Security Requirements Classification into Groups Using NLP Transformers

Abstract

This study presents an implementation of sentencelevel classification of security requirements into predefined groups. The method of this paper suggests using three models: BERT, XLNET, and DistilBERT for classification task and figures out evaluation metrics such as precision, recall, and F1-score. We compiled a new dataset of 1086 security requirements of 7 classes collected from multiple existing datasets, such as PURE, SecReq and Riaz's dataset. The best-achieved result is DistilBERT’s 78% F1-score on the multiclass classification task. The main contribution of this study is the new multiclass dataset of security requirements and an example of how a deep transformer model can be used for requirements elicitation, which can be used as a basis for further improvement.