Building problem domain ontology from security requirements in regulatory documents

  • Authors:

  • Seok-Won Lee;Robin Gandhi;Divya Muthurajan;Deepak Yavagal;Gail-Joon Ahn

  • Affiliations:

  • The University of North Carolina at Charlotte, Charlotte, NC;The University of North Carolina at Charlotte, Charlotte, NC;The University of North Carolina at Charlotte, Charlotte, NC;The University of North Carolina at Charlotte, Charlotte, NC;The University of North Carolina at Charlotte, Charlotte, NC

  • Venue:
  • Proceedings of the 2006 international workshop on Software engineering for secure systems
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Establishing secure systems assurance based on Certification and Accreditation (C&A) activities, requires effective ways to understand the enforced security requirements, gather relevant evidences, perceive related risks in the operational environment, and reveal their causal relationships with other domain concepts. However, C&A security requirements are expressed in multiple regulatory documents with complex interdependencies at different levels of abstractions that often result in subjective interpretations and non-standard implementations. Their non-functional nature imposes complex constraints on the emergent behavior of software-intensive systems, making them hard to understand, predict, and control. To address these issues, we present novel techniques from software requirements engineering and knowledge engineering for systematically extracting, modeling, and analyzing security requirements and related concepts from multiple C&A-enforced regulatory documents. We employ advanced ontological engineering processes as our primary modeling technique to represent complex and diverse characteristics of C&A security requirements and related domain knowledge. We apply our methodology to build problem domain ontology from regulatory documents enforced by the Department of Defense Information Technology Security Certification and Accreditation Process (DITSCAP).