Abstract Socio-technical systems (STS) are inherently complex due to the heterogeneity of its intertwined components. Therefore, ensuring STS security continues to pose significant challenges. Persistent security issues in STS are extremely critical to address as threats to security can affect entire enterprises, resulting in significant recovery costs. A profound understanding of the problems across multiple dimensions of STS is the key in addressing such security issues. However, we lack a systematic acquisition of the scattered knowledge related to design, development, and execution of STS. In this work, we methodologically analyze security issues from a requirements engineering perspective. We propose a cognitive three-layered framework integrating various modeling methodologies and knowledge sources related to security. This framework helps in understanding essential components of security and making recommendations of security requirements regarding threat analyses and risk assessments using Problem Domain Ontology (PDO) knowledge base. We also provide tool support for our framework. With the goal-oriented security reference model, we demonstrate how security requirements are recommended based on PDO, with the help of the tool. The organized acquisition of knowledge from SME groups and the domain working group provides rich context of security requirements, and also enhances the re-usability of the knowledge set.

中文翻译：

---

从问题域本体理解和推荐安全需求：认知三层方法

摘要 社会技术系统 (STS) 由于其相互交织的组件的异质性而具有内在的复杂性。因此，确保 STS 安全继续构成重大挑战。STS 中持续存在的安全问题非常重要，因为安全威胁会影响整个企业，从而导致巨大的恢复成本。深入了解 STS 多个维度的问题是解决此类安全问题的关键。然而，我们缺乏对 STS 的设计、开发和执行相关的零散知识的系统获取。在这项工作中，我们从需求工程的角度对安全问题进行了方法论分析。我们提出了一个认知三层框架，集成了与安全相关的各种建模方法和知识源。该框架有助于理解安全的基本组成部分，并使用问题域本体 (PDO) 知识库提出有关威胁分析和风险评估的安全要求建议。我们还为我们的框架提供工具支持。通过面向目标的安全参考模型，我们展示了如何借助该工具基于 PDO 推荐安全需求。从 SME 组和领域工作组那里有组织地获取知识提供了丰富的安全需求上下文，也增强了知识集的可重用性。通过面向目标的安全参考模型，我们展示了如何借助该工具基于 PDO 推荐安全需求。从 SME 组和领域工作组那里有组织地获取知识提供了丰富的安全需求上下文，也增强了知识集的可重用性。通过面向目标的安全参考模型，我们展示了如何借助该工具基于 PDO 推荐安全需求。从 SME 组和领域工作组那里有组织地获取知识提供了丰富的安全需求上下文，也增强了知识集的可重用性。