Automated risk identification using NLP in cloud based development environments

Abstract

In typical software development practice, the risk assessment is not being done in an integrated manner along with the SDLC life cycle. Mostly, risk assessment is a reactive process carried out either during the deployment process or during the evaluation of software for business. Humans are involved in the risk assessment process which is time consuming, error prone and expensive. The risks identified is also not immediately reflected upon the various people in the software development value chain. This causes the churning rate to find or alleviate risks in the future. In typical SDLC, risks may be developed while coding and it may be evident and would takes different shape as different version of the software gets updated over a period of time. Security aspects of the software solution depends on the code which needs to be consistently tracked on a continuous basis to monitor changes and its related risks, without which vulnerabilities and weakness identification will be reactive. It is always essential to identify risks based on the experience from others that is where the use of risk assessment frameworks would be handy along with vulnerability and weakness database such as common weakness enumeration, common vulnerability enumeration and Exploit DB. In this paper, NLP is implemented using deep learning techniques. This paper addresses the need for automated risk assessments with the help of NLP to auto identify the risks on the analysis of weakness and vulnerabilities.