Fuzzy-based security requirements quality assessing: Comparison of security experts and generative AI

Abstract

Software systems that store and process large volumes of data are prime targets for increasingly sophisticated cyberattacks. Software engineers recognise that developing software completely free of defects or vulnerabilities is practically impossible, which makes security a critical quality characteristic of software products that must be addressed from the earliest stages of requirements engineering to avoid data loss, software failure, and ensure effective maintenance. Today, secure software engineering promotes proactive risk analysis, systematically identifying potential threats and integrating appropriate countermeasures into the requirements and development process. This paper presents an empirical investigation of security requirements engineering methodologies that integrate the experience of security experts and generative AI capabilities into the security requirements engineering (SRE) process. The empirical investigation results show that SRE based on Generative Artificial Intelligence (GenAI) capabilities still does not achieve the security expert's experience in specifying security requirements, while ensuring the quality of requirement specification based on security risks. We hope that our results will inspire researchers and practitioners to further explore the improvement of security requirements specifications using generative AI and fuzzy logic for SRE.