Security demand automatic generation method and device, equipment and medium

Abstract

The invention provides a security demand automatic generation method and device, equipment and a medium, and relates to the technical field of software engineering.The method comprises the steps that an actual function demand is received, and a pre-configured verification demand retriever is used for recognizing the most relevant first K verification demands; inputting each pair of function demand-verification demand into a pre-configured security demand generation prompt template; and selectively guiding the large model to generate a security demand according to whether the function demand is matched with the verification demand. According to the method, the real software project function requirements are used as input, various and specific security requirements are automatically generated for the software project function requirements, manual intervention and time cost are remarkably reduced while it is ensured that the generated security requirements have high availability and high coverage rate, and an efficient and reliable security requirement generation tool is provided for a software development team.

Description

Technical Field

[0001] The present invention relates to the field of software engineering technology, and in particular to a method, device, equipment and medium for automatically generating security requirements. Background Art

[0002] In the field of software engineering, the identification and writing of security requirements are crucial to ensuring the integrity, availability, and confidentiality of software systems. With the rapid development of information technology, software products not only need to meet functional requirements, but also need to be able to resist various potential threats to protect user data and maintain corporate reputation and legal compliance.

[0003] The traditional security requirements analysis process mainly relies on the manual work of requirements engineers, who combine their own experience and industry standards to determine the necessary security elements. Engineers must screen out the content related to functional requirements from a large number of verification requirements one by one, which is time-consuming and labor-intensive, and is prone to omissions or inaccuracies in requirements due to differences in personal professional capabilities.

[0004] In order to improve efficiency and accuracy, model-based methods and template generation methods can reduce the workload to a certain extent, but they usually require the pre-construction of complex domain ontologies or structural models, which increases the workload and cost of preliminary preparation. On the other hand, deep learning technologies such as generative adversarial networks (GANs) can create more realistic demand texts, but their applicability and accuracy in specific projects are still insufficient, and they may introduce grammatical errors or content duplication. Furthermore, large language models are introduced into demand generation tasks due to their powerful text interpretation and generation capabilities. Nevertheless, when detailed input is lacking, the security requirements generated by large language models are often too general and difficult to meet the specific needs in different scenarios in a targeted manner. For example, in some cases, large models may simply recommend the use of data encryption as a protection measure, ignoring the particularity of specific application scenarios.

[0005] In summary, in the process of converting functional requirements into security requirements, existing technologies have problems such as low efficiency, lack of accuracy, and lack of practicality. Summary of the invention

[0006] The present invention provides a method, device, equipment and medium for automatically generating security requirements, which solves the problem of how to improve the efficiency, accuracy and practicality of the technology for automatically generating security requirements.

[0007] In order to achieve the above objectives, this application adopts the following technical solutions:

[0008] In a first aspect, a method for automatically generating security requirements is provided, comprising:

[0009] Receive the actual functional requirements and use a pre-configured verification requirement retriever to identify the top K most relevant verification requirements;

[0010] Input each functional requirement-verification requirement pair into the pre-configured security requirement generation prompt template;

[0011] Based on whether the functional requirements and verification requirements match, the large model is selectively guided to generate security requirements.

[0012] In a first possible implementation manner of the first aspect, the configuration step of the verification requirement retriever includes:

[0013] Creating a prompt template for synthesizing functional requirement-verification requirement pairs, namely, a data synthesis prompt template, which includes: instructions and example cases;

[0014] Using the large model and the prompt template to synthesize functional requirements for the selected ASVS verification requirements, ensuring that the functional requirements implicitly contain the vulnerabilities described in the verification requirements;

[0015] Verify each synthesized functional requirement through the verification requirement retriever, and filter the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever;

[0016] The paired data whose screening ranking is within the set value are regarded as qualified data that meet the quality requirements, and a data set of functional requirement-verification requirement paired data is formed based on the qualified data.

[0017] Based on any possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the verification requirement retriever, based on the architecture of the ColBERTv2 zero-sample retriever, includes:

[0018] A functional requirement encoder is used to receive a functional requirement FR input and generate a token-level embedding E of the functional requirement. FR ;

[0019] A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement. VR ;

[0020] A weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

[0021] Based on the first possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, verifying each synthesized functional requirement by the verification requirement retriever and screening the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever specifically includes:

[0022] Given a functional requirement FR input and a verification requirement VR input, we use a shared-weight encoder to obtain the token-level embedding E of FR and VR respectively. FR and E VR ;

[0023] Obtain the token weight W in the verification requirement through the weight embedding layer VR ;

[0024] Calculate the token-level cosine similarity between the functional requirement and the verification requirement, and use W VR Weight the similarity and get the similarity matrix Sim matrix ;

[0025] The similarity scores are aggregated using a MaxSim method similar to the ColBERTv2 zero-shot retriever to obtain the final similarity Sim FR,VR , the specific formula is as follows:

[0026] E FR ,E VR =Encoder FR (FR),Encoder VR (VR)#(1)

[0027] W VR =Embedding weight (VR)#(2)

[0028] Sim matrix =W VR ·CosSim(E FR ,E VR )#(3)

[0029]

[0030] In a second aspect, a device for automatically generating security requirements is provided, comprising:

[0031] A verification requirement retriever module, for receiving actual functional requirements and identifying top K most relevant verification requirements using a pre-configured verification requirement retriever;

[0032] a prompt engineering module for inputting each functional requirement-verification requirement pair into a pre-configured security requirement generation prompt template;

[0033] The security requirement generation module is used to selectively guide the large model to generate security requirements based on whether the functional requirements and verification requirements match.

[0034] In a first possible implementation manner of the second aspect, the verification requirement retriever module includes a configuration module of the verification requirement retriever, which is specifically configured to:

[0035] Creating a prompt template for synthesizing functional requirement-verification requirement pairs, namely, a data synthesis prompt template, which includes: instructions and example cases;

[0036] Using the large model and the prompt template to synthesize functional requirements for the selected ASVS verification requirements, ensuring that the functional requirements implicitly contain the vulnerabilities described in the verification requirements;

[0037] Verify each synthesized functional requirement through the verification requirement retriever, and filter the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever;

[0038] The paired data whose screening ranking is within the set value are regarded as qualified data that meet the quality requirements, and a data set of functional requirement-verification requirement paired data is formed based on the qualified data.

[0039] Based on any possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the verification requirement retriever, based on the architecture of the ColBERTv2 zero-sample retriever, includes:

[0040] A functional requirement encoder is used to receive a functional requirement FR input and generate a token-level embedding E of the functional requirement. FR ;

[0041] A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement. VR ;

[0042] A weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

[0043] Based on the first possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, verifying each synthesized functional requirement by the verification requirement retriever and screening the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever specifically includes:

[0044] Given a functional requirement FR input and a verification requirement VR input, we use a shared-weight encoder to obtain the token-level embedding E of FR and VR respectively.FR and E VR ;

[0045] Obtain the token weight W in the verification requirement through the weight embedding layer VR ;

[0046] Calculate the token-level cosine similarity between the functional requirement and the verification requirement, and use W VR Weight the similarity and get the similarity matrix Sim matrix ;

[0047] The similarity scores are aggregated using a MaxSim method similar to the ColBERTv2 zero-shot retriever to obtain the final similarity Sim FR,VR , the specific formula is as follows:

[0048] E FR ,E VR =Encoder FR (FR),Encoder VR (VR)#(1)

[0049] W VR =Embedding weight (VR)#(2)

[0050] Sim matrix =W VR ·CosSim(E FR ,E VR )#(3)

[0051]

[0052] According to a third aspect, an electronic device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the method for automatically generating security requirements as described in the first aspect are implemented.

[0053] In a fourth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method for automatically generating security requirements as described in the first aspect are implemented.

[0054] The advantages and positive effects of the present invention are:

[0055] The method proposed in this application automatically generates security requirements from functional requirements. First, the functional requirement-verification requirement pairing data is synthesized using prompt engineering, and a verification requirement retriever is designed and trained. The trained retriever is then used to retrieve verification requirements related to actual functional requirements, and the above information is integrated to use prompt engineering to guide the large model to generate the final security requirements. The present invention uses real software project functional requirements as input to automatically generate diverse and specific security requirements for it. While ensuring that the generated security requirements have high availability and high coverage, it significantly reduces manual intervention and time costs, providing software development teams with an efficient and reliable security requirement generation tool. Specifically:

[0056] (1) Specificity and diversity of generated requirements: The present invention can automatically generate security requirements that are highly relevant to the input functional requirements under zero-sample conditions. These generated security requirements are not only highly specific, but also cover multiple security aspects such as data protection, access control, and session management, which significantly enhances the practical value of the generated results in actual projects.

[0057] (2) Reducing manpower and time costs: The present invention can automatically generate security requirements from functional requirements, significantly reducing the workload and time investment required by requirements engineers in the requirements analysis phase, and effectively improving work efficiency.

[0058] (3) Efficient and without additional training: The present invention can be directly applied to different software projects and can generate high-quality security requirements without additional model training. This zero-sample generation capability reduces the threshold for deployment and use, making the present invention versatile and scalable in different projects and scenarios.

[0059] The device, electronic device and readable storage medium corresponding to the method for automatically generating security requirements of the present invention can achieve the same technical effect. To avoid repetition, they will not be described here. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic flow chart of a method for automatically generating security requirements provided in an embodiment of the present application;

[0061] Figure 2 A schematic flow chart of another method for automatically generating security requirements provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of a data synthesis prompt template provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of a security requirement generation prompt template provided in an embodiment of the present application;

[0064] Figure 5A schematic diagram of a security requirement automatic generation device provided in an embodiment of the present application

[0065] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose, the technical solutions in the embodiments of the present application are clearly described. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present application.

[0067] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0068] The description of the method flow in the specification of the present application and the steps of the flowchart in the drawings of the present specification do not have to be strictly executed according to the step numbers, and the method steps can be executed in a different order. Moreover, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0069] The following is a detailed description of the method, device, equipment and medium for automatically generating security requirements provided in the embodiments of the present application in conjunction with the accompanying drawings and preferred embodiments.

[0070] First, the application scenario of the method for automatically generating security requirements in an embodiment of the present application is described in detail.

[0071] Traditionally, the identification and writing of security requirements mainly rely on manual analysis by requirements engineers, who need to combine experience and industry standards to determine security factors. This approach is time-consuming and labor-intensive, and is easily limited by engineers' expertise. Engineers usually need to match and filter content related to functional requirements one by one from hundreds of verification requirements, which places high demands on engineers' security knowledge and efficiency. In addition, due to late or incomplete consideration of security requirements, requirements are often missed or inaccurate, which in turn affects the overall security of the system.

[0072] Existing automated or semi-automated methods, such as model-based methods and template generation methods, reduce the workload to a certain extent, but often require the pre-construction of complex domain ontologies, detailed structural models, or preset rules. These preparations are time-consuming and costly, and are not easy to promote and use. In addition, deep learning-based methods that have emerged in recent years, such as generative adversarial networks, can generate more realistic requirements, but their outputs are insufficient in applicability and accuracy for specific projects, and may contain grammatical errors or repeated content.

[0073] To make up for these shortcomings, advanced large-scale language models have been introduced into the task of demand generation. Although these models perform well in interpreting and generating text, without detailed input, the security requirements they generate are often general and lack sufficient specificity. For example, when faced with different software systems, large models often recommend the use of data encryption to protect information. Although this is a technically correct measure, it cannot meet the actual needs in certain specific scenarios. Therefore, how to effectively combine specific verification standards to generate more accurate and practical security requirements is the main challenge currently faced.

[0074] Based on this, this application proposes a method for automatically generating security requirements from functional requirements in response to the problems existing in the prior art in the process of generating security requirements from functional requirements, aiming to improve the efficiency and accuracy of security requirement writing, while ensuring that the generated requirements are consistent with industry security standards. This method can directly use the functional requirements of the project as input, and can generate specific security requirements covering multiple security dimensions under zero-sample conditions without additional training. By introducing the authoritative verification standard OWASP ASVS, this method can take into account the security of multiple aspects such as design identity authentication, session management, and data protection; at the same time, it introduces a verification requirement retrieval model to retrieve functional requirements to security requirements, and incorporates the vocabulary distribution features in the verification standard into the model to improve the performance of the retrieval model, and obtains verification requirements that match the actual functional requirements; finally, a prompt template that incorporates the actual functional requirements-verification requirements context is designed to guide the large model to generate the final security requirements.

[0075] See also Figure 1-2 , the embodiment of the present application provides a method for automatically generating security requirements, such as Figure 1-2 As shown, the recommended method of the embodiment of the present application includes:

[0076] Step S1, receiving actual functional requirements, and using a pre-configured verification requirement retriever to identify the top K most relevant verification requirements.

[0077] Step S2, input each pair of functional requirement-verification requirement into a pre-configured security requirement generation prompt template.

[0078] Step S3, selectively guide the large model to generate security requirements based on whether the functional requirements and verification requirements match.

[0079] Specifically, the configuration steps of the verification requirement retriever include:

[0080] Step S101 : creating a prompt template for synthesizing a functional requirement-verification requirement pair, namely, a data synthesis prompt template, which includes: instructions and example cases.

[0081] Step S102, using the large model and the prompt template to synthesize the functional requirements for the selected ASVS verification requirements, to ensure that the functional requirements implicitly contain the loopholes described in the verification requirements.

[0082] The above steps S101-S102 are the process of synthesizing the functional requirement-verification requirement pairing data ( Figure 2 , P1.1). Training the verification requirement retriever requires paired data of functional requirements and verification requirements, but currently there are only verification requirements and no paired functional requirements. Therefore, the present application embodiment uses prompt engineering to synthesize paired data. For example, the present application embodiment designs a prompt template for synthesizing functional requirements and verification requirements for its data synthesis, such as Figure 3 As shown in the figure, the data synthesis prompt template consists of instructions and three example cases. Each case provides valid synthesis results and invalid synthesis results and explains the reasons. This structure can help large models identify synthesis standards more accurately. The "valid reasons" section explains why there are loopholes in the verification requirements description in the functional requirements, while the "invalid reasons" details three types of deficiencies: (1) Synthesized data cannot be called functional requirements, that is, describing the functions of the system or system elements or the tasks to be performed by the system; (2) Synthesized data is too abstract and lacks specific details; (3) Synthesized data directly indicates loopholes in the verification requirements, rather than being implied in the functional requirements.

[0083] Step S103, verifying each synthesized functional requirement through a verification requirement retriever, and screening the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever.

[0084] Step S104 , screening the paired data ranked within a set value as qualified data that meets the quality requirements, and forming a data set of functional requirement-verification requirement paired data based on the qualified data.

[0085] The verification requirement retriever is based on the architecture of the ColBERTv2 zero-shot retriever and includes:

[0086] The functional requirement encoder is used to receive the functional requirement FR input and generate the token-level embedding E of the functional requirement. FR ;

[0087] A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement. VR ;

[0088] The weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

[0089] In step S103, each synthesized functional requirement is verified by a verification requirement retriever, and is screened according to the ranking order of the corresponding verification requirements in the search results of the verification requirement retriever, specifically including:

[0090] Step a: Given a functional requirement FR input and a verification requirement VR input, use a shared weight encoder to obtain the token-level embedding E of FR and VR respectively. FR and E VR .

[0091] Step b, obtain the token weight W in the verification requirement through the weight embedding layer VR .

[0092] Step c, calculate the token-level cosine similarity between the functional requirements and the verification requirements, and use W VR Weight the similarity and get the similarity matrix Sim matrix .

[0093] Step d: Aggregate the similarity scores using a MaxSim method similar to the ColBERTv2 zero-shot retriever to obtain the final similarity Sim FR,VR , the specific formula is as follows:

[0094] E FR ,E VR =Encoder FR (FR),Encoder VR (VR)#(1)

[0095] W VR =Embedding weight (VR)#(2)

[0096] Sim matrix =W VR ·CosSim(E FR ,E VR )#(3)

[0097]

[0098] The above steps S101 to S104 are the process of designing and training the verification requirement retriever architecture ( Figure 2 , P1.2).

[0099] It is worth noting that the above steps S101 to S104 do not synthesize functional requirements for each verification requirement in the verification standard, because some of them (such as ASVS Section 1.1 and Section 14.1) focus on the software development process rather than software functions. Specifically, the embodiment of the present application synthesizes 2410 functional requirement-verification requirement pairs for the 241 verification requirements in the screened ASVS.

[0100] In order to further improve the quality of the generated functional requirements-verification requirements, the above steps S103-S104 introduce a zero-shot retriever, namely ColBERTv2, as a quality control model to improve the accuracy of the synthesis results. Each synthesized functional requirement will be verified by the ColBERTv2 retriever, which will retrieve the verification requirements related to the functional requirement and filter them according to the ranking of the retrieval results. For example, only when the verification requirements corresponding to the synthesized functional requirements appear within the top 30% of the ColBERTv2 retrieval results, the pairing is considered qualified. Through this standard, data that meets the quality requirements is screened out, and finally a data set consisting of 1536 high-quality functional requirements-verification requirements pairing data is constructed. Then, the 1536 functional requirements-verification requirements pairs obtained in the previous step are used as a data set, and a 9:1 ratio is used for training and verification to obtain the required verification requirements retriever.

[0101] The present invention uses ColBERTv2 as the skeleton model and makes architectural adjustments to adapt to the characteristics of this retrieval task: (1) Functional requirements and verification requirements are difficult to match in terms of overall semantics. Usually, the connection exists at the token level. (2) Not all words in the verification requirements have all the weights. Tokens that indicate functions, such as "data" and "registration", are more important.

[0102] The delayed interaction strategy in ColBERTv2 represents text as a multi-dimensional vector at the token level rather than a single-dimensional vector at the sentence level, and uses the MaxSim method for aggregation, which is conducive to solving the problem caused by the above-mentioned feature (1). For feature (2), the token weights in the verification requirements are different. The present invention pre-calculates the token weights in ASVS, embeds these weights into the architecture of the retriever, and further learns them during the model training process, so that the verification requirement retrieval model can treat different tokens in the verification requirements differently, thereby improving the efficiency of the retrieval model. Specifically, the present invention uses the TF-IDF model to determine the weight of each token and normalize it. Then, a learnable weight embedding layer is introduced into the architecture of ColBERTv2, which is initialized to the token weights calculated by TF-IDF. The parameters of this layer can be updated during the training process to further adapt to the data. The overall architecture of the retriever is as follows Figure 1 This is shown in step P1.2.

[0103] In the specific implementation process of the above steps S1 to S3, for each actual functional requirement, the verification requirement retriever will identify the top K verification requirements that are most relevant to the functional requirement. This retrieval process ensures that each functional requirement can be matched with the most appropriate verification requirement. After retrieving the top K verification requirements, each pair of functional requirement-verification requirement will be input into the prompt template for security requirement generation, which is used to guide the model (such as GPT-4) to generate a security requirement corresponding to the input functional requirement and verification requirement. Security requirement generation follows a structured template (such as Figure 4 to ensure that the generated results are as expected. Figure 2 ,The above method consists of two main stages: data preparation, ,architecture design and training of the verification requirement retriever, and ,security requirement generation based on the verification requirement. ,It is worth noting that the first stage only needs to be performed once, and only the second stage needs to be ,performed in actual applications, which significantly simplifies the usage process.

[0104] It is worth noting that, in some possible implementations, although the present invention takes measures to improve the performance of the verification requirement retriever, it is still impossible to completely eliminate the situation of false matching. Therefore, two situations are considered in the security requirement generation prompt template:

[0105] (1) The functional requirements and verification requirements actually match: If the retrieved verification requirements are indeed applicable to the functional requirements, the big model will generate a security requirement based on the functional requirements and verification requirements, which clearly describes the security measures or functions required to implement the functional requirements and verification requirements.

[0106] (2) The functional requirements and verification requirements do not actually match: If the retrieved verification requirements are not related to the functional requirements, indicating that the verification requirements are not applicable to the functional requirements, the large model will not generate security requirements.

[0107] This selective generation can effectively reduce unnecessary computational overhead and alleviate the burden of manual review. Therefore, the security requirement generation prompt template contains two manually written examples, each of which is paired with a target functional requirement-verification requirement pair, showing two scenarios where verification requirements are applicable and inapplicable. This structured approach helps large models generate relevant and high-quality security requirements, ensuring that the generated requirements meet the security requirements of the project.

[0108] The end result is a complete set of generated security requirements that are based on the actual functional requirements and the corresponding verification requirements. The generated security requirements will be summarized into a final document or output set for the project team to use to ensure that the security of the system is met.

[0109] Based on the above technical solution, the method proposed in this application automatically generates security requirements from functional requirements. First, the functional requirement-verification requirement pairing data is synthesized using prompt engineering, and a verification requirement retriever is designed and trained. The trained retriever is then used to retrieve the verification requirements related to the actual functional requirements, and the above information is integrated to use prompt engineering to guide the large model to generate the final security requirements. The present invention uses real software project functional requirements as input to automatically generate diverse and specific security requirements for it. While ensuring that the generated security requirements have high availability and high coverage, it significantly reduces manual intervention and time costs, providing software development teams with an efficient and reliable security requirement generation tool.

[0110] The advantages and positive effects of the present invention are:

[0111] (1) Specificity and diversity of generated requirements: The present invention can automatically generate security requirements that are highly relevant to the input functional requirements under zero-sample conditions. These generated security requirements are not only highly specific, but also cover multiple security aspects such as data protection, access control, and session management, which significantly enhances the practical value of the generated results in actual projects.

[0112] (2) Reducing manpower and time costs: The present invention can automatically generate security requirements from functional requirements, significantly reducing the workload and time investment required by requirements engineers in the requirements analysis phase, and effectively improving work efficiency.

[0113] (3) Efficient and without additional training: The present invention can be directly applied to different software projects and can generate high-quality security requirements without additional model training. This zero-sample generation capability reduces the threshold for deployment and use, making the present invention versatile and scalable in different projects and scenarios.

[0114] See also Figure 5 , corresponding to the above-mentioned security requirement automatic generation method embodiment, the present application embodiment provides a security requirement automatic generation device, the device comprising:

[0115] A verification requirement retriever module 1001 is used to receive actual functional requirements and identify the top K most relevant verification requirements using a pre-configured verification requirement retriever;

[0116] A prompt engineering module 1002 for inputting each functional requirement-verification requirement pair into a pre-configured security requirement generation prompt template;

[0117] The security requirement generation module 1003 is used to selectively guide the large model to generate security requirements based on whether the functional requirements and verification requirements match.

[0118] Furthermore, the verification requirement retriever module includes a configuration module of the verification requirement retriever, which is specifically used to:

[0119] Creating a prompt template for synthesizing functional requirement-verification requirement pairs, the prompt template including instructions and example cases;

[0120] Using the large model and the prompt template to synthesize functional requirements for the selected ASVS verification requirements, ensuring that the functional requirements implicitly contain the vulnerabilities described in the verification requirements;

[0121] Verify each synthesized functional requirement through the verification requirement retriever, and filter the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever;

[0122] The paired data whose screening ranking is within the set value are regarded as qualified data that meet the quality requirements, and a data set of functional requirement-verification requirement paired data is formed based on the qualified data.

[0123] Furthermore, the verification requirement retriever, based on the architecture of the ColBERTv2 zero-shot retriever, includes:

[0124] A functional requirement encoder is used to receive a functional requirement FR input and generate a token-level embedding E of the functional requirement. FR ;

[0125] A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement.VR ;

[0126] A weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

[0127] Further, the verifying each synthesized functional requirement by the verification requirement retriever and screening the corresponding verification requirement according to the ranking order of the search results of the verification requirement retriever specifically includes:

[0128] Given a functional requirement FR input and a verification requirement VR input, we use a shared-weight encoder to obtain the token-level embedding E of FR and VR respectively. FR and E VR ;

[0129] Obtain the token weight W in the verification requirement through the weight embedding layer VR ;

[0130] Calculate the token-level cosine similarity between the functional requirement and the verification requirement, and use W VR Weight the similarity and get the similarity matrix Sim matrix ;

[0131] The similarity scores are aggregated using a MaxSim method similar to the ColBERTv2 zero-shot retriever to obtain the final similarity Sim FR,VR , the specific formula is as follows:

[0132] E FR ,E VR =Encoder FR (FR),Encoder VR (VR)#(1)

[0133] W VR =Embedding weight (VR)#(2)

[0134] Sim matrix =W VR ·CosSim(E FR ,E VR )#(3)

[0135]

[0136] The above-mentioned security requirement automatic generation device implements the steps and various processes of the above-mentioned security requirement automatic generation method embodiment and can achieve the same technical effect. To avoid repetition, they are not described again here.

[0137] See also Figure 6 Corresponding to the above-mentioned embodiment of the method for automatically generating security requirements, an embodiment of the present application provides an electronic device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the above-mentioned embodiment of the method for automatically generating security requirements and the various processes of the embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0138] The memory 1009 can be used to store software programs and various data. The memory 1009 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1009 may include a volatile memory or a non-volatile memory, or the memory 1009 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 1009 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0139] The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1010.

[0140] Corresponding to the above-mentioned embodiment of the method for automatically generating security requirements, the embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by the processor, the steps of the above-mentioned embodiment of the method for automatically generating security requirements and the various processes of the embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0141] The processor is the processor in the electronic device described in the above embodiment of the present application. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0142] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be noted that the scope of the method and device in the embodiment of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0143] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0144] It can be understood that the embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific embodiments, which are merely illustrative and not restrictive, and those skilled in the art are aware that various changes or equivalent replacements can be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, those of ordinary skill in the art can modify these features and embodiments to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention under the inspiration or teaching of the present application. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of the present application belong to the scope protected by the present invention.

Claims

1. A method for automatically generating security requirements, characterized in that: include: Receive the actual functional requirements and use a pre-configured verification requirement retriever to identify the top K most relevant verification requirements; Input each functional requirement-verification requirement pair into the pre-configured security requirement generation prompt template; Based on whether the functional requirements and verification requirements match, the large model is selectively guided to generate security requirements.

2. The method for automatically generating security requirements according to claim 1, characterized in that: The configuration steps of the verification requirement retriever include: Creating a prompt template for synthesizing functional requirement-verification requirement pairs, namely, a data synthesis prompt template, which includes: instructions and example cases; Using the large model and the prompt template to synthesize functional requirements for the selected ASVS verification requirements, ensuring that the functional requirements implicitly contain the vulnerabilities described in the verification requirements; Verify each synthesized functional requirement through the verification requirement retriever, and filter the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever; The paired data whose screening ranking is within the set value are regarded as qualified data that meet the quality requirements, and a data set of functional requirement-verification requirement paired data is formed based on the qualified data.

3. The method for automatically generating security requirements according to claim 1 or 2, characterized in that: The verification requirement retriever, based on the architecture of the ColBERTv2 zero-shot retriever, includes: A functional requirement encoder is used to receive a functional requirement FR input and generate a token-level embedding E of the functional requirement. FR ; A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement. VR ; A weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

4. The method for automatically generating security requirements according to claim 2, characterized in that: The verifying each synthesized functional requirement by the verification requirement retriever and screening the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever specifically includes: Given a functional requirement FR input and a verification requirement VR input, we use a shared-weight encoder to obtain the token-level embedding E of FR and VR respectively. FR and E VR ; Obtain the token weight W in the verification requirement through the weight embedding layer VR ; Calculate the token-level cosine similarity between the functional requirement and the verification requirement, and use W VR Weight the similarity and get the similarity matrix Sim matrix ; The similarity scores are aggregated using a MaxSim method similar to the ColBERTv2 zero-shot retriever to obtain the final similarity Sim FR，VR , the specific formula is as follows: E FR ,E VR =Encoder FR (FR), Encoder VR (VR)#(1) W VR =Embedding weight (VR)#(2) Yes matrix =W VR ·CosSim(E FR ,AND VR )#(3) 5. The device for automatically generating security requirements is characterized in that: include: A verification requirement retriever module, for receiving actual functional requirements and identifying top K most relevant verification requirements using a pre-configured verification requirement retriever; a prompt engineering module for inputting each functional requirement-verification requirement pair into a pre-configured security requirement generation prompt template; The security requirement generation module is used to selectively guide the large model to generate security requirements based on whether the functional requirements and verification requirements match.

6. The device for automatically generating security requirements according to claim 5, characterized in that: The verification requirement retriever module includes a configuration module of the verification requirement retriever, which is specifically used to: Creating a prompt template for synthesizing functional requirement-verification requirement pairs, namely, a data synthesis prompt template, which includes: instructions and example cases; Using the large model and the prompt template to synthesize functional requirements for the selected ASVS verification requirements, ensuring that the functional requirements implicitly contain the vulnerabilities described in the verification requirements; Verify each synthesized functional requirement through the verification requirement retriever, and filter the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever; The paired data whose screening ranking is within the set value are regarded as qualified data that meet the quality requirements, and a data set of functional requirement-verification requirement paired data is formed based on the qualified data.

7. The device for automatically generating security requirements according to claim 5 or 6, characterized in that: The verification requirement retriever, based on the architecture of the ColBERTv2 zero-shot retriever, includes: A functional requirement encoder is used to receive a functional requirement FR input and generate a token-level embedding E of the functional requirement. FR ; A verification requirement encoder is used to receive a verification requirement VR input and generate a token-level embedding E of the verification requirement. VR ; A weight embedding layer is used to embed the token weight W in the verification requirement calculated using the TF-IDF algorithm. VR Embedded into a learnable weight embedding layer to generate a weight matrix.

8. The device for automatically generating security requirements according to claim 6, characterized in that: The verifying each synthesized functional requirement by the verification requirement retriever and screening the corresponding verification requirements according to the ranking order of the search results of the verification requirement retriever specifically includes: Given a functional requirement FR input and a verification requirement VR input, we use a shared-weight encoder to obtain the token-level embedding E of FR and VR respectively. FR and E VR ; Obtain the token weight W in the verification requirement through the weight embedding layer VR ; Calculate the token-level cosine similarity between the functional requirement and the verification requirement, and use W VR Weight the similarity and get the similarity matrix Sim matrix ; The similarity scores are aggregated using a MaxSim method similar to the ColBERTV2 zero-shot searcher to obtain the final similarity Sim FR，VR , the specific formula is as follows: E FR ,E VR =Encoder FR (FR), Encoder VR (VR)#(1) W VR =Embedding weight (VR)#(2) Yes matrix =W VR ·CosSim(E FR ,AND VR )#(3) 9. An electronic device, characterized in that: The electronic device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for automatically generating security requirements as claimed in any one of claims 1 to 4.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method for automatically generating security requirements as described in any one of claims 1 to 4 are implemented.

Images