{"id":"https://openalex.org/W4411449751","doi":"https://doi.org/10.1145/3729347","title":"Incorporating Verification Standards for Security Requirements Generation from Functional Specifications","display_name":"Incorporating Verification Standards for Security Requirements Generation from Functional Specifications","publication_year":2025,"publication_date":"2025-06-19","ids":{"openalex":"https://openalex.org/W4411449751","doi":"https://doi.org/10.1145/3729347"},"language":"en","primary_location":{"id":"doi:10.1145/3729347","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729347","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3729347","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111296074","display_name":"Xiaoli Lian","orcid":"https://orcid.org/0000-0002-6100-7068"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoli Lian","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-6100-7068","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021796709","display_name":"Shuaisong Wang","orcid":"https://orcid.org/0009-0009-2033-7026"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuaisong Wang","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0009-2033-7026","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hanyu Zou","orcid":"https://orcid.org/0009-0007-2943-0433"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hanyu Zou","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0007-2943-0433","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060027879","display_name":"Fang Liu","orcid":"https://orcid.org/0000-0002-3905-8133"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fang Liu","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-3905-8133","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jiajun Wu","orcid":"https://orcid.org/0009-0004-0640-7386"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiajun Wu","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0004-0640-7386","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5114585361","display_name":"Li Zhang","orcid":"https://orcid.org/0000-0002-2258-5893"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li Zhang","raw_affiliation_strings":["Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2258-5893","affiliations":[{"raw_affiliation_string":"Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I82880672"],"apc_list":null,"apc_paid":null,"fwci":7.7475,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.97001131,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"2","issue":"FSE","first_page":"1710","last_page":"1732"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7581892013549805},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.6174664497375488},{"id":"https://openalex.org/keywords/security-testing","display_name":"Security testing","score":0.5739902257919312},{"id":"https://openalex.org/keywords/security-engineering","display_name":"Security engineering","score":0.5200445652008057},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5039152503013611},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.4916689991950989},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.491102933883667},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4451931416988373},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.43786388635635376},{"id":"https://openalex.org/keywords/computer-security-model","display_name":"Computer security model","score":0.4336380660533905},{"id":"https://openalex.org/keywords/bridge","display_name":"Bridge (graph theory)","score":0.4219886064529419},{"id":"https://openalex.org/keywords/functional-requirement","display_name":"Functional requirement","score":0.41486412286758423},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.2969092130661011},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.2739291489124298},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.2573782801628113},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.23284104466438293}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7581892013549805},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.6174664497375488},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.5739902257919312},{"id":"https://openalex.org/C13159133","wikidata":"https://www.wikidata.org/wiki/Q365674","display_name":"Security engineering","level":5,"score":0.5200445652008057},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5039152503013611},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.4916689991950989},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.491102933883667},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4451931416988373},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43786388635635376},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.4336380660533905},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.4219886064529419},{"id":"https://openalex.org/C62235348","wikidata":"https://www.wikidata.org/wiki/Q3264234","display_name":"Functional requirement","level":2,"score":0.41486412286758423},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.2969092130661011},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.2739291489124298},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2573782801628113},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.23284104466438293},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C126322002","wikidata":"https://www.wikidata.org/wiki/Q11180","display_name":"Internal medicine","level":1,"score":0.0},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3729347","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729347","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2505.11857","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.11857","pdf_url":"https://arxiv.org/pdf/2505.11857","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3729347","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729347","pdf_url":null,"source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Decent work and economic growth","score":0.5899999737739563,"id":"https://metadata.un.org/sdg/8"}],"awards":[{"id":"https://openalex.org/G7371131028","display_name":null,"funder_award_id":"62177003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1800478330","https://openalex.org/W1981028474","https://openalex.org/W1995875735","https://openalex.org/W2007469712","https://openalex.org/W2043628395","https://openalex.org/W2106326663","https://openalex.org/W2121764468","https://openalex.org/W2129289644","https://openalex.org/W2129580698","https://openalex.org/W2132628704","https://openalex.org/W2146863076","https://openalex.org/W2172046358","https://openalex.org/W2327037637","https://openalex.org/W2518473846","https://openalex.org/W2742200672","https://openalex.org/W2755375180","https://openalex.org/W2792900179","https://openalex.org/W2904558120","https://openalex.org/W2973814803","https://openalex.org/W2994326685","https://openalex.org/W3045153201","https://openalex.org/W3108928658","https://openalex.org/W3153864189","https://openalex.org/W3163146719","https://openalex.org/W3217305727","https://openalex.org/W4220840599","https://openalex.org/W4221057363","https://openalex.org/W4239258498","https://openalex.org/W4239371203","https://openalex.org/W4247037059","https://openalex.org/W4251742697","https://openalex.org/W4252946368","https://openalex.org/W4253600484","https://openalex.org/W4285162211","https://openalex.org/W4312991327","https://openalex.org/W4317243139","https://openalex.org/W4384345822","https://openalex.org/W4384347367","https://openalex.org/W4387143055","https://openalex.org/W4387145988","https://openalex.org/W4389520322","https://openalex.org/W4409055770"],"related_works":["https://openalex.org/W4230385779","https://openalex.org/W1811024770","https://openalex.org/W4206910357","https://openalex.org/W2017116761","https://openalex.org/W2013238834","https://openalex.org/W2412133583","https://openalex.org/W2542633692","https://openalex.org/W1976635772","https://openalex.org/W1963623648","https://openalex.org/W2018644264"],"abstract_inverted_index":{"In":[0],"the":[1,13,50,82,92,134,191,204],"current":[2],"software-driven":[3],"era,":[4],"ensuring":[5],"privacy":[6],"and":[7,25,46,56,136,175],"security":[8,16,34,75,86,180,185],"is":[9,20],"critical.":[10],"Despite":[11],"this,":[12],"specification":[14],"of":[15,84,118,139,206],"requirements":[17,39,76,88],"for":[18,178],"software":[19,57],"still":[21],"largely":[22],"a":[23,41,110,115],"manual":[24],"labor-intensive":[26],"process.":[27],"Engineers":[28],"are":[29,144,194],"tasked":[30],"with":[31,203],"analyzing":[32],"potential":[33],"threats":[35],"based":[36],"on":[37,114],"functional":[38,79],"(FRs),":[40],"procedure":[42],"prone":[43],"to":[44,49,123,146],"omissions":[45],"errors":[47],"due":[48],"expertise":[51],"gap":[52],"between":[53],"cybersecurity":[54],"experts":[55],"engineers.":[58,207],"To":[59],"bridge":[60],"this":[61],"gap,":[62],"we":[63,108,188],"introduce":[64],"F2SRD":[65,101],"(Function-to-Security":[66],"Requirements":[67],"Derivation),":[68],"an":[69],"automated":[70],"approach":[71],"that":[72,150,170,190],"proactively":[73],"derives":[74],"(SRs)":[77],"from":[78,91,128],"specifications":[80],"under":[81],"guidance":[83],"relevant":[85],"verification":[87,186],"(VRs)":[89],"drawn":[90],"well":[93],"recognized":[94],"OWASP":[95],"Application":[96],"Security":[97],"Verification":[98],"Standard":[99],"(ASVS).":[100],"operates":[102],"in":[103,153,167,172],"two":[104,160],"main":[105],"phases:":[106],"Initially,":[107],"develop":[109],"VR":[111],"retriever":[112],"trained":[113],"custom":[116],"database":[117],"FR-VR":[119],"pairs,":[120],"enabling":[121],"it":[122],"adeptly":[124],"select":[125],"applicable":[126],"VRs":[127,143],"ASVS.":[129],"This":[130],"targeted":[131],"retrieval":[132],"informs":[133],"precise":[135],"actionable":[137],"formulation":[138],"SRs.":[140,155],"Subsequently,":[141],"these":[142],"used":[145],"construct":[147],"structured":[148],"prompts":[149],"direct":[151],"GPT-4":[152],"generating":[154],"Our":[156],"comparative":[157],"analysis":[158],"against":[159],"established":[161],"models":[162],"demonstrates":[163],"F2SRD's":[164],"enhanced":[165],"performance":[166],"producing":[168],"SRs":[169,193],"excel":[171],"inspiration,":[173],"diversity,":[174],"specificity\u2014essential":[176],"attributes":[177],"effective":[179],"requirement":[181],"generation.":[182],"By":[183],"leveraging":[184],"standards,":[187],"believe":[189],"generated":[192],"not":[195],"only":[196],"more":[197],"focused":[198],"but":[199],"also":[200],"resonate":[201],"stronger":[202],"needs":[205]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2025-10-10T00:00:00"}