Abstract:The rapid development of intelligent connected vehicles has increased the attack surface of vehicles and made the complexity of vehicle systems unprecedented. Original equipment manufacturers (OEMs) need to accurately represent and identify threats and match corresponding security requirements. Meanwhile, the fast iteration cycle of modern vehicles requires development engineers to quickly obtain cybersecurity requirements for new features in their developed systems in order to develop system code that meets cybersecurity requirements. However, existing threat identification and cybersecurity requirement methods in the automotive domain cannot accurately describe and identify threats for a new feature while also quickly matching appropriate cybersecurity requirements. This article proposes a cybersecurity requirements management system (CRMS) framework to assist OEM security experts in conducting comprehensive automated threat analysis and risk assessment and to help development engineers identify security requirements prior to software development. The proposed CRMS framework enables development engineers to quickly model their systems using the UML-based (i.e., capable of describing systems using UML) Eclipse Modeling Framework and security experts to integrate their security experience into a threat library and security requirement library expressed in Alloy formal language. In order to ensure accurate matching between the two, a middleware communication framework called the component channel messaging and interface (CCMI) framework, specifically designed for the automotive domain, is proposed. The CCMI communication framework enables the fast model of development engineers to match with the formal model of security experts for threat and security requirement matching, achieving accurate and automated threat and risk identification and security requirement matching. To validate our work, we conducted experiments on the proposed framework and compared the results with the HEAVENS approach. The results showed that the proposed framework is superior in terms of threat detection rates and coverage rates of security requirements. Moreover, it also saves analysis time for large and complex systems, and the cost-saving effect becomes more pronounced with increasing system complexity.

A Linear Classifier Based Approach for Identifying Security Requirements in Open Source Software Development

A Practical Approach to the Automatic Classification of Security-Relevant Commits

LLM-Enhanced Static Analysis for Precise Identification of Vulnerable OSS Versions

Supporting secure programming in web applications through interactive static analysis.

Detection of Software Security Weaknesses Using Cross-Language Source Code Representation (CLaSCoRe)

Group Feature Selection Via Structural Sparse Logistic Regression for IDS

LLM-Assisted Static Analysis for Detecting Security Vulnerabilities

Causative Insights into Open Source Software Security using Large Language Code Embeddings and Semantic Vulnerability Graph

A Business Process-based Method on Security Requirement Analysis of Information Systems

Machine Learning Based Approach to Recommend MITRE ATT&CK Framework for Software Requirements and Design Specifications

FESR: A Framework for Eliciting Security Requirements Based on Integration of Common Criteria and Weakness Detection Formal Model

Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysis

Tracing requirements in software design

Learning to Identify Security-Related Issues Using Convolutional Neural Networks

Advancements in Automated Code Scanning Techniques for Detecting Security Vulnerabilities in Open Source Software

Automated software vulnerability detection with machine learning

Automatically Classifying User Requests in Crowdsourcing Requirements Engineering

Improving software security with static automated code analysis in an industry setting

Security Defect Detection via Code Review: A Study of the OpenStack and Qt Communities

A Framework for Cybersecurity Requirements Management in the Automotive Domain