Validating Security Requirement Specifications through the use of a Knowledge Graph

Turning a customer's product vision into implementable requirement specifications is notoriously difficult and time-consuming. Beyond that, security is an aspect of requirement specifications that is frequently underdeveloped. If developers had access to an automated system that could validate requirement specifications based on known loopholes and external expertise, the likelihood of injecting a security vulnerability into a software product would decrease. As depicted in this paper, the automated system takes a Software Requirement Specification (SRS) document as input. The system then potentially validates that all related security topics and vulnerabilities are covered within the security requirement specifications. Entity linking is used to parse the SRS to form queries for a security concepts and vulnerabilities knowledge graph. The query result can provide developers with areas of security to be considered as updates to the SRS and to help during the software design stage to improve the system's security.