Paper published in a book (Scientific congresses, symposiums and conference proceedings)
Decision Support for Security-Control Identification Using Machine Learning
Bettaieb, Seifeddine; Shin, Seung Yeob; Sabetzadeh, Mehrdad et al.
2019In International Working Conference on Requirements Engineering: Foundation for Software Quality, Essen 18-21 March 2019
Peer reviewed
 

Files


Full Text
REFSQ_2019_paper_11.pdf
Author postprint (410.81 kB)
Download

All documents in ORBilu are protected by a user license.

Send to



Details



Keywords :
Security Requirements Engineering; Security Assessment; Machine Learning
Abstract :
[en] [Context & Motivation] In many domains such as healthcare and banking, IT systems need to fulfill various requirements related to security. The elaboration of security requirements for a given system is in part guided by the controls envisaged by the applicable security standards and best practices. [Problem] An important difficulty that analysts have to contend with during security requirements elaboration is sifting through a large number of security controls and determining which ones have a bearing on the security requirements for a given system. This challenge is often exacerbated by the scarce security expertise available in most organizations. [Principal ideas/results] In this paper, we develop automated decision support for the identification of security controls that are relevant to a specific system in a particular context. Our approach, which is based on machine learning, leverages historical data from security assessments performed over past systems in order to recommend security controls for a new system. We operationalize and empirically evaluate our approach using real historical data from the banking domain. Our results show that, when one excludes security controls that are rare in the historical data, our approach has an average recall of ≈ 95% and average precision of ≈ 67%. [Contribution] The high recall – indicating only a few relevant security controls are missed – combined with the reasonable level of precision – indicating that the effort required to confirm recommendations is not excessive – suggests that our approach is a useful aid to analysts for more efficiently identifying the relevant security controls, and also for decreasing the likelihood that important controls would be overlooked.
Research center :
Interdisciplinary Centre for Security, Reliability and Trust (SnT) > Software Verification and Validation Lab (SVV Lab)
Disciplines :
Computer science
Author, co-author :
Bettaieb, Seifeddine ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Shin, Seung Yeob ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Sabetzadeh, Mehrdad ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Briand, Lionel ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Nou, Grégory
Garceau, Michael
External co-authors :
no
Language :
English
Title :
Decision Support for Security-Control Identification Using Machine Learning
Publication date :
2019
Event name :
25th International Working Conference on Requirements Engineering: Foundation for Software Quality
Event place :
Essen, Germany
Event date :
from 18-03-2019 to 21-03-2019
Audience :
International
Main work title :
International Working Conference on Requirements Engineering: Foundation for Software Quality, Essen 18-21 March 2019
Peer reviewed :
Peer reviewed
Focus Area :
Security, Reliability and Trust
Funders :
Alphonse Weicker Foundation
Available on ORBilu :
since 22 January 2019

Statistics


Number of views
323 (82 by Unilu)
Number of downloads
611 (49 by Unilu)

Scopus citations®
 
7
Scopus citations®
without self-citations
5

Bibliography


Similar publications



Contact ORBilu