Integrating Expert Elicitation into Subjective Logic for Assurance Case Confidence

Sammanfattning

Security or other critical system properties are commonly communicated to stakeholders using structured assurance arguments based on graphical representations such as Goal Structuring Notation (GSN). As systems become increasingly complex, more uncertainties appear, making it harder to justify confidence in arguments through review alone. Because GSN does not explicitly capture uncertainty that might affect the validity of arguments, several quantitative confidence assessment frameworks have been proposed to complement it. This thesis focuses on a Subjective Logic-based confidence propagation model of Yuan et al. for such arguments. To make this framework more applicable in practice, we develop and integrate an expert opinion elicitation method based on experts’ decision and confidence in the decision about the evidence items in the arguments. These judgments are extracted and transformed into binomial subjective opinions which serve as inputs to the propagation rules. In a diagnostic evaluation of the augmented model, we assess whether introducing the elicitation step alters the behavior of the propagation rules by applying a variance-based global sensitivity analysis (GSA) for dependent (correlated) input variables, using the method of Kucherenko et al. and randomized quasi-Monte Carlo (RQMC) with scrambled Sobol’ low-discrepancy sequences (LDSs) to confirm convergence of the sensitivity indices. Overall, the analysis of the indices of the original and augmented frameworks shows that introducing the elicitation step does not materially alter the behavior of the propagation model. While the elicitation layer introduces additional interaction effects and subtle shifts in sensitivity magnitudes, it remains structurally transparent and consistent with the original model, preserving the integrity of the propagation logic while providing a more intuitive interpretation of the results.