A Survey of Security Assessment Ontologies <s> Introduction <s> paper, we introduce a knowledge-oriented approach for the Security Requirements Engineering phase for developing E-Voting System. The knowledge acquired through the process of eliciting and analyzing secure E-Voting System is represented in the form of UML models; which can be made available to future developers and the dependency towards security experts can be reduced. In this paper we present a set of security requirements and security requirements patterns that were developed based on the aforementioned approach. Security requirements for modelling have been identified by following the Model Oriented Security Requirements Engineering framework for web applications. The security requirements have been designed into security requirements patterns for creating security requirements ontology for an E- Voting System. The ontology allows all concepts of importance and their relationships to be identified. The paper also compares the approach with other relevant methods in the Security Requirements Engineering phase for developing secure applications. <s> BIB001 </s> A Survey of Security Assessment Ontologies <s> Introduction <s> Security is an increasingly important quality facet in modern information systems and needs to be retained. Due to a constantly changing environment, long-living software sys- tems "age" not by wearing out, but by failing to keep up-to- date with their environment. The problem is that requirements engineers usually do not have a complete overview of the security- related knowledge necessary to retain security of long-living software systems. This includes security standards, principles and guidelines as well as reported security incidents. In this paper, we focus on the identification of known vulnerabilities (and their variations) in natural-language requirements by leveraging security knowledge. For this purpose, we present an integrative security knowledge model and a heuristic method to detect vulnerabilities in requirements based on reported security in- cidents. To support knowledge evolution, we further propose a method based on natural language analysis to refine and to adapt security knowledge. Our evaluation indicates that the proposed assessment approach detects vulnerable requirements more reliable than other methods (Bayes, SVM, k-NN). Thus, requirements engineers can react faster and more effectively to a changing environment that has an impact on the desired security level of the information system. Index Terms—Security requirements, Heuristics, Requirements analysis, Software evolution, Knowledge carrying software <s> BIB002
Security defects, whose corrections are already known, continue to be introduced in new systems or exist in systems in operation, just waiting to be activated. On the other hand, it is not easy to detect and fix unknown security problems systematically. Activities to test the security of information systems often rely heavily on knowledge and experience of professionals involved in these activities   BIB001 BIB002    . Main research directions in Security Assessment and efforts aimed at formalizing the conceptual domain should be uncovered. A literature review is the tool to enable us to identify research issues, contributions, characteristics and objectives of these efforts. Analysis of the selected works is as important as the literature review itself; the foundational concepts of the domain and their relationships must be uncovered. Domain knowledge is necessary to formalize research in a systematic way. The knowledge available in the literature supporting security assessment is not structured enough. Approaches based on a conceptual formalization, properly built into the information security context, can provide a better support for security assessment. Ontologies can be used as a vocabulary, a dictionary or a roadmap of the Information Security domain. Furthermore, an ontology can be used to reason (provide inferences) about relationships between entities  . Hence, our main objective is to search for initiatives aimed at formalizing concepts from the "Security Assessment" fields of research, by means of ontologies.