数据流图与大语言模型在安全威胁验证中的实用性：一项注册报告
Usefulness of data flow diagrams and large language models for security threat validation: a registered report
AI总结：
针对安全威胁验证缺乏完成定义、分析效率低的问题，本研究设计对照实验探究不同分析材料对威胁验证的效果，结合预实验发现优化设计并提供初始复现包。
摘要：
最新网络安全标准的出台提高了组织安全评估的门槛，但现有技术的可扩展性往往不佳。威胁分析与风险评估用于识别新建或重构系统的安全威胁，然而目前缺乏“完成定义”，因此已识别的威胁必须经过验证，这拖慢了分析进程。现有文献多聚焦于威胁分析的整体性能，但此前尚无研究探讨分析人员需要深入研究材料到何种程度，才能有效验证已识别的安全威胁。我们提出一项由从业者参与的对照实验，旨在探究拥有部分分析材料（如大语言模型（LLM）生成的建议）是否优于无材料，以及拥有更多材料（系统数据流图加LLM生成的建议）是否优于仅有部分材料。此外，我们展示了由41名硕士研究生参与的预实验的关键发现，这些发现用于优化研究设计。最后，我们还提供了初始复现包，其中包含实验材料与数据分析脚本，并计划在最终从业者数据收集工作完成后扩展该复现包，加入新材料（如预筛选问题）。
英文摘要：
The arrival of recent cybersecurity standards has raised the bar for security assessments in organizations, but existing techniques don't always scale well. Threat analysis and risk assessment are used to identify security threats for new or refactored systems. Still, there is a lack of definition-of-done, so identified threats have to be validated which slows down the analysis. Existing literature has focused on the overall performance of threat analysis, but no previous work has investigated how deep must the analysts dig into the material before they can effectively validate the identified security threats. We propose a controlled experiment with practitioners to investigate whether some analysis material (like LLM-generated advice) is better than none and whether more material (the system's data flow diagram and LLM-generated advice) is better than some material. In addition, we present key findings from running a pilot with 41 MSc students, which are used to improve the study design. Finally, we also provide an initial replication package, including experimental material and data analysis scripts and a plan to extend it to include new materials based on the final data collection campaign with practitioners (e.g., pre-screening questions).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
