process-oriented methodology for assessing and improving software trustworthiness[END_REF] found 44 Trust Principles that determine the quality of software. These principles combine aspects of both security and software engineering as illustrated in Figure 1 below. The TSM recognises the role of both security techniques and software engineering practices in the development of trustworthy of software systems, i.e. secure software development can be considered a socio-technical system (STS), which has been examined by Mohammadi et al. [START_REF] Mohammadi | An analysis of software quality attributes and their contribution to trustworthiness[END_REF]. They identified a number of attributes in STS that affect the trustworthiness of the developed software, these attributes are shown in Figure 2. These attributes capture different aspects of trustworthiness, but in this paper we focus on the attributes that are most directly linked with the security of the software product, i.e. Security and Dependability. The difficult part of using these attributes directly, is that it requires a general evaluation of the attributes in all types of software. The metrics created will have to apply to both small and large projects (and everything in between) without being biased toward one or the other.

The work on TSM and STS demonstrate that trustworthy software is defined by directly observable software artefacts of the developed systems, as well as indirectly perceivable characteristics of the software development process. This corresponds to the notions of direct and indirect trust in the trustee.

Direct Trust

Direct trust can be established through certification (as mentioned above,) through examination of the source code (using different software quality metrics,) or through examination of the security history of the software.

Software related metrics for quality software has been studied extensively in the literature. In the following, we examine a few of these that have been studied in the context of maintainability, but may apply to several of the Dependability related trustworthiness attributes. The maintainability attributes are particularly relevant, because they aim to measure the size and complexity of the developed software and complexity is often consider the mother of all security vulnerabilities.

The simplest way to measure the complexity of software is to measure the size of the program. This is most commonly done by counting the lines of code in the software, because smaller programs are often easier to comprehend, but several extensions to this metric are possible. In effective lines of code, lines consisting only of comments, blank lines, and lines with standalone brackets are ignored. The logical lines of codes counts the number of statements in the programming language, e.g. lines ending with a semicolon in "Java" or "C". The comment to code ratio is another simple metric is to measure the amount of actual code to the amount of information included to assist software developers. Other metrics have been proposed, e.g. Halstead complexity [START_REF] Halstead | Elements of Software Science (Operating and Programming Systems Series)[END_REF] tries to eliminate the impact of the programming language by considering the software vocabulary and the program length and the ABC metric [START_REF] Fitzpatrick | More c++ gems. chap. Applying the ABC Metric to C, C++, and Java[END_REF] is measured as the length of a three-dimensional vector measuring the number of Assignments, Branches, and Conditions.

In order to establish the security history of software, it is necessary to identify known vulnerabilities and estimate their severity, i.e. how much control of the system an attacker may obtain and how easy the vulnerability is to exploit in practice. The Common Vulnerabilities and Exposures [START_REF]Common vulnerabilities and exposures[END_REF] database maintained by the MITRE Corporation since 1999. It defines a common identifier (the CVE number) and a short description of the vulnerability, which provides security professionals an unambiguous way to discuss vulnerabilities. In adition to naming and describing known vulnerabilities, the Common Vulnerability Scoring System (CVSS) [START_REF]Common Vulnerability Scoring System SIG: The Common Vulnerability Scoring System (CVSS)[END_REF] defines a way to capture the principal characteristics of a vulnerability and calculate a numerical score reflecting its severity. The CVSS scoring system is maintained by a special interest group (SIG) of the Forum of Incident Response and Security Teams (FIRST) and CVSS scores for most vulnerabilities listed in the CVE database can be found on the National Vulnerability Database [START_REF]National vulnerability database[END_REF]. The CVSS scores vulnerabilities from 0 to 10, where 10 is the most critical. Numerical scores are, however, difficult to communicate to a large audience, so FIRSThas decided to define severity levels that map the CVSS scores to text. This mapping is shown in Table 1.

Severity level CVSS Score None 0.0 Low 0.1 -3.9 Medium 4.0 -6.9 High 7.0 -8.9 Critical 9.0 -10.0 Table 1. Mapping CVSS scores to severity levels

Indirect Trust

Some software requires frequent patches and security updates, which reflects the competence, development methods and priorities of the development team, i.e. some development teams seem to favour feature rich software delivered at a high rate, while others favour more judicious methods focusing on formal specification, evaluation and testing. Indirect trust may therefore be established through the track record of the software developers. It is hard to know the development methodology of a software product that has not undergone certification, e.g. according to the Common Criteria mentioned above, so we need to rely on inference based on externally observable indicators, such as the number of CVEs and the CVSS scores mentioned above.

Wang et al. [START_REF] Wang | Security metrics for software systems[END_REF] proposes a security score based on the CVE and CVSS scores, which are used together with the Common Weakness Enumeration (CWE) [START_REF]Common Weakness Enumeration (CWE)[END_REF] to define a security metric. The focus of the security metric is on the common types of vulnerabilities, and how the specific type are handled by the software developers. The calculations use the CVSS score and the duration of the vulnerability type to calculate a severity score of the project.

CodeTrust

As mentioned above, the trustworthiness of software depends on both software artefacts, that can be observed directly in the source code, and the methodology, processes and people involved in the software development. In this paper, we develop a metric for the trustworthiness of software called CodeTrust. This metric focus on the security aspects of trustworthiness and, in particular, aspects relating to the development process (the software development team) and the security history of a particular software project or product.

Overview

An overview of the CodeTrust metric is shown in Figure 3, which should be read top down. Most larger software systems, and many smaller systems, include externally sourced software modules or libraries. The first step is therefore to decompose the software into clearly identifiable components. Aggregation of software components is normally achieved through copying source code or through external calls to libraries or services -these are normally known as dependencies. We do not presume to be able to distinguish between internally and externally developed software from the source code alone, so in this paper we propose a decomposition based on the stated dependencies of a given software system or component.

Information about the development team and software source code are not normally available for external review, so the Team Analysis and Maintainability Analysis are only included for internal software projects or Open Source Software (OSS) projects. We believe that evaluating different OSS components to include in current development projects will be one of the principal uses for CodeTrust, which is why we include it in the general metric.

Security Analysis

The number of CVEs reported for a particular software reflects the number of vulnerabilities found in that software, so a low number of vulnerabilities is always preferred. The criticality of a vulnerability is rated by the CVSS on a 0 -10 scale, where 10 is a vulnerability with critical severity and 0 has a low severity level. A large number of vulnerabilities with low severity is preferred to a few critical vulnerabilities, as the non-critical vulnerabilities may not provide much access to information, whereas a critical vulnerability may compromise the entire system.

Security Score We calculate a Security Score (SS), where the vulnerabilities and severity and are weighted as seen in equation 1. The Security Score correspond roughly to a classic definition of risk as the likelihood of an unwanted event multiplied by the consequences of that event happening.

security score = 0.2 • vulnerability score + 0.8 • severity score (1)
Vulnerability Score The vulnerability score indicates the general amount of CVEs registered for the software and thus the developer's ability to create secure software. The vulnerability score calculation is found in Equation 2. The severity score is an indication of how the software matures, by tracking the severity levels of reported vulnerabilities; the calculations are found in equation 6. The weight between the vulnerability score and severity score favours severity, because the criticality of a vulnerability is more important than the amount of vulnerabilities overall.

vulnerability score = grade ncve • grade tcve (2)
The vulnerability score is made up by the average annual number of recorded vulnerabilities for the software and is represented by the factor grade ncve; the calculations can be found in Equation 3.

grade ncve =          User evaluation if ncve <= 5 0.7 if 5 < ncve <= 20 0.9 if 20 < ncve <= 70 1.0 if 70 < ncve (3)
The ncve is the average annual number of recorded CVEs, which has a tendency to discriminate against larger projects, because a project with 20 million lines of code is more likely to produce a large number of vulnerabilities compared to a project in the tens of thousands lines of code. This is an issue when CodeTrust evaluation is used as an absolute estimate of software trustworhiness, but it allows comparison of similar software, such as the most popular web browsers Edge, Chrome and Firefox. Possible solutions to the size bias include weighting the grade ncve by the size of the project or separating software projects into size intervals for comparison with other projects of similar size. The User evaluation relies on the registered number of users for a particular software project. Such data can be obtained as sales numbers for commercial software or taken from OpenHub [4], which have extensive data on a large set of OSS Projects, including numbers of users and contributors. The second part of the vulnerability score is the CVE trend, which is a simple linear regression of the CVEs for every year. The evaluation does not focus on the amount of CVEs but the trends, which is indicated by the slope in a linear regression.

User evaluation =          0 if
grade tcve =      4 if a < -0.2 7 if -0.2 < a < 0.2 10 if 0.2 < a (5)
For simplicity, we only operate with a positive trend, i.e. there are fewer vulnerabilities so the slope (a in Equation 5) is negative, a neutral trend (the slope is roughly flat) and a negative trend (the slope is positive). The possible values returned by the calculation have been distributed evenly in the domain 0 -10, as indicated in the equation above.

Severity Score The severity score is based directly on the CVSS reports from the National Vulnerability Database [START_REF]National vulnerability database[END_REF].

The severity score, shown in Equation 6, measures whether the average of vulnerabilities with severity Critical or High is greater than 25% (average critical and average high are binary variables that are true if this is the case.) It also includes the trends, for each of the CVSS severity levels, calculated using Equation 5, in the same way as the CVE trend. The coefficients for the trend variables reflect the relative importance of the severity levels for the final security of the software. They have been established through minor tests with known open source software projects; more fundamental experimentation will be carried out as part of our future work. The security score is in the same range (0 -10) as the CVSS score, with severity 10 meaning the least secure system. We believe this is counter intuitive, so we define the security history score, in Equation 7, where 10 reflects a system with the best security history.

security history score = 10 -security score [START_REF]Commission of the European Communities: Information Technology Security Evaluation Criteria (ITSEC): Preliminary Harmonised Criteria[END_REF] In the following, we examine the two remaining constituent elements of the CodeTrust metric, namely the team analysis and the maintainability analysis. As mentioned earlier, we focus these efforts on OSS, because numbers to support our analysis are more easily obtained. It should be possible for most software development companies to obtain similar numbers from their own products.

Team Analysis

The quality of software developed by a development team depends on the project management methodologies, processes and tools employed by the team, but to a higher degree on the security conciousness and experience of the individual team members. The experience of a developer in OSS projects can be roughly estimated by looking at the security history of previous projects. This contributor score can be determined as a sum of the security history score of all of all other projects that the contributor has contributed to, weighted by the relative size of the contributions as shown in Equation 8. This estimation is obviously rough, because the contributor may not have committed any of the vulnerable code to software with a poor security history, but we believe that security conscious programmers will migrate away from projects where security has low priority (in open source projects, the satisfaction of contributing to a meaningful is the primary reward for programmers.) contributor score = projects commits contributor in project • security history score project total commits contributor (8) Having estimated the experience of the individual contributors to a software project, we can now calculate a team score as the sum of the contributor scores for the individual developers weighted by the relative size of their contributions to the overall software project, as shown in 9 below. team score = contributors contributor commits project • contributor score total commits project [START_REF] Dierks | The Transport Layer Security (TLS) Protocol Version 1[END_REF] The information about contributors to OSS projects and the number of commits that they have contributed to different project can be found on OpenHub [4].

Maintainability Analysis

As discussed in Section 3, there are many metrics for measuring the maintainability og software. In the current definition of CodeTrust, we favour a simple definition based on the comments to code ration defined in Equation-10, but we clearly identify this as an interesting area for future work.

comments code ratio = lines comments lines code + lines comments [START_REF] Fitzpatrick | More c++ gems. chap. Applying the ABC Metric to C, C++, and Java[END_REF] The necessary information for these calculations can be found on OpenHub for many OSS projects. This allows us to benchmark individual projects against the other projects, i.e. normalize the comment to code ration for a particular project to the average project. Table 2 presents data for a number of well known projects; these were collected in December 2016.

The table shows that the majority of OSS projects has a comment to code ration between 10% and 25%, so we define the Maintainability score as the normalized comment to code ratio as defined in Equation 11.

M aintainability score = comment code ratio -0.1 0.25 -0.

CodeTrust Metric

Having calculated the security history score, the team score and the maintainability score for the projects above, we are now able to define the CodeTrust metric as shown in Equation 12.

codetrust = 0.65 • security history score + 0.25 • team score + 0.1 • maintainability score (12)
The weighting of the different scores reflect our estimate of the relative importance of these scores to the overall trustworthiness of the developed software. As each of these scores are subject to further research, it is possible that these weights will change, but we feel confident that the relative importance of the different aspects are captured by the weights above.

Evaluation

We have developed a simple prototype that implements the CodeTrust metric, which allows us to present a preliminary evaluation. The prototype is written in Java, with the incorporation of a few external components and libraries, such as the Debian Linux package manager program apt-rdepends for resolving dependencies and the RoboBrowser [START_REF] Carp | robobrowser[END_REF] for scraping web pages. For a more detailed description of the prototype and the evaluation presented in this paper, please refer to the M.Sc. thesis of Michael B. Nielsen- [START_REF] Nielsen | Quality and IT Security assessment of Open Source Software projects[END_REF].

We evaluate each of the three components before we present the evaluation of the full CodeTrust prototype.

Security History Score

We have selected a number of popular OSS projects, where information is available on OpenHub; this is simply to make our evaluation task easier. The results of this evaluation are presented in Table 3 Project ncve tcve vs lt mt ht ct ah ac sev ss Apache server 0.9 3. Security History Score for selected OSS projects.

The dashes indicates that there were no CVEs registered for the project at the time of evaluation. This may be explained by projects being new (no vulnerabilities have been found yet), small (few users to find vulnerabilities and little interest from criminals) or well engineered and competently programmed. We note that most of the projects that have no CVE data receives the lowest possible security score, apart from the password manager Keypass which receives the highest score. This demonstrates that it is possible for a project to receive a high score based on user evaluations and that projects developed for security purposes are likely to be more security concious, which should result in a higher security score. The relative high score of OpenSSl confirms this belief, despite the bad publicity attracted because of the HeartBleed vulnerability.

Team Score

The team score is used to describe how the current contributors experience and performance have been with their previous projects. The perfect situation would be to test each contributors performance in their commits, but this is unfortunately not possible. The contributors found are only the contributors currently contributing, which means the contributors with commits during the last 12 months. The contributors are thus evaluated on the projects which they have been part of and committed to. The data from each project is found in Table 4.

We note that two projects (Filezilla and Keepas2) have very few contributors, so if these contributors have not recently contributed to other projects, the team score is essentially determined by the user evaluation of the security history score calculation (this explains the extreme values 0 and 10). 4. Team Score for selected OSS projects.

Maintainability Score

The maintainability score simply reflects the code to comment ratio as discussed earlier. The score is shown in Table 5. We observe that two projects (Atom editor and neat-project) receives the lowest score and one project (Wordpress) scores the highest. We explain this by the effects of normalizing the ratio to the range 10% -25%, i.e. the two lowest scoring projects both have a comment to code ratio below 10% and the highest scoring project has a ratio above the 25%.

CodeTrust

The results of our evaluation of selected OSS projects are shown in Table 6, which shows the project, the security history score (SH score), the team score, the maintainability score and the CodeTrust score for the project. We first note that several projects received a very low score because of a "0" in the Security History Score. This is how the CodeTrust metric is designed, but it highlights the problem of incomplete information. In most cases, the low security score reflects the fact that no CVEs have been registered for the project.

We also note that the OpenSSl, which contained the bug that caused the HeartBleed vulnerability described in Section 2, receives a respectable score of 6.81, which means that OpenSSL belongs to the upper quartile of the evaluated projects.

Finally, we note that the CodeTrust makes it possible to compare competing frameworks, such as the combination of Python and PHP against Ruby and Ruby on Rails. Both frameworks are relatively mature frameworks for dynamic web content and generally score well, but PHP scores a little lower than the others, which suggests that the Ruby based combination is a little more secure.

Conclusions

In this paper, we examined the problem of trustworthiness of software, in particular software developed in Open Source Software projects. Trustworthiness concerns both functional and non-functional requirements for the developed software, but in this paper we focused on the non-functional requirement security.

We have defined the CodeTrust metric to measure the trustworthiness of software, through an evaluation og the security history of the software itself and the development team responsible for the software. We also included a rough estimate of the maintainability of the software in our metric, because complexity of code is one of the main causes for insecure software.

We have employed the CodeTrust metric to evaluate a number of OSS projects, including OpenSSL, which contained the bug that caused the higly publicized HeartBleed vulnerability. The CodeTrust evaluation gave a high score to OpenSSL, which indicates that the CodeTrust metric is robust against short term effects og widely publicized vulnerabilities.

No metric is more reliable than the input it receives, which is also a problem identified in the evaluation of CodeTrust. New software has no security history, so it is possible that CodeTrust should emphasize the team analysis more in this case. This would, however, only solve the problem when the team consists of experienced software developers with a public track record, so software by many student start-ups would not be trusted (it is an open question whether it should).

The problem of missing data is an important issue that we intend to address in future work. There are two main direction that we plan to pursue: acquisition of more data, through more comprehensive web-scraping techniques, and including a confidence score in the metric, which indicates the quality of the data that the evaluation is based on.

The overall result of our evaluation shows that the CodeTrust metric works well for larger and more mature OSS projects, but that there are some problems evaluation new or small projects. The evaluation shows that most of the projects that rated poorly, did so because of missing data, which means that the current prototype cannot be used to make automated decisions about whether to rely on particular software or not. Our evaluation of the two dynamic web-page frameworks Ruby on Rails and PHP shows that there is a difference in trustworthiness, but also that both frameworks are mature and have a reasonable security track record. The difference may persuade an organisation to choose one framework over the other, which is another reason for evaluating the trustworthiness of software.

Finally, we wish to further examine the relationship between the Security History Score and the Team Score, in particular for software developers that primarily work on a single project. In this case, the CodeTrust evaluation is based almost exclusively on the security history data.

Fig. 1 .

 1 Fig. 1. Trust Principles that reflect trustworthiness, quality and security of software.

Fig. 2 .

 2 Fig. 2. Trustworthiness attributes identified by Mohammadi et al. [14].

Fig. 3 .

 3 Fig. 3. Overview of the CodeTrust metric.

  severity score =(0.6 • average critical+ 0.4 • average high) + 0.45 • trend critical+ 0.3 • trend high + 0.1 • trend medium + 0.05 • trend low (6)

Table 2 .

 2 OpenHub data for popular open source projects.

	1	• 10	(11)

Table 5 .

 5 Maintainability Score for selected OSS projects.

	Project	Code/Comment ratio Maintainability score
	Apache server	10.29	0.19
	Atom editor	8.26	0
	Docker	10.93	0.62
	Mozilla Filezilla	12.98	2.00
	Firefox	16.75	4.5
	Keepass2	16.74	4.49
	MongoDB	21.29	7.53
	MySQL	19.49	6.32
	neat-project	6.67	0
	OpenSSL	18.20	5.47
	PHP	13.97	2.65
	Python	15.22	3.48
	Ruby	12.18	1.46
	Ruby on Rails	16.07	4.04
	tar	11.99	1.32
	Wordpress	27.49	10

Table 6 .

 6 CodeTrust metric for selected OSS projects.

	Project	SH score Team score Maintainability score CodeTrust score
	Apache server	8.88	5.71	0.19	7.22
	Atom editor	0	9.89	0	2.47
	Docker	0	9.91	0.62	2.5
	Filezilla	0	10	2	2.7
	Firefox	8.48	5.14	4.5	7.2
	Keepass2	10	0	4.49	6.95
	MongoDB	0	9.96	7.53	3.24
	MySQL	6.48	4.62	6.32	6
	neat-project	0	9.87	0	2.47
	OpenSSL	8.48	3.02	5.47	6.81
	PHP	5.2	5.49	2.65	5.02
	Python	5.72	9.08	3.48	6.34
	Ruby	6.68	7.29	1.46	6.31
	Ruby on Rails	6.68	6.29	4.04	6.32
	tar	6.44	5.63	1.32	5.73
	Wordpress	8.12	3.49	10	7.15

OpenSSL is a widely used implementation of the Transport Layer Security (TLS) protocol[START_REF] Dierks | The Transport Layer Security (TLS) Protocol Version 1[END_REF], which allows two computers on the Internet to establish secure communication. It is often used by embedded systems and open source software, such as the Apache and nginx webservers which, at the time, powered around two thirds of the websites on the Internet.

The Common Critera captures the Protection Profile (PP) and the Security Target (ST) and measures the Evaluation Assurance Level (EAL), which depends on the depth and rigour of the security evaluation.