Machine-Learned Requirement Classification for Software Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software development processes struggle to integrate security requirements effectively, leading to a philosophical and practical separation between business and technical user descriptions, resulting in high false-positive and false-negative security outcomes, and a lack of scalability in expert resources.
Innovation Solution
Utilize machine learning models, specifically Natural Language Processing (NLP) and deep learning techniques, to classify functional requirements and automatically generate security acceptance criteria, integrating them into the software development lifecycle.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security review processes are used, then security expertise can be applied, but scalability is limited and false-positive/false-negative rates increase
Solution Approach 1:
The patent replaces manual security review processes with an automated machine learning-based system that uses NLP to analyze functional requirements and generate security acceptance criteria. This substitution eliminates the scalability limitations of manual review while maintaining security expertise through trained models that can process large volumes of requirements consistently.
Solution Approach 2:
The system enables self-service by automatically generating security acceptance criteria from functional requirements without requiring manual intervention from security experts for each requirement. The machine learning model autonomously analyzes requirements, identifies security concerns, and produces actionable security criteria, freeing experts for high-value tasks.
2Reliability
If security requirements are separated from business requirements, then specialized security review can be performed, but integration is lost leading to false-positive/false-negative outcomes
Solution Approach 1:
The patent merges security requirements with business requirements by processing functional requirements through a unified machine learning pipeline that simultaneously understands both business context and security implications. The system integrates security acceptance criteria generation directly into the requirements analysis process, eliminating the separation between business and security domains while maintaining specialized security review capabilities.
Solution Approach 2:
The machine learning model serves multiple functions: it analyzes functional requirements for business context, identifies security concerns, generates security acceptance criteria, and prioritizes security tasks. This multi-functionality unified approach eliminates the need for separate specialized review processes while maintaining high accuracy through comprehensive requirement analysis.
Data Source
AI summary
A method may include querying a project data store with a project identifier using a processing unit. The query retrieves the functional requirement of a stored project data structure associated with the identifier. This requirement is then input into a trained machine learning model, which has output nodes corresponding to a set of requirement classifications. The output values from the model are accessed, and a requirement classification is added to the project data structure based on these values.