一句话：提出基于 NLP 的 backlog 丰富系统，检测安全相关条目并链接安全需求，以支持持续安全合规。
在受监管领域，工程团队需在整个开发生命周期中满足安全要求，但从简短、自由形式的 backlog 条目中推断安全相关性并及时获取适用要求仍很困难。本文提出一种基于 NLP 的 backlog 丰富系统，将安全相关性分类器与面向安全需求文档的检索增强生成（RAG）流水线结合，用于检测安全相关 backlog 条目并链接到相关安全需求。作者在大型企业的高受监管场景中开发并评估该方法，给出三项贡献：发布由九名安全实践者标注的 288 条 backlog 数据集，标注者间一致性较高（Fleiss’ κ=0.787）；召回导向分类器在分布内达到 F2=0.774，在五个基准上的零样本平均 G-measure 约为 0.65，匹配或优于多数已发表的经典机器学习与开源 GPT 基线；初步评估四阶段 RAG 流水线，在工业 backlog 与公司内部安全策略及 CIS Benchmarks 上检索到的 24 条条款中有 12 条相关性评分至少为 4/5。结果显示，NLP 驱动的 backlog 丰富有望帮助工程师在开发早期识别安全需求。
Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a retrieval-augmented generation (RAG) pipeline over security requirements documents. The approach was developed and evaluated in the context of a large enterprise in highly regulated domains. We present three contributions. First, we release a dataset of 288 backlog items labeled for security relevance by nine security practitioners, with substantial agreement (Fleiss’ κ=0.787). Second, a recall-oriented classifier achieving F2=0.774 in-distribution and mean zero-shot G-measure ≈ 0.65 across five established benchmarks, matching or outperforming most published classical-ML and open-source GPT baselines. Third, we preliminarily evaluated a four-stage security requirements document-grounded RAG pipeline with two practitioners on industrial backlogs using company-internal security policies and CIS Benchmarks. Of the retrieved 24 clauses, 12 were rated at least 4/5 for relevance. Our findings provide first indicators that NLP-based product backlog enrichment can support engineers in identifying security requirements early in the development process. With this work we aim to facilitate continuous security compliance through proactive introduction of security requirements in continuous software engineering.
@inproceedings{abs-2607-27374,
title = {From Backlog Items to Security Guidance: Towards Continuous Security Compliance},
author = {Ignacio García Núñez and Florian Angermeir and Fabiola Moyón Constante},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834527}
}