A Security Ontology for Security Requirements Elicitation

Abstract

International audienceSecurity is an important issue that needs to be taken into account at all stages of information system development, including early requirements elicitation. Early analysis of security makes it possible to predict threats and their impacts and define adequate security requirements before the system is in place. Security requirements are difficult to elicit, analyze, and manage. The fact that analysts' knowledge about security is often tacit makes the task of security requirements elicitation even harder. Ontologies are known for being a good way to formalize knowledge. Ontologies, in particular, have been proved useful to support reusability. Requirements engineering based on predefined ontologies can make the job of requirement engineering much easier and faster. However, this very much depends on the quality of the ontology that is used. Some security ontologies for security requirements have been proposed in the literature. None of them stands out as complete. This paper presents a core and generic security ontology for security requirements engineering. Its core and generic status is attained thanks to its coverage of wide and high-level security concepts and relationships. We implemented the ontology and developed an interactive environment to facilitate the use of the ontology during the security requirements engineering process. The proposed security ontology was evaluated by checking its validity and completeness compared to other ontologies. Moreover, a controlled experiment with end-users was performed to evaluate its usability

Using the AMAN-DA method to generate security requirements: a case study in the maritime domain

“…(b) The method is generic in the sense that it is designed to be used with a generic security ontology [12] and any domain ontologies; as long as they embed, some expected knowledge. (c) The defined rules allow the method to automatically exhibit an appropriate ontological semantics (security and domain specific) to the engineer in charge of requirements elicitation (agents, objects, threats, security requirements, etc.).…”

“…A controlled experiment with end-users was performed to evaluate its usability. The paper [12] presents in detail the construction of the ontology, its concepts and relations and reports its evaluation. …”

“…Using an input maritime domain ontology (Figure 18), the core security ontology (presented in [12], Figures 4 and 17) and the security goal and requirements specification models in addition to the rules presented above, a case study related to a maritime domain was undertaken in order to assess the efficacy of AMAN-DA for generating security requirements.…”

NANE: Identifying Misuse Cases Using Temporal Norm Enactments

“…Using a domain ontology [30] would greatly simplify the requirements analyst's effort in refining norms. In addition, the process of norm extraction from requirements can be automated via adopting a natural language processing approach.…”

A Survey of Security Assessment Ontologies

“…[11]; [12]; [13]; [14]; [15,16]; [17]; [18]; [19]; [20]; [21]; [22]; [23]; [24]; [25]; [26]; [27]; [28]; [29]; [30]; [31]; [32]; [33]; [34]; [35]; [36]; [37]; [38]; [39]; [40]; [41]; [42]; [43]; [44]; [45]; [44]; [8]; [46]; [47]. Generic and abstract proposals (Top-Level Ontologies) can be found in [48], [3], [49], [50], and [51]. Specific proposals (Task and Application Ontologies) can be found in [52], [53], and [54].…”