Artificial intelligence based security requirements identification and testing
The proposed systems and methods apply natural language processing to identify implicit security requirements flowing from input text narratively describing desired features for a software project. These systems and methods can identify hidden security requirements that may not be readily apparent from the features described in the input text. For example, a story may include a feature of a return URL (Uniform Resource Locator), which is the URL for the website to which a user will be redirected. A security vulnerability that would not be obvious from this feature is that a user might be directed to an attacker controlled site instead of the originally intended site. A security requirement that could counteract this vulnerability would be to include the feature of verifying all redirects go to Whitelisted Sites. The proposed systems and methods provide a framework for automated security requirements analysis capable of identifying unstated security requirements early on in a software development lifecycle using artificial intelligence techniques.
1. A method for identification of security requirements, the method comprising:
retrieving, from a user story data repository and at a first time, user story data for a first user story;
separating each individual word in the user story data to create a first word list;
identifying, using natural language processing, whether each individual word in the first word list is a functional word;
creating a regular expression (regex) for each individual word identified in the first word list as the functional word to produce a first functional word regex list comprising a first plurality of functional word regexes;
determining which functional word regexes in the first functional word regex list have one or more corresponding security requirements in a key functional words mapping database, wherein the one or more corresponding security requirements indicate requirements of security to protect assets associated with the user story data from internet attacks to the assets;
forming the one or more corresponding security requirements into a first list of security requirements;
linking at least a first security requirement of the first list of security requirements with the first user story in a user stories already assessed database; and
automatically generating and displaying a first report that identifies the first security requirement together with the first user story.
2. The method of claim 1 , further comprising:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, mapping the first security requirement to the first user story in a security requirements duplicate dictionary;
determining a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determining that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary, refraining from mapping the second security requirement to the first user story a second time.
3. The method of claim 1 , further comprising:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, mapping the first security requirement to the first user story in a security requirements duplicate dictionary;
determining a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determining that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary, mapping the second security requirement to the first user story in the user stories already assessed database and updating the security requirements duplicate dictionary.
4. The method of claim 1 , further comprising:
automatically inputting, in response to generating the first report, the first report into the user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieving, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separating each individual word in the updated user story data to create a second word list;
identifying, using natural language processing, whether each individual word in the second word list is the functional word;
creating a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determining that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically referring to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had not been previously linked to the first user story, automatically generating and displaying a second report that identifies the second security requirement together with the first user story.
5. The method of claim 1 , further comprising:
automatically inputting, in response to generating the first report, the first report into a user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieving, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separating each individual word in the updated user story data to create a second word list;
identifying, using natural language processing, whether each individual word in the second word list is the functional word;
creating a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determining that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically referring to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had not been previously linked to the first user story, automatically generating and displaying a second report that identifies the second security requirement together with the first user story only once.
6. The method of claim 1 , further comprising:
retrieving, from an automated testing playbook repository, a first automated testing playbook associated with the first security requirement;
automatically performing a first test based on the first automated testing playbook; and
automatically generating and displaying a second report that identifies results of the first test.
7. The method of claim 6 , further comprising:
identifying, during the first test, a first issue; and
automatically executing, based on a plurality of healing actions included in the first automated testing playbook, a first healing action to resolve the first issue.
8. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to:
retrieve, from a user story data repository and at a first time, user story data for a first user story;
separate each individual word in the user story data to create a first word list;
identify, using natural language processing, whether each individual word in the first word list is a functional word;
create a regular expression (regex) for each individual word identified in the first word list as the functional word to produce a first functional word regex list comprising a first plurality of functional word regexes;
determine which functional word regexes in the first functional word regex list have one or more corresponding security requirements in a key functional words mapping database, wherein the one or more corresponding security requirements indicate requirements of security to protect assets associated with the user story data from internet attacks to the assets;
form the one or more corresponding security requirements into a first list of security requirements;
link at least a first security requirement of the first list of security requirements with the first user story in a user stories already assessed database; and
automatically generate and display a first report that identifies the first security requirement together with the first user story.
9. The non-transitory computer-readable medium storing software of claim 8 , wherein the instructions further cause the one or more computers to:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, map the first security requirement to the first user story in a security requirements duplicate dictionary;
determine a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determine that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary, refrain from mapping the second security requirement to the first user story a second time.
10. The non-transitory computer-readable medium storing software of claim 8 , wherein the instructions further cause the one or more computers to:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, map the first security requirement to the first user story in a security requirements duplicate dictionary;
determine a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determine that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary, map the second security requirement to the first user story in the user stories already assessed database and updating the security requirements duplicate dictionary.
11. The non-transitory computer-readable medium storing software of claim 8 , wherein the instructions further cause the one or more computers to:
automatically input, in response to generating the first report, the first report into the user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieve, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separate each individual word in the updated user story data to create a second word list;
identify, using natural language processing, whether each individual word in the second word list is the functional word;
create a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determine that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically refer to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had not been previously linked to the first user story, automatically generate and display a second report that identifies the second security requirement together with the first user story.
12. The non-transitory computer-readable medium storing software of claim 8 , wherein the instructions further cause the one or more computers to:
automatically input, in response to generating the first report, the first report into a user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieve, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separate each individual word in the updated user story data to create a second word list;
identify, using natural language processing, whether each individual word in the second word list is the functional word;
create a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determine that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically refer to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had been previously linked to the first user story, automatically generate and display a second report that identifies the second security requirement together with the first user story only once.
13. The non-transitory computer-readable medium storing software of claim 8 , wherein the instructions further cause the one or more computers to:
retrieve, from an automated testing playbook repository, a first automated testing playbook associated with the first security requirement;
automatically perform a first test based on the first automated testing playbook; and
automatically generate and display a second report that identifies results of the first test.
14. The non-transitory computer-readable medium storing software of claim 13 , wherein the instructions further cause the one or more computers to:
identify, during the first test, a first issue; and
automatically execute, based on a plurality of healing actions included in the first automated testing playbook, a first healing action to resolve the first issue.
15. A system for identification of security requirements, the system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to:
retrieve, from a user story data repository and at a first time, user story data for a first user story;
separate each individual word in the user story data to create a first word list;
identify, using natural language processing, whether each individual word in the first word list is a functional word;
create a regular expression (regex) for each individual word identified in the first word list as the functional word to produce a first functional word regex list comprising a first plurality of functional word regexes;
determine which functional word regexes in the first functional word regex list have one or more corresponding security requirements in a key functional words mapping database, wherein the one or more corresponding security requirements indicate requirements of security to protect assets associated with the user story data from internet attacks to the assets;
form the one or more corresponding security requirements into a first list of security requirements;
link at least a first security requirement of the first list of security requirements with the first user story in a user stories already assessed database; and
automatically generate and display a first report that identifies the first security requirement together with the first user story.
16. The system of claim 15 , wherein the instructions further cause the one or more computers to:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, map the first security requirement to the first user story in a security requirements duplicate dictionary;
determine a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determine that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is already mapped to the first user story in the security requirements duplicate dictionary, refrain from mapping the second security requirement to the first user story a second time.
17. The system of claim 15 , wherein the instructions further cause the one or more computers to:
in response to linking at least the first security requirement of the first list of security requirements with the first user story in the user stories already assessed database, map the first security requirement to the first user story in a security requirements duplicate dictionary;
determine a second functional word regex of the first functional word regex list is associated with a second security requirement in the key functional words mapping database;
determine that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary; and
in response to determining that the second security requirement is not mapped to the first user story in the security requirements duplicate dictionary, map the second security requirement to the first user story in the user stories already assessed database and updating the security requirements duplicate dictionary.
18. The system of claim 15 , wherein the instructions further cause the one or more computers to:
automatically input, in response to generating the first report, the first report into the user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieve, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separate each individual word in the updated user story data to create a second word list;
identify, using natural language processing, whether each individual word in the second word list is a functional word;
create a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determine that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically refer to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had not been previously linked to the first user story, automatically generate and display a second report that identifies the second security requirement together with the first user story.
19. The system of claim 15 , wherein the instructions further cause the one or more computers to:
automatically input, in response to generating the first report, the first report into a user stories already assessed database, wherein a security requirements duplicate dictionary is based on data stored in the user stories already assessed database;
retrieve, from the user story data repository and at a second time subsequent to the first time, updated user story data for the first user story;
separate each individual word in the updated user story data to create a second word list;
identify, using natural language processing, whether each individual word in the second word list is the functional word;
create a regex for each individual word identified in the second word list as the functional word to produce a second functional word regex list comprising a second plurality of functional word regexes;
determine that a first functional word regex in the second functional word regex list corresponds to a second security requirement in the key functional words mapping database;
automatically refer to the security requirements duplicate dictionary to determine whether the second security requirement had been previously linked to the first user story; and
in response to determining that the first security requirement had been previously linked to the first user story, automatically generate and display a second report that identifies the second security requirement together with the first user story only once.
20. The system of claim 15 , wherein the instructions further cause the one or more computers to:
retrieve, from an automated testing playbook repository, a first automated testing playbook associated with the first security requirement;
automatically perform a first test based on the first automated testing playbook; and
automatically generate and display a second report that identifies results of the first test.