Analyzing and evaluating security features in software requirements
Analyzing and evaluating security features in software requirements
复制标题
分析和评估软件需求中的安全功能
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
R. Raje
中科院分区：
文献类型：
--
作者：
Ruchika Malhotra;A. Chug;Allenoush Hayrapetian;R. Raje
对于复杂的项目，软件需求通常包含非功能属性的说明（例如，与安全相关的特性）。分析这类需求的过程很费力，而且容易出错。由于软件需求固有的自由流动性质，从全面性和一致性的角度来看，应用基于自然语言处理（NLP）的机器学习（ML）技术来分析这些文档是很诱人的。在本文中，我们提出了一种新的半自动方法，可以从完整性、矛盾性和不一致性的角度来评估软件系统的安全需求。使用ISO引入的安全标准构建一个模型，使用基于nlp的ML技术对基于安全的需求进行分类。因此，该方法旨在确定软件需求文档的适当结构。一旦这样的结构被形式化并经过经验验证，它们将为软件组织提供指南，以生成与面向安全的特性相关的全面且明确的需求规范文档。建议的解决方案将在开发安全软件的早期阶段帮助组织，并减少总体开发工作和成本。
Software requirements, for complex projects, often contain specifications of non-functional attributes (e.g., security-related features). The process of analyzing such requirements is laborious and error prone. Due to the inherent free-flowing nature of software requirements, it is tempting to apply Natural Language Processing (NLP) based Machine Learning (ML) techniques for analyzing these documents from the point of view of comprehensiveness and consistency. In this paper, we propose novel semi-automatic methodology that can assess the security requirements of the software system from the perspective of completeness, contradiction, and inconsistency. Security standards introduced by the ISO are used to construct a model for classifying security-based requirements using NLP-based ML techniques. Hence, this approach aims to identify the appropriate structures that underlie software requirement documents. Once such structures are formalized and empirically validated, they will provide guidelines to software organizations for generating comprehensive and unambiguous requirement specification documents as related to security-oriented features. The proposed solution will assist organizations during the early phases of developing secure software and reduce overall development effort and costs.