Abstract With the rapid development of information technology, advanced persistent threats (APTs) have led to numerous serious data breaches and information system disruptions, causing immense losses to governments, businesses, and individuals. APT attack activities are usually carried out stealthily and often require analyzing large amounts of audited data, making it difficult to handle APT attacks promptly. Existing work attempts to improve the handling and detection efficiency of APT attacks based on limited audit data. However, these methods only increase the number of attack samples by finding suspicious entities through rules, ignoring the attack features contained in potential relations between entities. In this paper, we propose a potential relation prediction-based method (APMP) for APT attack detection in few-shot scenarios, which exploits potential relations to find ignored attack features. Specifically, APMP extracts the information between entities and relations in the attack sequence to train the prediction model. The prediction model can predict potential relations between entities and map them into the provenance graph. In this way, APMP complements the potential relations between entities in the provenance graph and captures the attack-related information between entities, improving the results of attack detection. We evaluate APMP using ten real-world public APT attack datasets. The average evaluation precision of APMP attack detection is 100%, with a recall rate of 93.18% and an F1-score of 96.30%. The results show that our proposal can effectively detect APT attacks in few-shot scenarios.

In agile development, user stories are used to express user requirements, which employ simple natural language sentences. As software scales grow and evolve continuously, managing user stories becomes increasingly challenging, necessitating the modeling of user stories to clarify their associated semantics. Currently, representing user stories as goal models is an effective approach. However, extracting the semantics of the goal models from user stories is a time-consuming and labor-intensive task. In particular, abstracting low-level user stories into high-level goals remains difficult and relies heavily on the expertise of requirements engineers. This paper leverages the knowledge extraction and comprehension capabilities of large language models (LLMs) to divide the goal model extraction task into two categories: explicit concept extraction and implicit concept extraction. This classification is based on direct extraction from the user story field (explicit) and extraction according to implicit semantics (implicit). A multi-strategy prompting method (MSPM) is devised, which combines prompt templates, few-shot learning, ReAct, and chain-of-thought techniques to suit explicit and implicit goal model concept extraction, ultimately generating iStar models. The experimental results show that the proposed method has an average F 1 scores of 97.9% and 92.7% for the nodes and relationships in the extraction of the goal model, and has advantages in the completeness of the extraction of the goal modeling element.

Manually extracting device knowledge from dense hardware manuals for requirements elicitation is a timeconsuming and error-prone bottleneck in embedded systems development. While Large Language Models (LLMs) offer automation potential, their direct application is unreliable for this high-precision task due to factual inaccuracies and sensitivity to prompt engineering. To address this, we propose a novel hybrid method that synergizes parameter-efficient tuning with the reasoning power of LLMs. Instead of directly tuning the LLM, our approach uses soft prompts to efficiently optimize a lightweight sentence encoder, transforming it into a domainaware semantic retriever. This specialized retriever then generates superior, context-rich prompts for a frozen LLM. Our optimization strategy features a multi-task contrastive loss to discern fine-grained semantics and a clustering-based exemplar selection process to ensure prompt diversity and relevance. On a real-world dataset of devices, our method achieves F1-scores of 87.02% for entity extraction and 77.60% for relation extraction, significantly outperforming baseline LLMs and a strong, heavyweight, domain-specific pre-trained model (EquipBERT).

Reinforcement learning-based knowledge graph reasoning requires complex logical reasoning based on given query relations. Existing methods rely exclusively on delayed reward signals to train the model to perceive the logical reasonableness of the whole reasoning path. This paradigm cannot recognize the logical reasonableness of intermediate reasoning actions, thereby limiting its performance. The logical reasonableness of the same reasoning action changes under different reasoning histories, which makes it difficult for the model to perceive the logical reasonableness of reasoning actions. This paper proposes a Dynamic Logic Alignment-based knowledge graph reasoning method (DLA). DLA dynamically combines the reasoning history and actions, and aligns its logical meaning with the query relation to assess the reasonableness of actions. Firstly, considering that actions have different logical meanings under different history paths, we design a reasoning history-aware dynamic action enhancement mechanism. The mechanism enhances the representation of the current action by injecting the logical composition of history and action at each time step. Secondly, considering that logical composition can provide the reasoning basis for the reinforcement learning agent, we design a query enhancement mechanism for logical composition alignment. The mechanism selects the action with high reasonableness by aligning the logical composition and query relation. Our method has been evaluated on five datasets of different scales, and the experimental results reveal that our method outperforms existing methods.

Online reviews allow consumers to provide detailed feedback on various aspects of items. Existing methods utilize these aspects to model users' fine-grained preferences for specific item features through graph neural networks. We argue that the performance of items on different aspects is important for making precise recommendations, which has not been taken into account by existing approaches, due to lack of data. In this paper, we propose an aspect performance-aware hypergraph neural network (APH) for the review-based recommendation, which learns the performance of items from the conflicting sentiment polarity of user reviews. Specifically, APH comprehensively models the relationships among users, items, aspects, and sentiment polarity by systematically constructing an aspect hypergraph based on user reviews. In addition, APH aggregates aspects representing users and items by employing an aspect performance-aware hypergraph aggregation method. It aggregates the sentiment polarities from multiple users by jointly considering user preferences and the semantics of their sentiments, determining the weights of sentiment polarities to infer the performance of items on various aspects. Such performances are then used as weights to aggregate neighboring aspects. Experiments on six real-world datasets demonstrate that APH improves MSE, Precision@5, and Recall@5 by an average of 2.30%, 4.89%, and 1.60% over the best baseline. The source code and data are available at https://github.com/dianziliu/APH.

Threat analysis is a pillar of security-by-design which plays an important role in the elicitation and refinement of security threats. In preparation for the analysis, a model of the system under analysis e.g., the Data Flow Diagram (DFD for short) is often created. Empirical measures of success are important for practitioners that are struggling to meet the current demands for expertise. But no previous work has investigated the role of these diagrams during the validation of identified security threats. This paper presents an experiment conducted with 98 students in two countries. We measured the impact of the DFD on the perceived and actual effectiveness of validating a list of identified security threats including both fabricated and actual threats. In presence of sequence diagrams, the participants perceived DFDs as more useful. However, when exposed to both a DFD and a sequence diagram, DFDs had no significant impact on the participants’ ability to validate security threats.

Modern software has evolved from delivering software products to web services and applications, which need to be protected by security operation centers (SOC) against ubiquitous cyber attacks. Numerous security alerts are continuously generated every day, which have to be efficiently and correctly processed to identify potential threats. Many AIOps (artificial intelligence for IT operations) approaches have been proposed to (semi-)automate the inspection of alerts so as to reduce manual effort as much as possible. However, due to the ever-complicating attacks, a significant amount of manual work is still required in practice to ensure correct analysis results. In this paper, we propose a Context-Aware cLustering approach for cLassifying sEcurity alErts (CALLEE), which fully exploits the rich relationships among alerts in order to precisely identify similar alerts, significantly reducing the workload of SOC. Specifically, we first design a core conceptual model to capture connections among security alerts, based on which we establish corresponding heterogeneous information networks. Next, we systematically design a set of meta-paths to profile typical alert scenarios precisely, contributing to obtaining the representation of security alerts. We then cluster security alerts based on their contextual similarities, considering the tradeoff between the number of clusters and the homogeneity of each cluster. Finally, security operators only need to manually inspect a limited number of alerts within each cluster, pragmatically reducing their workload while ensuring the accuracy of alert classification. To evaluate the effectiveness of our approach, we collaborate with our industrial partner and pragmatically apply the approach to a real alert dataset. The results show that our approach can reduce the workload of SOC by 99.76%, outperforming baseline approaches. In addition, we further investigate the integration of our proposal with the real business scenario of our industrial partner. The feedback from practitioners shows that CALLEE is pragmatically applicable and helpful in industrial settings.

User stories are the main artifacts maintained in agile development and play an important role in describing requirements and making development plans. Writing good user stories becomes a key part of improving agile development. However, effective storytelling requires clear communication, reduced ambiguity, and enhanced testability. How to write good user stories is a challenge for beginners. In order to increase learner immersion and improve user story writing skills, this paper explores a gamification approach. Specifically, we started by creating specifications for beginners to write good user stories. Then, the process of user story writing is broken down, the gamification elements are refined, and the gamification teaching framework Story Explorer is proposed. In a course with 64 students, we assessed learning engagement and story quality. The results showed that the quality of user stories improved by an average of 11.8%, while students demonstrated a high level of engagement. Using Story Explorer significantly increased students' motivation to write high-quality user stories and the quality of their results.

Log-based anomaly detection is crucial for software reliability assurance. System logs are semi-structured data containing constant and variable contents, both of which can provide valuable features for anomaly detection. Due to variables being heterogeneous and discrete, there is a lack of effective approaches that can comprehensively incorporate features of variables into log-based anomaly detection. In this paper, we propose VCRLog, an anomaly detection method that mines the relationships among the heterogeneous and discrete variables and extracts important features contributing to anomaly detection. Firstly, considering parsing methods cannot accurately extract variables from logs, we propose a variable extraction method based on domain knowledge. Secondly, to capture and extract the relationship feature among heterogeneous and discrete variables, we design a conceptual model based on system operation to construct variable attributed graph, which can mine important feature vectors by structural embeddings. Finally, considering constants directly express the meaning of logs, we combine relationship vectors with semantic vectors of constants to achieve transformer-based anomaly detection. Experimental results show that our proposed method can accurately detect anomalies and maintain high accuracy as the training data size decreases, outperforming existing methods. Our source code and experimental data are publicly available at https://github.com/Fridaywjy/VCRLog.

In agile software development, user stories are provided by different stakeholders, and there may be semantic conflicts between them. It takes a lot of time and manpower to identify semantic conflicts from a large number of user stories, and the identification effect is not ideal. This paper proposes a semantic conflict identifying tool. The tool mainly includes two parts: one is to identify whether there are syntax problems or ambiguity problems in each user story, and the other is to identify whether there are semantic problems between user stories. The tool combines the NLP and BERT model for improving the syntactic and semantic quality of user stories through feedback and interaction. Our preliminary results on 9060 user stories show an F1-Score of 92%. A demo video of this tool is available at https://youtu.be/EGYyI9RclRc.

Requirements-driven testing is crucial for validating functionality and maintaining software quality during the early stages of development.It is usually done manually by experienced experts, which is timeconsuming and thus affects development efficiency.Although a number of approaches have been proposed to automate the generation of test cases, they primarily rely on (semi-)formalized requirements and thus cannot be applied to user stories and other natural language-based requirements specifications that are more prevalent in practice.In this paper, we propose an incrementally refined multi-stage method that utilizes LLM to generate test cases from user stories automatically.Specifically, we design a systematic process to incrementally refine user stories and transform them into test cases in multiple stages.We compare the consistency, reasonable, testability, coverage, and time consumption of test cases generated by our method to those designed by experts and find that our proposal outperforms baseline methods in terms of all metrics, achieving 4.8 points testability and 86.36% coverage compared to the baseline's 4.5 points and 44.64%.This indicates a promising direction for improving the practicality and efficiency of test case generation from user stories.

Summary Industrial Wireless Sensor Networks (IWSNs) have gained significant popularity for their ability to improve plant productivity and production efficiency through self‐organization and rapid deployment. However, the challenge of achieving reliable and sustainable data transmission remains due to the large amount of heterogeneous data generated by large‐scale IWSNs. In this paper, we present a systematic approach that addresses this challenge by focusing on data transmission clustering strategies, optimal cluster head selection, and routing design. We propose a novel Jointly Optimized Clustering Protocol (JOCP), which enhances cluster head selection by considering multiple critical factors that impact the IWSN life cycle. JOCP incorporates two key modules: the many‐objective clustering model and the double‐layer selection evolutionary algorithm. Specifically, the many‐objective clustering model considers cluster head selection from different perspectives, including maximum node survival cycle, minimum node distance, minimum network overall energy consumption, and balanced cluster energy consumption, with the aim of extending the network life cycle. Additionally, the double‐layer selection evolutionary algorithm optimizes the many‐objective clustering model to select appropriate cluster heads. Through performance verification, we demonstrate that the JOCP protocol effectively enhances the network life cycle and increases the number of surviving nodes compared to baseline clustering algorithms. Our research provides a comprehensive solution to the challenges associated with reliable and sustainable data transmission in large‐scale IWSNs, highlighting the potential for improved performance in industrial applications.

Knowledge graphs (KGs) model entities or concepts and their relations in a structural manner. The incompleteness has turned out to be the main challenge that hinders the application of KG. Recently, reinforcement learning (RL) has been recognized as an effective method to deal with such a challenge, which models research tasks into a sequence decision problem without labels. Although an increasing number of studies investigate and analyze knowledge graphs using reinforcement learning, there lacks a systematic literature review that comprehensively and quantitatively analyzes the landscape of RL-based KG research (RL-KG for short). As a result, researchers may have encountered difficulties in appropriately adopting RL techniques in KG research, even reinventing the wheels. In this paper, we follow the Systematic Literature Review (SLR) methodology to survey, screen, and investigate papers of RL-KG. Specifically, we identify 109 highly related papers from 1542, and systematically investigate them with regard to the following five aspects: (1) to what extent RL-KG have been investigated; (2) what application domains have been covered; (3) what RL techniques have been mainly considered; (4) whether there is a connection between the influence and reproducibility of these papers; (5) what specialized datasets, evaluation metrics, and publication venues have been applied. Through an in-depth analysis of the review results, we systematically and comprehensively identify some significant phenomena and analyze the reasons and difficulties of these phenomena. Based on such analysis, we tentatively propose promising future research topics to promote the RL-KG.

Entity alignment (EA) aims to find equivalent entities in knowledge graphs (KGs) from multiple data sources and is a crucial step in integrating KGs. Recent studies learn the similarity of entity embeddings by aggregating neighboring entities. However, these methods solely compare neighboring entities and do not incorporate the connected relation between an entity and its neighbors. In this paper, we propose a novel Entity and Relation joint Interaction Learning (ERIL) approach, which effectively captures the interaction between entities and relations, enhancing the precision of alignment across different KGs. Specifically, the ERIL model jointly learns the neighborhood features of entities and the spatial structure of relations to train a shared permutation matrix, capturing comprehensive associative relations within KGs. Moreover, a semi-supervised iterative framework is designed to leverage the positive interactions between entities and relations to identify more aligned entities. Extensive experiments are conducted on five benchmark datasets to demonstrate the effectiveness of ERIL compared with existing state-of-the-art EA methods. On DBP15K, our model ERIL outperforms currently available EA methods by 1.9% on Hits@10.

The research of machine learning for requirements engineering (ML4RE) has attracted more and more attention from researchers and practitioners. Although pioneering research has shown the potential of using ML techniques to improve RE practices, there lacks a systematic and comprehensive literature review in academia that integrates an industrial perspective. Specifically, none of the reviews available in ML4RE have considered the grey literature, which is primarily from practitioner origin and is more reflective of the real issues and challenges faced in practice. In this paper, we conduct a systematic survey of academic publications in ML4RE and complement it with the practitioners’ voices from Stack Overflow to complete a comprehensive literature review. Our research objective is to provide a comprehensive view of the current research progress in ML4RE, present the main questions and challenges faced in RE practice, understand the gap between research and practice, and provide our insights into how the RE academic domain can pragmatically develop in the future. We systematically investigated 207 academic papers on ML4RE from 2010 to 2022, along with 375 questions related to RE practices on Stack Overflow and their corresponding answers. Our analysis encompassed their trends, focused RE activities and tasks, employed solutions, and associated data. Finally, we conducted a joint analysis, contrasting the outcomes of both parts. Based on the statistical results from collected literature, we summarize an academic roadmap and analyse the disparities, offering research recommendations. Our suggestions include the development of intelligent question-answering assistants employing large language models, the integration of machine learning into industrial tools, and the promotion of collaboration between academia and industry. This study contributes by providing a holistic view of ML4RE, delineating disparities between research and practice, and proposing pragmatic suggestions to bridge the academia-industry gap.

Reviews are valuable resources that have been widely researched and used to improve the quality of recommendation services. Recent methods use multiple full embedding layers to model various levels of individual preferences, increasing the risk of the data sparsity issue. Although it is a potential way to deal with this issue that models homophily among users who have similar behaviors, the existing approaches are implemented in a coarse-grained way. They calculate user similarities by considering the homophily in their global behaviors but ignore their local behaviors under a specific context. In this paper, we propose a two-tier shared embedding model (TSE), which fuses coarse- and fine-grained ways of modeling homophily. It considers global behaviors to model homophily in a coarse-grained way, and the high-level feature in the process of each user-item interaction to model homophily in a fine-grained way. TSE designs a whole-to-part principle-based process to fuse these ways in the review-based recommendation. Experiments on five real-world datasets demonstrate that TSE significantly outperforms state-of-the-art models. It outperforms the best baseline by 20.50% on the root-mean-square error (RMSE) and 23.96% on the mean absolute error (MAE), respectively. The source code is available at https://github.com/dianziliu/TSE.git.

Faced with so many mobile applications in the app store, users have difficulties finding their preferred mobile applications. Existing studies do not comprehensively consider implicit feedback in mobile applications and thus do not combine behavioral information and published information together to make recommendations. This paper proposes a novel method to recommend mobile applications based on metagraph embedding using the combination of behavioral information and published information. Specifically, this paper constructed a conceptual model using the combinations of behavioral information and published information that could well portray users and mobile applications. Based on this conceptual model, six metagraphs are designed to interpret the multidimensional relationships between users and mobile applications in the model. By random walking guided by each metagraph, a series of node sequences that could express node neighborhood are obtained. Finally, the similarity between users and apps is calculated using the embedded vector of each node, and the recommendations are given to the user. Based on a real-world dataset, we evaluate the performance of our method. The experimental result shows that our method outperforms existing models and methods in all metrics, in which the average F1-measure increases by 19.21%, and the average NDCG increases by 4.99%.

Precisely understanding and capturing runtime requirements is the basis for the success of self-adaptive systems. Runtime goal models are an effective way to represent such runtime requirements on top of traditional design-time goal models. However, due to the increasingly complex environments and unpredictable stakeholder behaviors, the runtime requirements are challenging to explore at the design time fully and are usually captured manually. In this paper, we present ongoing work on automatically mining runtime requirements from runtime user interactions. Specifically, our approach takes design-time goal models as input, which are first associated with user operation sequences. Then, we mine runtime behavior patterns from the operation sequences, shedding light on the runtime requirements. We have demonstrated our approach with a real system, which is an online data-flow diagram (DFD) modeling platform and has been used for more than three years. By applying our approach, a runtime goal model for this system has been automatically established, reasonably showing modelers' runtime requirements when modeling DFDs.

Advanced persistent threat (APT) attack leverages various intelligence-gathering techniques to obtain sensitive and critical information, imposing increasing threats to modern software enterprises. However, due to the persistent presence of APT attacks, it is difficult to effectively analyze a large amount of audit data for detecting such attacks, especially for small and medium-sized enterprises (SMEs). This limitation hinders security operation centers (SOC) from promptly handling APT attacks. In this paper, we propose an attack path-based method (APM) for APT attack detection on few-shot learning. Specifically, APM first identifies candidate malicious entities from the provenance graph, contributing to the completion of the missing attack paths. Secondly, we propose a systematic method to exploit potential attack behaviors in the attack path based on the identified candidate malicious entities. We evaluate APM through five APT attacks in realistic environments. Compared to existing baselines, the precision, recall, and F1-score of APM for attack detection increased by 0.28%, 1.64%, and 1.13%, respectively. The results show that our proposal can outperform baseline approaches and effectively detect APT attacks based on few-shot learning.

Abstract With the development of mobile networks and the rapid prevalence of location‐based social networks (LBSN), a massive volume of spatiotemporal data has been generated, which is valuable for points of interest (POI) recommendation. However, current studies have not unleashed the full power of such spatiotemporal data, which either explore only a single dimension of the data or consider multiple factors in an asynchronous fashion. In this article, we propose a novel spatiotemporal network‐based recommender framework (STNBR) to effectively recommend POIs for users. Specifically, we first establish a comprehensive conceptual model of spatiotemporal data, involving various essential factors for POIs recommendation. On top of the conceptual model, we design a series of meaningful meta‐paths that simultaneously consider the time and location factors to precisely capture the semantics of user behaviours. By profiling users based on their embedded meta‐paths, our approach can yield meaningful POIs recommendations. We have evaluated our proposal using a realistic dataset obtained from Foursquare and Gowalla, the results of which show that our STNBR model outperforms existing approaches.

Abstract Social engineering attacks are a growing threat to modern complex systems. Increasingly, attackers are exploiting people's "vulnerabilities" to carry out social engineering attacks for malicious purposes. Although such a severe threat has attracted the attention of academia and industry, it is challenging to propose a comprehensive and practical set of countermeasures to protect systems from social engineering attacks due to its interdisciplinary nature. Moreover, the existing social engineering defence research is highly dependent on manual analysis, which is time‐consuming and labour‐intensive and cannot solve practical problems efficiently and pragmatically. This paper proposes a systematic approach to generate countermeasures based on a typical social engineering attack process. Specifically, we systematically ‘attack’ each step of social engineering attacks to prevent, mitigate, or eliminate them, resulting in 62 countermeasures. We have designed a set of social engineering security patterns that encapsulate relevant security knowledge to provide practical assistance in the defence analysis of social engineering attacks. Finally, we present an automatic analysis framework for applying social engineering security patterns. We applied the case study method and performed semi‐structured interviews with nine participants to evaluate our proposal, showing that our approach effectively defended against social engineering attacks.

Consistency verification of safety requirements is crucial for the success of safety-critical systems, particularly railway systems. However, this task often requires significant time spent on interaction and communication between domain experts, who possess in-depth knowledge of safety requirements in a specific domain, and formal experts, who have the necessary skills to apply verification tools and techniques. To enhance time efficiency and productivity, we propose an approach to empower domain experts with formal methods for verifying safety requirements’ consistency. This involves transforming natural requirements into formal models and using formal methods for verification. The approach also localizes inconsistent requirements to provide feedback to domain experts. Communication between domain experts and formal experts can be facilitated through the pattern language SafeNL. By adopting this approach, domain experts can utilize formal verification without extensive consultation with formal experts. Two practical case studies with CASCO Signal Ltd. validate its effectiveness, practicality, as well as a significant reduction of time compared to traditional methods (at least 90% reduction). This reduction in time is primarily due to reduced communication needs and more efficient localization. Evaluations show that SafeNL is user-friendly and the approach performs well in modular systems while scalability is somewhat limited.

Goal modeling plays an imperative role in early requirements engineering, which has been investigated for decades. There have been many studies that show the usefulness of requirements goal models. However, the establishment of goal models is typically done manually, which is time-consuming and has a steep learning curve. In this paper, we propose a semi-automatic framework for constructing iStar models, which is a well-known goal modeling language. Specifically, we first investigate the practical needs of iStar modelers on the automation of iStar modeling by holding interviews, based on which we propose an interactive and iterative modeling process. Our proposal takes advantage of human decisions and artificial intelligence algorithms, respectively, aiming at achieving low modeling costs while maintaining the quality of models. We then propose a hybrid approach for automatically extracting goal model snippets from requirements text, which implements the automatic tasks of our proposed process. The proposed method combines logical reasoning with deep learning techniques so as to unleash the power of domain knowledge to assist with automation tasks. We have performed a series of experiments for evaluation. The experimental results show that our method achieves the F1-measure of 90.34% for actor entity extraction, 93.14% for intention entity extraction, and 83.18% for actor relation extraction, which can efficiently establish high-quality goal models. The artifacts are available at Zenodo1.

Usability requirements have been widely recognized as an essential quality requirement for systems that interact with people. However, evaluating the satisfaction of usability requirements usually involves user interactions, which is intrusive and time-consuming. In this paper, we propose a novel framework for systematically and automatically evaluating the satisfaction of usability requirements at runtime. Specifically, a behavior-centric conceptual model is proposed to comprehensively characterize user behaviors. An analysis process is then proposed based on the conceptual model, which systematically refines high-level usability requirements into observable and measurable user behaviors in order to automatically evaluate their satisfaction. Moreover, we investigate and mine patterns of user behaviors, which further explain the results of the satisfaction analysis. We systematically design and conduct a case study to evaluate our proposed framework, the results of which show that our approach is able to identify most usability issues and precisely assess the satisfaction of participants’ usability requirements. Importantly, our approach enables continuous usability requirements evaluation without interfering with users, pragmatically contributing to trade-off analysis among quality requirements at runtime.

User feedback is valuable for the continued development of the system. Most of the user feedback analyzed today is explicit, such as app reviews. However, many users are reluctant to provide this explicit feedback, which costs them extra time. In this paper, we present an ongoing study, which investigates eye movement patterns with the purpose of automatically collecting users’ implicit feedback. Specifically, we establish the semantic connection between eye movements and users’ perceptions based on cognitive and empirical evidence. Our proposed approach can thus systematically assess the satisfaction of six non-functional requirements, quietly unveiling users’ needs for the software they use. Finally, we design an evaluation plan in order for assessing the effectiveness of our approach.

iStar modeling is an effective measure for requirements analysis, and researchers have proposed nearly thirty different modeling tools for this purpose. There are two types of existing modeling tools, i.e., graphical and textual. However, either type has its limitations. Graphical modeling tools suffer from the scalability issue. Textual tools rely on visual models when modeling. To overcome the limitations, we have developed the BiStar, a template-based iStar modeling tool combining graphical and textual modeling. The two main features of our BiStar tool are as follows. First, BiStar adopts textual templates to support the batch addition of four common iStar model elements, including Actors, Intentions, Dependencies, and Refinements. Second, BiStar supports the templated creation of iStar models using text models. In addition, BiStar has full support for graphical iStar modeling as a basic feature of a modeling tool. BiStar automatically visualizes the model elements and templates added in the text as described above. After visualization, modelers can freely choose between graphical and textual modeling to continue modeling. Our BiStar tool thus combines graphical modeling with textual modeling.

iStar modeling is beneficial in the early stage of requirements engineering, helping requirements analysts to analyze requirements and improve the efficiency and quality of the software development procedure. However, it is time-consuming and hard to learn to perform the iStar modeling manually, which can be more practical if the modeling process is automated.To facilitate the distribution of iStar practices, we designed a user-friendly semi-automatic iStar modeling approach to assist users in iStar modeling by extracting model elements from natural language requirement artifacts. Specifically, based on the analysis of the actual modeling process via interviewing, this work proposed an iStar modeling process, and automated three modeling steps: the actor entity extraction, the actor relation extraction, and the intention entity extraction. Then, this work proposes a hybrid method for natural language processing to extract the model elements in requirement sentences to automate the modeling steps. This hybrid method consists of two parts: the deep learning-based method and the logical reasoning method, which utilizes both methods simultaneously, ensuring the high accuracy of the results. Overall, this work proposed a user-friendly semi-automatic approach for aiding the iStar modeling, which proposes an iStar modeling process and automates many steps with hybrid natural language method during the process. We evaluated our proposed approach, and the results show that our proposed approach is efficient and helpful.

Recently, efforts have been made to explore introducing music content into deep learning-based music recommendation systems.In previous research, with reference to tasks such as speech recognition, music content is often fed into recommendation models as low-level audio features, such as the Mel-frequency cepstral coefficients.However, unlike tasks such as speech recognition, the audio of music often contains multiple sound sources.Hence, low-level time-domain-based or frequencydomain-based audio features may not represent the music content properly, limiting the recommendation algorithm's performance.To address this problem, we propose a music recommendation model based on chord progressions and attention mechanisms.In this model, music content is represented as chord progressions rather than low-level audio features.The model integrates user song interactions and chord sequences of music and uses an attention mechanism to differentiate the importance of different parts of the song.In this model, to make better use of the historical behavioral information of users, we refer to the design of the neural collaborative filtering algorithm to obtain embedding of users and songs.Under this basis, we designed a chord attention layer to mine users' fine-grained preferences for different parts of the music content.We conducted experiments with a subset of the last.fm-1bdataset.The experimental results demonstrate the effectiveness of the method proposed in this paper.

As network techniques rapidly evolve, attacks are becoming increasingly sophisticated and threatening. Network intrusion detection has been widely accepted as an effective method to deal with network threats. Many approaches have been proposed, exploring different techniques and targeting different types of traffic. Anomaly-based network intrusion detection is an important research and development direction of intrusion detection. Despite the extensive investigation of anomaly-based network intrusion detection techniques, there lacks a systematic literature review of recent techniques and datasets. We follow the methodology of systematic literature review to survey and study 119 top-cited papers on anomaly-based intrusion detection. Our study rigorously and comprehensively investigates the technical landscape of the field in order to facilitate subsequent research within this field. Specifically, our investigation is conducted from the following perspectives: application domains, data preprocessing and attack-detection techniques, evaluation metrics, coauthor relationships, and datasets. Based on the research results, we identify unsolved research challenges and unstudied research topics from each perspective, respectively. Finally, we present several promising high-impact future research directions.

Music content has recently been identified as useful information to promote the performance of music recommendations. Existing studies usually feed low-level audio features, such as the Mel-frequency cepstral coefficients, into deep learning models for music recommendations. However, such features cannot well characterize music audios, which often contain multiple sound sources. In this paper, we propose to model and fuse chord, melody, and rhythm features to meaningfully characterize the music so as to improve the music recommendation. Specially, we use two user-based attention mechanisms to differentiate the importance of different parts of audio features and chord features. In addition, a Long Short-Term Memory layer is used to capture the sequence characteristics. Those features are fused by a multilayer perceptron and then used to make recommendations. We conducted experiments with a subset of the last.fm-1b dataset. The experimental results show that our proposal outperforms the best baseline by [Formula: see text] on HR@10.

[Context] Establishing requirements models is an effective way to analyze them, which is typically dealt with in a graphical manner (i.e., the drag-and-draw fashion). However, as the size of models increases, the scalability issue has become an unignorable challenge, hindering the practical adoption of requirements modeling approach. Some researchers have recently proposed and promoted textual modeling approaches, mitigating these issues of requirements modeling. [Objective] In this paper, we aim at evaluating the two modeling methods, i.e., a graphical modeling method VS. a textual modeling method. In particular, we apply these two methods to iStar modeling language, which has been widely recognized as an effective means to model and analyze requirements. [Methods] We have systematically designed and conducted a controlled experiment with 38 participants to compare two iStar modeling methods (graphical and textual) using two corresponding modeling tools (piStar and T-Star). The experimental results reveal that the numbers of iStar model nodes and relationships built by the participants had no significant difference, regardless of the modeling method adopted. [Conclusions] First, the results show that the textual modeling method is as usable as the graphical modeling method when creating iStar models. Second, we have identified a number of issues that contribute to improving the utility and practicality of the iStar modeling method.

With the fast growth of system complexity, it is increasingly difficult to comprehensively analyze security of such large-scale systems, which is a knowledge-intensive task. Although there are various available security knowledge sources, they are not well-connected with each other due to their heterogeneity and unstructured descriptions. In this paper, we propose a systematic approach to construct a comprehensive and reusable knowledge graph in the field of information security. Specifically, we first investigate heterogeneous security knowledge sources and establish a detailed ontology of information security, integrating various security conceptual models. Then, we train a security entity identifier based on active learning to extract security knowledge from unstructured descriptions. Such extracted knowledge is then fused to establish a comprehensive and reusable security knowledge graph based on the unified ontology. Finally, we illustrate the utility of our established knowledge graph with a set of exemplary queries and reasoning rules in the context of a real security scenario.

In recent years, there have been numerous cyber security issues that have caused considerable damage to the society. The development of efficient and reliable Intrusion Detection Systems (IDSs) is an effective countermeasure against the growing cyber threats. In modern high-bandwidth, large-scale network environments, traditional IDSs suffer from a high rate of missed and false alarms. Researchers have introduced machine learning techniques into intrusion detection with good results. However, due to the scarcity of attack data, such methods’ training sets are usually unbalanced, affecting the analysis performance. In this paper, we survey and analyze the design principles and shortcomings of existing oversampling methods. Based on the findings, we take the perspective of imbalance and high dimensionality of datasets in the field of intrusion detection and propose an oversampling technique based on Generative Adversarial Networks (GAN) and feature selection. Specifically, we model the complex high-dimensional distribution of attacks based on Gradient Penalty Wasserstein GAN (WGAN-GP) to generate additional attack samples. We then select a subset of features representing the entire dataset based on analysis of variance, ultimately generating a rebalanced low-dimensional dataset for machine learning training. To evaluate the effectiveness of our proposal, we conducted experiments based on the NSL-KDD, UNSW-NB15, and CICIDS-2017 datasets. The experimental results show that our method can effectively improve the detection performance of machine learning models and outperform the baselines.

Urban rail transit stations are the key nodes of urban rail transit network. Identifying and analyzing land use characteristics around urban rail transit stations can significantly contribute to urban rail transportation operation and management. Therefore, a visualization method of land use characteristics around urban rail transit stations based on POI is proposed in this paper. In the proposed method, first, the Voronoi diagram is used to determine coverage of urban rail transit stations and each POI is put in a coverage area based on their physical location. Then, topic-oriented hierarchical POIs of each urban rail transit station are extracted based on skyline idea. Finally, the land use characteristics around an urban rail transit station are visualized based on the extracted hierarchical POIs. We carried out two case studies and a quality evaluation. By using realistic data from Beijing rail transit in order to validate the method proposed in this paper. Results show that our method can clarify various situations of land use of urban rail transit stations and may provide support for the application of transportation model technology.

Processing application user reviews has recently been recognized as an efficient approach to explore user requirements. However, most existing approaches focus on mining the reviews themselves without effectively associating the reviews with requirements concepts, limiting the effectiveness of review mining for requirements analysis tasks. In this paper, we propose to automatically identify Requirements-oriented Reviews (RoRs) from software application reviews by considering requirements specific domain knowledge and syntactic information of user reviews. Specifically, we first define a conceptual model of RoRs based on existing requirements ontology and user review categories, establishing connections between the concepts of requirements engineering and user reviews. We then systematically identify the textual features of RoRs by following a conceptual model-driven top-down strategy. Based on such features, we then train effective RoR classifiers to identify RoRs. To evaluate the performance of our approach, we have applied our approach to a real dataset of mobile application reviews, the results of which show that our approach can effectively identify RoRs with an F-measure of 0.8, outperforming than the baselines.

In recent years, the amount of user check-in data has significantly increased on social network platforms. Such data is an ideal source for characterizing user behaviors and identifying similar users, contributing to many research areas (e.g. user-based collaborative filtering). However, existing trajectory-based user similarity analysis approaches do not distinguish the effects of geographical factors at a fine-grained level, and thus are not able to unleash the full power of semantic information that is hidden in the trajectory. In this paper, we have proposed an effective graph embedding approach to identify similar users based on their check-in data. Specifically, we firstly identify meaningful concepts of user check-in data, based on which we design two metagraphs for representing features of similar user behaviors. Then we characterize each user with a sequence of nodes that are derived through a metagraph-guided random walk strategy. Such sequences are embedded to generate meaningful user vectors for measuring user similarity and eventually identifying similar users. We have evaluated our proposal on three public datasets, the results of which show that our approach is 4% higher than the best existing approach in terms of F1-measure.

Although academia has recognized the importance of explicitly specifying security requirements in early stages of system developments for years, in reality, many projects mix security requirements with other types of requirements. Thus, there is a strong need for precisely and efficiently classifying such security requirements from other requirements in requirement specifications. Existing studies leverage lexical evidence to build probabilistic classifiers, which are domain-dependent by design and cannot effectively classify security requirements from different application domains. In this paper, we propose an ontology-driven learning approach to automatically classify security requirements. Our approach consists of a conceptual layer and a linguistic layer, which understands security requirements based on not only lexical evidence but also conceptual domain knowledge. In particular, we apply a systematic approach to identify linguistic features of security requirements based on an extended security requirements ontology and linguistic knowledge, connecting the conceptual layer with the linguistic layer. Such linguistic features are then used to train domain-independent security requirements classifiers by using machine learning techniques. We have carried out a series of experiments to evaluate the performance and generalization ability of our proposal against existing approaches. The results of the experiments show that the proposed approach outperforms existing approaches with a significant increase of F1 score (0.63 VS. 0.44) when the training dataset and the testing dataset come from different application domains, i.e., the classifiers trained by our approach can be generalized to classify security requirements from different domains.

With the development of society and economy, the urban rail transit has become one of the important components of urban transportation system, while the construction of the urban rail greatly improves the public transportation environments. Currently, there are many research focus on the passenger flow predictions according to their corresponding historical data, however, it is hard to assist transport models vary such volumes for a new station planning or being constructed. In view of this limitation, we provide a novel method for urban rail station characteristics analysis in intelligent transportation considering city land usages. Initially, point of interest (POIs) are divided by the proposed RC-tree (Colored R-tree)-based algorithm into the bounded areas for each station. Second, the Diversity and Proportion approaches are proposed to extract the top-k POIs from bounded areas based on their semantic and spatial characteristics. Then, classify the stations based on the similarity of the extracted top-k POIs. Moreover, we made a case study on real dataset, including a large volume of Automatic Fare Collection system (AFC) records for the experimental evaluations, and the results show that the proposed method can verify the rationality of land use and provide support for the application of transportation model technology.

Continuously maintaining software requirements traceability links is essential for managing and evolving software systems. Due to development pressure, traceability links are usually missing during the early development phase in practice, and thus many information retrieval-based approaches have been proposed to automatically recover the traceability links. However, such approaches typically calculate textual similarities among software artifacts without considering specific features of different software artifacts, leading to less accurate results. In this paper, we propose a hybrid approach to recover requirements traceability links, which combines machine learning and logical reasoning to explore features of use cases and code. On one hand, our approach engineers features of use cases and code by taking into account their semantics, based on which a classifier is trained by using supervised learning algorithms. On the other hand, we investigate and leverage the structural information of code to incrementally discover traceability links by defining a list of reasoning rules. We have carried out a series of experiments to compare our approach with state-of-the-art methods, the results of which show that our approach significantly outperforms others.

Eliciting precise user preferences and establishing a comprehensive user profile significantly contribute to personalized recommendations from numerous applications. However, existing methods do not adequately establish critical relationships at the knowledge level. In this paper, we argue that precisely processing applications' user feedback is essential for understanding user requirements and making application recommendations. Therefore, we first establish an ontological model of user feedback, guiding the generation of a knowledge graph regarding user reviews and user ratings. In particular, we augment the graph with topics of each review and application in order to deal with the sparsity of user feedback. Moreover, we explore in-depth knowledge from the graph by identifying three meaningful meta-paths, which are essential for calculating user similarity and thus making recommendations. Specifically, we propose a feedback-based similarity calculation model FSCM, with the purpose of predicting applications that are of interests of certain users. We have evaluated our model over 1386 reviews from a mobile application store, the results of which show that our approach can improve the prediction accuracy, as well as to enhance the interpretability of analysis results.

Social engineering attacks have drawn more and more attention from both academia and industry, due to the serious threats they pose to information security via exploitation of human vulnerabilities. Unlike technology-based attacks, which have been investigated for decades, there is no efficient security requirements analysis approach for dealing with social engineering attacks. One major obstacle to this problem is the uncertainty of human behavior, making it difficult to effectively assess social engineering attacks. In this paper, we investigate the nature of social engineering attacks and identify their essential factors. Based on such findings, we formulate the problem of social engineering attack assessment, which can be quantitatively calculated using probabilistic model checking. Finally, we present a research agenda that details critical research directions and discusses corresponding challenges.

Consistency verification of safety requirements is an important but still challenging task for safety-critical systems such as rail transit systems. That is mainly because requirements are typically written in natural language and with strong time constraints. Driven by the practical need from industry, in this paper we propose a systematic approach to specify safety requirements in a quasi-natural language and automatically verify their consistency using formal methods. Specifically, we define a domain specific language SafeNL to specify safety requirements, and then automatically transform them into formal constraints defined in the Clock Constraint Specification Language (CCSL). The transformed constraints can be automatically and efficiently verified by model checking. We conduct two practical case studies to analyze the safety requirements of an interlocking system in CASCO Signal Ltd. Results of the studies show the validity and utility of our approach can pragmatically contribute to industrial practice. We also report some lessons learned from case studies.

Protecting people from cyber threats imposes great challenges, not only technically, but also socially. To achieve the intended level of awareness, software security principles need to be shown with concrete examples during security education. This study aims to design a serious game integrating software security knowledge and concepts into the processes to make it more engaging to learn while playing. In this paper, we have: (i) designed a serious game to compensate the deficiencies in the literature; (ii) performed empirical evaluations including survey, brainstorming and observation to the proposed game. Results: Our study shows that: (i) Cyber Security‐Requirements Awareness Game (CSRAG) has a positive effect on players security learning outcomes, level of engagement and participation; (ii) Game‐based learning can be an effective way of teaching security related scenarios.

Over the last two decades, much attention has been paid to the area of goal-oriented requirements engineering (GORE), where goals are used as a useful conceptualization to elicit, model, and analyze requirements, capturing alternatives and conflicts. Goal modeling has been adapted and applied to many sub-topics within requirements engineering (RE) and beyond, such as agent orientation, aspect orientation, business intelligence, model-driven development, and security. Despite extensive efforts in this field, the RE community lacks a recent, general systematic literature review of the area. In this work, we present a systematic mapping study, covering the 246 top-cited GORE-related conference and journal papers, according to Scopus. Our literature map addresses several research questions: we classify the types of papers (e.g., proposals, formalizations, meta-studies), look at the presence of evaluation, the topics covered (e.g., security, agents, scenarios), frameworks used, venues, citations, author networks, and overall publication numbers. For most questions, we evaluate trends over time. Our findings show a proliferation of papers with new ideas and few citations, with a small number of authors and papers dominating citations; however, there is a slight rise in papers which build upon past work (implementations, integrations, and extensions). We see a rise in papers concerning adaptation/variability/evolution and a slight rise in case studies. Overall, interest in GORE has increased. We use our analysis results to make recommendations concerning future GORE research and make our data publicly available.

Security has been a growing concern for large organizations, especially financial and governmental institutions, as security breaches in the systems they depend on have repeatedly resulted in billions of dollars in losses per year, and this cost is on the rise. A primary reason for these breaches is that the systems in question are socio-technical - a mix of people, processes, technology and infrastructure. However, such systems are designed in a piecemeal rather than a holistic fashion, leaving parts of the system vulnerable. To tackle this problem, a three-realm security requirements framework was proposed to holistically analyse security requirements in different conceptual realms, including social realm (business processes, social actors), a software realm (software applications that support the social realm) and an infrastructure realm (physical and technological infrastructure). In this paper we evaluate this security requirements analysis framework. The evaluation was performed by two graduate students using a large scale case study on a medical emergency response system.

Discovering potential attacks on a system is an essential step in engineering secure systems, as the identified attacks will determine essential security requirements. The prevalence of Socio-Technical Systems (STSs) makes attack analysis particularly challenging. These systems are composed of people and organizations, their software systems, as well as physical infrastructures. As such, a thorough attack analysis needs to consider strategic (social and organizational) aspects of the involved people and organizations, as well as technical aspects affecting software systems and the physical infrastructure, requiring a large amount of security knowledge which is difficult to acquire. In this paper, we propose a systematic approach to efficiently leverage a comprehensive attack knowledge repository (CAPEC) in order to identify realistic and detailed attack behaviors, avoiding severe repercussions of security breaches. In particular, we propose a systematic method to model CAPEC attack patterns, which has been applied to 102 patterns, in order to semi-automatically select and apply such patterns. Using the CAPEC patterns as part of a systematic and tool-supported process, we can efficiently operationalize attack strategies and identify realistic alternative attacks on an STS. We validate our proposal by performing a case study on a smart grid scenario.

Over the last two decades, much attention has been paid to the area of Goal-Oriented Requirements Engineering(GORE), where goals are used as a useful conceptualization to elicit, model and analyze requirements, capturing alternatives and conflicts. Goal modeling has been adapted and applied to many sub-topics within RE and beyond, such as agent-orientation, aspect-orientation, business intelligence, model-driven development, security, and so on. Despite extensive efforts in this field, the RE community lacks a recent, general systematic literature review of the area. As a first step towards providing a GORE overview, we present a Systematic Literature Map, focusing on GORE-related publications at a high-level, categorizing and analyzing paper information in order to answer several research questions, while omitting a detailed analysis of individual paper quality. Our Literature Map covers the 246 top-cited GORE-related conference and journal papers, according to Scopus, classifying them into a number of descriptive paper types and topics, providing an analysis of the data, which is made publicly available. We use our analysis results to make recommendations concerning future GORE research.

The ever-growing complexity of systems makes their protection more challenging, as a single vulnerability or exposure of any component of the system can lead to serious security breaches. This problem is exacerbated by the fact that the system development community has not kept up with advances in attack knowledge. In this demo paper, we propose a holistic attack analysis approach to identify and tackle both atomic and multistage attacks, taking into account not only software attacks but also attacks that are targeted at people and hardware. To bridge the knowledge gap between attackers and defenders, we systematically analyze and refine the malicious desires of attackers (i.e., anti-goals), and leverage a comprehensive attack pattern repository (CAPEC) to operationalize attacker goals into concrete attack actions. Based on the results of our attack analysis, appropriate security controls can be selected to effectively tackle potential attacks.

Creating and reasoning with goal models is useful for capturing, understanding, and communicating about requirements in the early stages of information system (re)development. However, the utility of goal models is greatly enhanced when an awareness of system intentions can feed into other stages in the requirements analysis process (e.g. requirements elaboration, validation, planning), and can be used as part of the entire system life cycle (e.g., architecture, process design, coding, testing, monitoring, adaptation, and evolution). In order to understand the progress that has been made in integrating goal models with downstream system development, we ask: what approaches exist which map/integrate/transform goal-oriented languages to other software artifacts or languages? To answer this question, we conduct a systematic survey, producing a roadmap of work summarizing 174 publications. Results include a categorization of the “why?” and “how?” for each approach. Findings show that there are a wide variety of proposals with many proposed sources and targets, covering multiple paradigms, motivated by a variety of purposes. We conclude that although much work has been done in this area, the work is fragmented and is often still in a proposal stage.

Various governmental or academic institutes survey current security trends, and report vulnerabilities, security breaches, and their costs. However, it is unclear whether (and how) practitioners analyze these vulnerabilities and attacks to arrive at security requirements and decide on security solutions. What modeling methods are used for eliciting, analyzing, and documenting security requirements in real-world practice? This paper intends to answer such questions through a survey of security requirements engineering practices. 374 software professionals from 237 International and Chinese firms participated in the survey. The results show businesses often try to consider security from early stages of the development life cycle, however, ultimately, security is left to be built into the system at the implementation phase. We observed that practitioners favour qualitative risk assessment rather than quantitative approaches, and this helps them consider more varieties of factors when comparing alternative security design solutions.

Requirements engineering has gained growing attention in both academia and industry, as today’s software intensive systems are expected to provide highly user-centric functions and qualities. Thus, it is important to understand under what situations existing requirements engineering practice is not working well. Continuing our probe into the industrial practices status quo, this paper reports the results from a recent survey of requirements practices in China in 2009. The web-based survey of requirements engineering practices focuses on requirements elicitation techniques, requirements representation techniques. Although purporting to report on the state-of-the-art of requirements engineering in China, it is likely to portray the state-of-the-art of RE worldwide as well.