一句话：利用自然语言处理对配置项描述进行分类，辅助安全专家识别安全相关设置。
论文关注安全相关配置设置的识别问题：为保障计算基础设施安全，必须配置所有安全相关项，但人工识别依赖安全专家，耗时且昂贵。作者提出使用当前自然语言处理技术，根据配置设置的描述文本训练分类器，自动判断其是否与安全相关。评估表明，训练出的分类器性能尚不足以完全替代人类安全专家，但能够帮助专家更高效地完成分类。作者还发布了标注数据集和已训练模型的代码，以促进配置安全分析和后续研究。
To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.
@inproceedings{paperbot7215,
title = {Automated Identification of Security-Relevant Configuration Settings Using NLP},
author = {Patrick Stöckle and Theresa Wasserer and Bernd Grobauer and Alexander Pretschner},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3559499}
}