C2/C3: Security-Relevance Classifier and Security-Requirements Retrieval Pipeline for Product Backlogs
Abstract
Code and model artifacts for contributions C2 and C3 of: Ignacio García N., Florian Angermeir, Fabiola Moyón C. "From Backlog Items to Security Guidance: Towards Continuous Security Compliance." 41st IEEE/ACM International Conference on Automated Software Engineering (ASE 2026), Industry Showcase. C2 is a recall-oriented binary classifier that flags security-relevant product backlog items: a frozen MPNet sentence encoder (all-mpnet-base-v2) with an elastic-net logistic-regression head, trained on the C1 dataset (F2 = 0.774 on the held-out split; mean zero-shot G-measure ≈ 0.65 on the Wu et al. benchmarks). The pre-trained deployment model is included. C3 is a four-stage retrieval-augmented generation pipeline (LLM requirement extraction → bi-encoder recall → cross-encoder reranking → LLM semantic filter) that maps a flagged backlog item to applicable clauses of a security requirements document. The package ships a CIS Benchmarks PDF segmenter and index builder so the full pipeline can be reproduced against any CIS Benchmark; the segmenter for company-internal policies is not included due to confidentiality agreements. The package contains the source code (Python, FastAPI REST service, Dockerfile), the evaluation notebooks reproducing the paper's C2 results, the pre-trained model, and the C1-derived train/test splits. The code is released under MIT. The included C1-derived data (dataset and splits) is CC BY 4.0, with item texts derived from the TAWOS dataset (Tawosi et al.,…
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.