Thu 4 Sep 2025 16:30 - 16:50 at Room 1.1 - Privacy and Security Chair(s): Tobias Hey

Research shows that analysts and developers consider privacy as an afterthought, which may lead to non-compliance and violation of user’s privacy. Most current approaches, however, focus on extracting legal requirements from the regulations and evaluating the compliance of software and processes with them. In this paper, we develop a novel approach based on chain-of-thought prompting (CoT), in-context-learning (ICL), and Large Language Models (LLMs) to extract privacy behaviors from various software documentation prior to software development and then generate privacy requirements in the format of user stories. Our results show most commonly used LMs, such as GPT-4o and Llama 3, can identify privacy behaviors, and generate privacy user stories with F1 scores exceeding 0.8. We also show that the performance of these models could be improved through parameter tuning. Our findings provide insight into using and optimizing LMs for generating privacy requirements given software documentation created prior to or throughout the software development lifecycle.

Thu 4 Sep

Displayed time zone: Brussels, Copenhagen, Madrid, Paris change

16:00 - 17:30
Privacy and SecurityRE@Next! Papers / Research Papers at Room 1.1
Chair(s): Tobias Hey Karlsruhe Institute of Technology (KIT)
16:00
30m
Paper
LLM-assisted Extraction of Regulatory Requirements: A Case Study on the GDPR
Research Papers
Sallam Abualhaija University of Luxembourg, Marcello Ceci University of Luxembourg, Nicolas Sannier University of Luxembourg, SnT, Domenico Bianculli University of Luxembourg, Salomé Lannier , Martina Siclari University of Luxembourg, Olivier Voordeckers University of Luxembourg, Stanisław Tosza University of Luxembourg
16:30
20m
Paper
Generating Privacy Stories From Software Documentation
RE@Next! Papers
16:50
20m
Paper
Recommending Security Requirements through Asset Identification and Threat Mapping
RE@Next! Papers
Sugandha Malviya Ball State University, André Fonteles Ball State University, Angeles Marin Batana Ball State University, Alec Burch-DeWitt Ball State University
17:10
20m
Paper
Satisfying Complex Data Security Requirements in Digital Business Ecosystems
RE@Next! Papers
Yulu Wang Vrije Universiteit Amsterdam, Charlotte van der Velden , Sabine Oechsner Vrije Universiteit Amsterdam, Jaap Gordijn Vrije Universiteit Amsterdam