# Explainable Security Requirements Classification Through Transformer Models
## 1 Introduction  
Security requirements are the criteria or constraints that a system, application, or process must meet to protect its data, resources, and users. In addition, the nature of the system and the sensitivity of the data it processes may further determine a specific security requirement. However, the most considerable intent of these requirements is to minimize risks and vulnerabilities that could lead to unauthorized access, data breaches, or any other security-related incident. Non-security requirements, on the other hand, specify what functional and performance criteria the system should meet to accomplish its stated functional goals. They can include requirements about usability, scalability, reliability, and conformity with industry standards. While non-security aspects are essential for the system's overall effectiveness and user satisfaction, they must be balanced wisely with the security features while designing a robust and resilient architecture. In contrast, non-security requirements address the functional and performance specifications a system must meet to achieve its intended objectives successfully. Some examples of such requirements include usability, scalability, reliability, or conformity with industry-specific standards. Of course, the non-security requirements must be balanced with security considerations in order to developrobust and resilient architecture. This becomes very important as organizations navigate through the complexities of modern-day technology and understand the interplay between security and non-security requirements, as well as develop comprehensive strategies that address protection from potential threats and enhance operational effectiveness and user satisfaction [1]. It is crucial to distinguish between security and non-security requirements among various software specifications. The ability to classify the latter is essential because it is helpful in the recollection of any security requirements in the earlier stages of development, resulting in better security in the final software solution [2]. Additionally, precise classification aids in resource allocation, enabling teams to dedicate appropriate attention and expertise to security and non-security aspects, thereby enhancing the overall quality and reliability of the software. However, the latter are typically articulated in natural language, and this form of representation suffers from some problems [3]. First, requirements can be incomplete, meaning they might not detail all those vital components of the system or project; this incompleteness could lead to ambiguities about what the system can conduct or the project's scope. Second, requirements can be inconsistent. That is, the different parts of the requirement may, in fact, conflict with each other; hence, the meaning is not clear and is misinterpreted. Another common problem is redundancy. Some requirements repeat the same information, making the document unnecessarily long and increasing the risk of inconsistency. Lastly, requirements can be vague; ambiguous requirements cannot provide a clear understanding and may be interpreted differently by different stakeholders, which may cause misconceptions, resulting in possible gaps in the intended system or project outcome. To address these challenges, we propose a novel method for automatically classifying software requirements into security and non-security categories using transformer models. Our approach focuses on the shortcomings of the operational requirements analysis stage, employing transformer models to make the security requirements better focused and reasonably increase the security measures in software development by understanding language context and semantics. These models' use is beneficial in this regard, thanks to their capabilities in Artificial Intelligence [4; 5; 6] and with particular regard to many Natural Language Processing (NLP) tasks [7; 8; 9].