{"id":"https://openalex.org/W7160423758","doi":"https://doi.org/10.1109/saner-c67878.2026.00045","title":"Enhancing Security Requirements Coverage via RAG and Automated Feedback Loops","display_name":"Enhancing Security Requirements Coverage via RAG and Automated Feedback Loops","publication_year":2026,"publication_date":"2026-03-17","ids":{"openalex":"https://openalex.org/W7160423758","doi":"https://doi.org/10.1109/saner-c67878.2026.00045"},"language":null,"primary_location":{"id":"doi:10.1109/saner-c67878.2026.00045","is_oa":false,"landing_page_url":"https://doi.org/10.1109/saner-c67878.2026.00045","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135422791","display_name":"Giuseppe Sabetta","orcid":null},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giuseppe Sabetta","raw_affiliation_strings":["University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107130597","display_name":"Alfonso Cannavale","orcid":"https://orcid.org/0009-0002-0209-5974"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Alfonso Cannavale","raw_affiliation_strings":["University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135453713","display_name":"Andrea De Lucia","orcid":null},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Andrea De Lucia","raw_affiliation_strings":["University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033738898","display_name":"Fabio Palomba","orcid":"https://orcid.org/0000-0001-9337-5116"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fabio Palomba","raw_affiliation_strings":["University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Salerno,Software Engineering (SeSa) Lab,Department of Computer Science,Salerno,Italy","institution_ids":["https://openalex.org/I131729948"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I131729948"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"285","last_page":"292"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11869999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11869999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.07159999758005142,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.050999999046325684,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.34869998693466187},{"id":"https://openalex.org/keywords/control-system","display_name":"Control system","score":0.3296000063419342},{"id":"https://openalex.org/keywords/feedback-loop","display_name":"Feedback loop","score":0.2892000079154968},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.28769999742507935},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.27950000762939453}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5773000121116638},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.34869998693466187},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.3296000063419342},{"id":"https://openalex.org/C186886427","wikidata":"https://www.wikidata.org/wiki/Q5441213","display_name":"Feedback loop","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28769999742507935},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.27950000762939453},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2768999934196472},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2768000066280365},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27649998664855957},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.26980000734329224},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.2612999975681305},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2522999942302704}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/saner-c67878.2026.00045","is_oa":false,"landing_page_url":"https://doi.org/10.1109/saner-c67878.2026.00045","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W2095881341","https://openalex.org/W2131730994","https://openalex.org/W2649501556","https://openalex.org/W4241965918","https://openalex.org/W4309674289","https://openalex.org/W4386576685","https://openalex.org/W4392414327","https://openalex.org/W4401042735","https://openalex.org/W4401720547","https://openalex.org/W4402665833","https://openalex.org/W6959505596"],"related_works":[],"abstract_inverted_index":{"The":[0],"integration":[1],"of":[2,147,157],"Large":[3],"Language":[4],"Models":[5],"(LLMs)":[6],"into":[7],"Software":[8],"Engineering":[9,21],"offers":[10],"efficiency":[11],"but":[12,55],"may":[13],"also":[14],"introduce":[15],"significant":[16],"risks.":[17],"In":[18],"Security":[19],"Requirements":[20],"(SRE),":[22],"generic":[23],"LLMs":[24],"frequently":[25],"exhibit":[26],"omission":[27],"errors-failing":[28],"to":[29,118],"identify":[30],"necessary":[31,54],"security":[32,58,110,151],"constraints-and":[33],"hallucinations.":[34],"While":[35],"Retrieval-Augmented":[36],"Generation":[37],"(RAG)":[38],"mitigates":[39],"factual":[40],"errors,":[41],"standard":[42],"implementations":[43],"rely":[44],"on":[45,126],"semantic":[46],"similarity,":[47],"creating":[48],"a":[49,65,79,85,96,128,143,154,179],"bottleneck":[50],"that":[51,139],"overlooks":[52],"structurally":[53],"semantically":[56],"distinct":[57],"categories.":[59,121],"To":[60],"address":[61],"this,":[62],"we":[63],"propose":[64],"specialized":[66],"RAG":[67],"framework":[68,125],"designed":[69],"as":[70,163,178],"an":[71,114],"automated":[72],"Quality":[73],"Assurance":[74],"mechanism.":[75],"Our":[76],"approach":[77,176],"integrates":[78],"curated":[80],"OWASP":[81],"Knowledge":[82],"Base":[83],"with":[84,153],"novel":[86],"two-stage":[87],"generation":[88,117],"pipeline.":[89],"Unlike":[90],"single-shot":[91],"RAG,":[92],"our":[93,175],"system":[94],"incorporates":[95],"deterministic":[97],"threshold-based":[98],"feedback":[99],"loop:":[100],"it":[101],"statically":[102],"analyzes":[103],"the":[104,109,124,140],"initial":[105],"output's":[106],"coverage":[107],"against":[108],"taxonomy":[111],"and":[112],"triggers":[113],"adaptive":[115],"compensatory":[116],"populate":[119],"under-represented":[120],"We":[122],"evaluated":[123],"UniClass,":[127],"web":[129],"application":[130],"case":[131],"study,":[132],"across":[133,149],"repeated":[134],"executions.":[135],"Empirical":[136],"results":[137],"demonstrate":[138],"pipeline":[141],"achieves":[142],"stable":[144],"Mean":[145],"Coverage":[146],"72%":[148],"relevant":[150],"categories":[152],"high":[155],"Applicability":[156],"<tex":[158],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[159],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">$\\mathbf{8":[160],"1":[161],"\\%}$</tex>,":[162],"verified":[164],"by":[165],"one":[166],"project":[167],"developer.":[168],"By":[169],"enforcing":[170],"structural":[171],"completeness":[172],"before":[173],"implementation,":[174],"serves":[177],"critical":[180],"QA":[181],"guardrail":[182],"for":[183],"secure":[184],"AI-driven":[185],"development.":[186]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-05-07T00:00:00"}