PAPS：一个可扩展的安全需求优先级和部分选择框架
PAPS: A Scalable Framework for Prioritization and Partial Selection of Security Requirements
摘要：
由于资源的限制，现有的优先级和选择技术的软件安全需求（对策）找到一个子集的高优先级的安全需求忽略低优先级的需求或推迟到未来的版本。然而，忽略或推迟安全需求，一方面可能会使一些安全威胁（漏洞）无人关注，另一方面会影响依赖于被忽略或推迟的需求的其他安全需求。为解决这一问题，我们建议在可以容忍的情况下考虑部分满足安全要求，而不是无视这些要求或将其推迟到未来。在这样做的过程中，我们提出了一个基于目标的框架，该框架能够根据安全目标对安全要求进行优先排序和部分选择。建议的框架有助于减少被忽视（推迟）的安全需求的数量，从而减少忽视软件产品中的安全需求的不利影响。
英文摘要：
Owing to resource constraints, the existing prioritization and selection techniques for software security requirements (countermeasures) find a subset of higher-priority security requirements ignoring lower-priority requirements or postponing them to the future releases. Ignoring or postponing security requirements however, may on one hand leave some of the security threats (vulnerabilities) unattended and on the other hand influence other security requirements that rely on the ignored or postponed requirements. To address this, we have proposed considering partial satisfaction of security requirements when tolerated rather than ignoring those requirements or postponing them to the future. In doing so, we have contributed a goal-based framework that enables prioritization and partial selection of security requirements with respect to security goals. The proposed framework helps reduce the number of ignored (postponed) security requirements and consequently reduce the adverse impacts of ignoring security requirements in software products.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
