Classifying software security requirements into confidentiality, integrity, and availability using machine learning...

Area of Science:

• Software Engineering
• Information Security
• Natural Language Processing

Background:

• Security requirements are critical non-functional software requirements, often based on the confidentiality, integrity, and availability (CIA) triad.
• Natural language-based requirements can be ambiguous, making it difficult to distinguish between different security dimensions.
• Automating the classification of security requirements aids in tracing and ensuring implementation.

Purpose of the Study:

• To propose and evaluate methods for automatically classifying security requirements into the CIA triad.
• To compare feature extraction techniques (TF-IDF and sentence-transformer embedding) combined with machine learning algorithms.

Main Methods:

• Developed five machine learning models (SVM, KNN, RF, GB, BNB) for each feature extraction technique.
• Utilized Term Frequency-Inverse Document Frequency (TF-IDF) and sentence-transformer embedding for feature extraction.
• Created a web interface for real-time analysis and classification of security requirements.

Main Results:

• The Support Vector Machine (SVM) model combined with sentence-transformer embedding achieved the highest accuracy at 87%.
• This approach demonstrated superior performance in predicting the security dimension of requirements compared to other models.
• TF-IDF and other machine learning algorithms showed varying degrees of success but were outperformed by the SVM-sentence-transformer combination.

Conclusions:

• Automated classification of security requirements into the CIA triad is feasible and beneficial for software engineering.
• Sentence-transformer embedding combined with SVM offers a highly accurate method for this classification task.
• The developed system can enhance the efficiency and reliability of security requirement management.