###### Abstract  
As the world becomes digitized and connected, cyberattacks and security issues have been steadily increasing. In particular, advanced persistent threats (APTs) are actors who perform various complex attacks over the long term to achieve their purpose. These attacks involve more planning and intelligence than typical cyberattacks. Many studies have investigated APT detection and defense methods; however, studies on security requirements that focus on non-technical factors and prevention are relatively few. Therefore, this study aims to provide attack information to users obtained by analyzing attack scenarios as well as security requirements to help the users understand and make decisions. To this end, we propose a method for extracting attack elements by providing users with templates for attack scenarios with different levels of abstraction. In addition, we use a problem domain ontology that is based on the concept of a case to provide users with attack analysis results and recommended security requirements. Our method uses case-based reasoning to retrieve similar cases, recommend reusable security requirements, and propose revision directions. The ontology can be improved by adding the solution to the problem as a new case. We conducted case studies and surveys to evaluate our methods and showed that they help specify security requirements.  
advanced persistent threat; security requirement; problem domain ontology; case-based reasoning; artificial intelligence; recommendation system +
Footnote †: journal: _Applied_  
needed. However, the requirement specification process is time-consuming and expensive, and hence a method to efficiently derive security requirements is needed. Second, APTs also utilize social engineering elements, and there is no structure for analysis structures that includes non-technical elements. As mentioned before, most research focusing on technical solutions considers attack methods and mechanisms but does not consider non-system factors such as attack targets, attack goals, and security policies. Therefore, this study proposes a method to recommend security requirements by building an integrated knowledge base called the case-based problem domain ontology (CB-PDO) to address this problem. To recommend security requirements, we define all elements associated with APT characteristics in the APT component and analyze their relationships to build a knowledge base that is integrated into one abstract level. Furthermore, to derive recommended specifications, we use a case-based reasoning (CBR) method, which is a classical artificial intelligence technique that imitates human problem solving by solving new problems based on previous similar cases. We retain past problems that have already been solved, using them as \"cases\" to solve current problems, and continuously accumulate a knowledge base to represent learning. We used two methods to evaluate the proposed method: first, we conducted a case study to evaluate whether the proposed method met our research objectives. Second, we performed security expert verification and validation to evaluate whether our research was practically effective and helpful. Each quality was evaluated using a questionnaire. The results show that the proposed method effectively recommends security requirements to security experts. Furthermore, we show that our method can become a more sophisticated recommendation system with the continuous accumulation of cases.  
The remainder of this paper is organized as follows: Section 2 describes related work on APT attack analysis, security, and CBR. Our proposed method is presented in Section 3, and the verification and evaluation results are presented in Section 4. Finally, the conclusions, limitations, and future work are presented in Section 5.