Software Security Integrity via ML Requirement Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software development processes struggle to integrate security requirements effectively, leading to a philosophical and practical separation between business and technical user descriptions, resulting in high false-positive and false-negative security outcomes, and a lack of scalability in expert resources.
Innovation Solution
Utilize machine learning models, specifically Natural Language Processing (NLP) and deep learning techniques, to classify functional requirements and automatically generate security acceptance criteria, integrating them into the software development lifecycle.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security review processes are used, then security expertise can be applied, but scalability is limited and expert resources are insufficient
Solution Approach 1:
The patent replaces manual mechanical security review processes with an automated machine learning system. The ML model automatically classifies functional requirements and generates security acceptance criteria, substituting human expert manual work with an automated computational system that can scale without additional expert resources.
Solution Approach 2:
The patent introduces a machine learning model as an intermediary between functional requirements and security acceptance criteria. This intermediary automatically processes and transforms business/technical requirements into security requirements, bridging the gap without requiring direct human expert intervention for each requirement.
2Reliability
If security requirements are integrated into development processes, then security outcomes improve, but false-positive and false-negative rates increase
Solution Approach 1:
The patent applies preliminary action by generating security acceptance criteria early in the requirements phase, before implementation and testing. The ML model classifies functional requirements and creates security criteria upfront, allowing security considerations to be built into the development process from the beginning rather than added later as corrections.
Solution Approach 2:
The patent implements dynamics by making the security requirement generation adaptive and iterative. The machine learning system continuously learns from feedback and refines its classifications, allowing the security acceptance criteria generation to evolve and improve accuracy over time rather than being static.
3Ease of manufacture
If business and technical user descriptions are separated, then development processes are simplified, but security requirements integration becomes difficult
Solution Approach 1:
The patent applies universality by designing a machine learning system that handles multiple types of requirements (functional, security, compliance) through a unified classification framework. The same ML infrastructure processes diverse requirement types and generates appropriate acceptance criteria for each, making the system versatile across different requirement categories while maintaining process simplicity.
Data Source
AI summary
A project data store is queried using a processing unit and a project identifier. The result is the retrieval of functional requirements for the project's data structure tied to that identifier. This information is then input into a machine learning model configured with the model's output nodes corresponding to a set of security concerns. Upon processing, the model's output values are accessed. A corresponding security concern is then added to a project data structure based on these output values.