Thousands of issues.

Which ones are about security?

Security requirements get buried in the backlog.

Teams often don’t focus on security early in development.

Issues open · sorted by newest
Introducing
SecureReqNet
Reads an issue. Flags it if it’s about security.
01Learn the language
02Read with a CNN

Learn the words.

Word embeddings, learned without labels from three corpora:

52,908CVE vulnerability descriptions
53,214GitLab and GitHub issues
10,000Wikipedia articles
WORD EMBEDDINGS · ILLUSTRATIVE

Read in windows.

Convolutional kernels slide across the issue’s words in 7-, 5-, and 3-word windows. A softmax makes the call.

ISSUE · NATURAL LANGUAGE ONLY
#4182
sessiontokenstaysvalidafterpasswordresetonlogout
7-gram
5-gram
3-gram
SECURITY-RELATEDSECURITY-RELATED
NOT SECURITY
0%
accuracy on 1,032 unseen open-source issues
71.6%accuracy on 69 industrial requirements from Cisco
Trained on the pastEvery test issue was created after all training issues.

Learning to Identify Security-Related Issues Using Convolutional Neural Networks

David N. Palacio · Daniel McCrystal · Kevin Moran · Carlos Bernal-Cárdenas · Denys Poshyvanyk · Chris Shenefiel
ICSME 2019 · IEEE International Conference on Software Maintenance and Evolution