---
abstract: |
    Privacy has been frequently identified as a main concern for system developers while dealing with/managing personal information. Despite this, most existing work on privacy requirements deals with them as a special case of security requirements. Therefore, key aspects of privacy are, usually, overlooked. In this context, wrong design decisions might be made due to insufficient understanding of privacy concerns. In this paper, we address this problem with a systematic literature review whose main purpose is to identify the main concepts/relations for capturing privacy requirements. In addition, the identified concepts/relations are further analyzed to propose a novel privacy ontology to be used by software engineers when dealing with privacy requirements.

    Keywords {#keywords .unnumbered}
    ========

    Privacy Ontology, Privacy Requirements, Privacy by Design (PbD), Requirements Engineering
author:
- Mohamad Gharib
- Paolo Giorgini
- John Mylopoulos
title: 'Ontologies for Privacy Requirements Engineering: A Systematic Literature Review'
---

Introduction
============

Increasing numbers of today’s systems deal with personal information (e.g., information about citizens, customers, etc.), where such information is protected by privacy laws [@gharibre2016]. Therefore, privacy has become a main concern for system designers. In other words, dealing with privacy related concerns is a must these days because privacy breaches may result in huge costs as well as a long-term consequences [@acquisti2006there; @gellman2002privacy; @hong2004privacy; @camp2002designing; @campbell2003economic]. Privacy breaches might be due lack of appropriate security policies, bad security practices, attacks, data thefts, etc. [@acquisti2006there; @labda2014modeling]. However, most of these breaches can be avoided if privacy requirements of the system-to-be were captured properly during system design (e.g., Privacy by Design (PbD)) [@cavoukian2009privacy; @cavoukian2011privacy; @labda2014modeling], where privacy requirements aim to capture the types and levels of protection necessary to meet the privacy needs of the users.

Nevertheless, just few works focused on considering privacy during the system design [@Gurses2011]. More specifically, most existing work on privacy requirements often deal with them either as non-functional requirements (NFRs) with no specific criteria on how such requirements can be met [@anton2002analyzing; @yu2002designing; @mouratidis2007secure], or as a part of security [@zannone2006requirements; @kalloniatis2008addressing], i.e., focusing mainly on confidentiality and overlooking important privacy aspects such as anonymity, pseudonymity, unlinkability, unobservability, etc.

On the other hand, privacy is an elusive and vague concept [@solove2002conceptualizing; @solove2006taxonomy; @kalloniatis2008addressing]. Although several efforts have been made to clarify the privacy concept by linking it to more refined concepts such as secrecy, person-hood, control of personal information, etc., there is no consensus on the definition of these concepts or which of them should be used to analyze privacy [@solove2006taxonomy]. This has resulted in a lot of confusion among designers and stakeholders, which has led in turn to wrong design decisions. In this context, a well-defined privacy ontology that captures privacy related concepts along with their interrelations would constitute a great step forward in designing privacy-aware systems.

Ontologies have been proven to be a key success factor for eliciting high-quality requirements, and it can facilitate and improve the job of requirements engineers [@souag2012towards; @kaiya2006using; @dzung2009ontology], since it can reduce the conceptual vagueness and terminological confusion by providing a shared understanding of the related concepts between designers and stakeholders [@uschold1996ontologies].

In addition, the ontology should capture privacy requirements in their social and organizational context. Since most complex systems these days (e.g., healthcare systems, smart cities, etc.) are socio-technical systems [@emery1960socio], which consist not only of technical components but also of humans along with their interrelations, where different kinds of vulnerabilities might manifest themselves [@liu2003security; @gharibre2016]. Focusing on the technical aspects and leaving the social and organizational aspects outside the system’s boundary leaves the system open to different kinds of vulnerabilities that might manifest themselves in the social interactions and/or the organizational structure of the system [@liu2003security]. The Flash Crash [@sommerville2012large] and the Allied Irish Bank scandal [@massacci2008detecting] are good examples, where problems were not caused by mere technical failures, but it were also due to several socio-technical related vulnerabilities of the system.

This paper applies systematic review techniques to survey available literature to identify the most mature studies that propose privacy ontologies/concepts. In addition, we further analyze the selected privacy related concepts/relations to identify the main ones in order to propose a novel ontology that can be used to capture privacy requirements. This paper is therefore intended to be a starting point to address the problem of identifying a core privacy ontology.

The rest of the paper is organized as follows; Section (2) describes the review process and the protocol underlining this systematic review. We present and discuss the review results and findings in Section (3). In Section (4) we propose a novel ontology for privacy requirements engineering. We discuss threats to validity in Section (5). Related work is presented in Section (6), and we conclude and discuss future work in Section (7).

Review Process
==============

A systematic review can be defined as a systematic process for defining research questions, searching the literature for the best available resources to answer such questions, and collecting available data from the resources for answering the research questions. Following [@kitchenham2004procedures; @keele2007guidelines], the review process (depicted in Figure \[fig:plan\]) consists of three main phases:

1.  Planning the review, in which we formulate the research questions and we define the review protocol.

2.  Conducting the review, in which we conduct the search process after identifying the search terms and the literature sources, and then we perform the study selection activity.

3.  Reporting the results of the review, in which we collect detailed information from the selected studies in order to answer the research questions, and then we use the obtained data to answer the research questions, which we discuss in the following section.

Planning the review
-------------------

This phase is very important for the success of the review, for it is here that we define the research objectives and the way in which the review will be carried out. This includes two main activities: (1) formulating the research questions that the systematic review will answer; and (2) defining the review protocol that specifies the main procedures to be taken during the review.

### Research questions

Formulating the review questions is a very critical activity since these questions are used to derive the entire systematic review methodology [@kitchenham2004procedures]. Therefore, we formulate the following four Research Questions (RQ) to identify the main privacy concepts that have been presented in the literature:

RQ1

:   What are the privacy concepts/relations that have been used to capture privacy concerns?

RQ2

:   What are the main concepts/relations that have been used for capturing privacy requirements?

RQ3

:   Do existing privacy studies cover the main privacy concepts/relations?

RQ4

:   What are the limitations of existing privacy studies?

### Define the review protocol

The review protocol specifies the methods to be followed while conducting the systematic review. Based on [@kitchenham2004procedures; @keele2007guidelines], a review protocol should specify the following: the strategy that will be used to search for primary studies selection; study selection criteria; study quality assessment criteria; data extraction and dissemination strategies. In the rest of this section, we discuss how we specify and perform each of these activities.

Conducting the review
---------------------

This phase is composed of two main activities: 1- search strategy; and 2- study selection, where each of them is composed of several sub-activities. In what follows, we discuss them.

### Search strategy

The search strategy aims to find as many studies relating to the research questions as possible using an objective and repeatable search strategy [@kitchenham2004procedures]. The search activity consists of three main sub-activities: 1- identify the search terms, 2- identify the literature resources, and 3- conduct the search process.

**Identify the search terms.** Following [@kitchenham2004procedures; @keele2007guidelines], we derived the main search terms from the research questions. In particular, we used the Boolean AND to link the major terms, and we use the Boolean OR to incorporate alternative synonyms of such terms. The resulting search terms are: (Privacy AND (ontology OR ontologies OR taxonomy OR taxonomies ) OR (Privacy requirements).

**Identify the literature resources.** Six electronic database resources were used to primarily extract data for this research. These include: IEEE Xplore, ACM Digital Library, Springer, ACM library, Google Scholar, and Citseerx.

**Conduct the search process.** The search process (shown in Figure \[fig:process\]) consists of two main stages:

Search stage 1.

:   We have used the search terms to search the six electronic database sources, and only papers with relevant titles have been selected;

Search stage 2.

:   The reference lists of all primary selected papers were carefully checked, and several relevant papers (25 papers) were identified and added to the list of the primary selected papers.

**Study selection.** The selection process (shown in Figure \[fig:process\]) consists of two main stages.

Selection stage 1 (primary selection).

:   Searching the electronic database source returned 240 relevant papers, among which we have identified and removed 33 duplicated papers. Next, we have applied the primary selection criteria on the remaining 207 papers. In particular, we have read the abstract, introduction, and then we skimmed through the rest of paper. We removed all the papers that are not published in the English language, and we excluded all papers that are not related to any of our research questions. Moreover, when we were able to identify multiple version of the same paper, only the most complete one was included. Finally, we excluded any paper that has been published before 1996, since we were not able to find any concrete work related to our research before 1996. The primary selection inclusion and exclusion criteria are shown in Table \[table:inexcriteria\]. The outcome of this selection stage was 107 papers, i.e., we have excluded 100 papers.

Selection stage 2 (Quality Assessment (QA)).

:   At this stage, the QA criteria has been applied to the papers that have resulted from the first selection stage (107 papers) along with the papers that have resulted from the second search stage (25 papers), for a total of 132 papers. In order to identify the most relevant studies that can be used to answer our research questions, we formulated five QA questions (shown in Table \[table:qualityassessment\]) to evaluate the relevance, completeness, and quality of the studies, where each question has only two answers: Yes = 1 or No= 0. The quality score for each study is computed by summing the scores of its QA questions, and the paper is selected only if it scored at least 4. As a result, 98 papers were excluded and 34 studies were selected. The result of the QA of the studies is presented in Table \[table:Quality\] in Appendix A.

\[table:inexcriteria\]

\[table:qualityassessment\]

Reporting the results
---------------------

The final phase of the systematic review involves summarizing the results, and it consists of two main activities: 1- data synthesis; and 2- results and discussion.

### Data synthesis

In what follows, we describe how data syntheses were executed: Data related to *RQ1* can be extracted directly from the list of selected papers (shown in Table \[table:selected\]). To answer *RQ2*, the contents of the 34 selected studies were further analyzed to identify privacy related concepts along with their interrelations, and list them in a comprehensive table (Table \[table:rq\]). Moreover, we identify the main concepts/relations for capturing privacy requirements based on Table \[table:rq\] & Table \[table:iteration\] that shows the frequency of concepts/relations appearance in the selected studies. To answer *RQ3* data can be derived from Table \[table:limitation\], which summaries the percentage of the main concepts/relations categories that each selected study cover. *RQ4* can be answered by categorizing the studies into four group based on the concepts categories they do not cover.

Review results and discussion
=============================

This section presents and discusses the findings of this review. First, we start by presenting an overview of the selected studies, and then, we present the findings of this review concerning the research questions.

**Overview of selected studies[^1].** 34 studies were selected, where 5 studies were from book chapters, 10 papers were published in journals, 11 papers appeared in conference proceedings, 6 papers came from workshops, and 2 papers were extracted from symposiums. The number of papers by year of publication is presented in Figure \[fig:pubyear\]; while the percentages of the selected studies based on their publishing type are represented in Figure \[fig:pie\].

![Number of papers by year of publication[]{data-label="fig:pubyear"}](pubyear.eps){width="70.00000%"}

**RQ1:** *What are the privacy concepts/relations that have been used to capture privacy concerns?* The review has identified 34 studies that provide concepts and relations that can be used for capturing privacy requirements. The list of the selected studies that answers our first research question (*RQ1*) is presented in Table \[table:selected\], where each paper is described by its identifier, title, author(s), publication year and number of citation. In what follows, we present a summary of the contributions of each selected study.

\[table:selected\]

**ACM\_03 [@van2004elaborating],**

:   “*Elaborating Security Requirements by Construction of Intentional Anti-Models*”. Lamsweerde [@van2004elaborating] proposed a goal-oriented approach that extends the KAOS framework for modeling and analyzing security requirements. The framework focus on generating and resolving obstacles/anti-goals to goal satisfaction, i.e., it addresses malicious obstacles/anti-goals (threats) set up by attackers to threaten security goals, and the new security requirements are obtained as countermeasures to resolve these obstacles/anti-goals (threats). The framework adopts several main concepts from KAOS (e.g., agents, goals, etc.) and proposes concepts for building intentional threat models (e.g., obstacles, anti-goal, anti-requirements, attacker, etc.).

**ACM\_14 [@labda2014modeling],**

:   “*Modeling of Privacy-aware Business Processes in BPMN to Protect Personal Data*”. Labda et al. [@labda2014modeling] propose a privacy-aware Business Processes (BP) framework for modeling, reasoning and enforcing privacy constraints. They have identified several privacy-related concepts, including: *Data*, *User*, *Action*, *Purpose*, and *Permissions*. In addition, they identify five concepts that can be used for analysis privacy in BP: (1) *Access control*, (2) *Separation of Tasks (SoT)*, (3) *Binding of Tasks (BoT)*, (4) *User consent*, (5) *Necessity to know (NtK)*.

**ACM\_16 [@braghin2008introducing],**

:   “*Introducing Privacy in a Hospital Information System*”. Braghin et al. [@braghin2008introducing] presented an approach that supports expressing and enforcing privacy-related policies. The approach extends the conceptual model of an open source hospital information system (Care2x) with concepts for role-based privacy management (e.g., subject, processor, and controller), and concepts for supporting the privacy enforcement mechanisms (actions), where such actions can be either inactive or declarative, where the former includes actions that require to access and process data, while the latter includes simple statements representing activities that do not require to interact with the system.

**ACM\_35 [@singhal2010ontologies],**

:   “*Ontologies for Modeling Enterprise Level Security Metrics*”. Singhal and Wijesekera [@singhal2010ontologies] provide a security ontology that supports IT security risk analysis. The ontology identifies which threats endanger which assets and what countermeasures can reduce the probability of the occurrence of a related attack. The concepts of the ontology, includes: *threat*, a potential violation of security, an *attack* exploits vulnerabilities to realize a threat, where *vulnerabilities* are characteristics of target assets that make them prone to attack, and a *risk* is an expectation of loss expressed as a probability that a particular threat will exploit a certain vulnerability, which will result in a harmful result. Finally, *security mechanisms* are designed to prevent threats from happening or mitigating their impact when they occur.

**ACM\_40 [@wang2009ovm],**

:   “*OVM: An Ontology for Vulnerability Management*”. Wang and Guo [@wang2009ovm] propose an ontology for vulnerability management (OVM) that capture the fundamental concepts in information security and their relationship, retrieve vulnerable assets (data) and reason about the cause and impact of such vulnerabilities. The ontology has been built based on the Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and Common Attack Pattern Enumeration and Classification (CAPEC). The top level concepts of the ontology includes, a *Vulnerability* existing in an *IT\_Product* that can be exploited by an *Attacker* through an *Attack* that compromises the *IT\_Product* and cause *Consequence*. Moreover, *Countermeasures* can be used to protect the *IT\_Product* through mitigating the *Vulnerability*.

**CIT\_07 [@velasco2009modelling],**

:   “*Modeling Reusable Security Requirements Based on an Ontology Framework*”. Velasco et al. [@velasco2009modelling] propose an ontology-based framework for representing and reusing security requirements based on risk analysis. The ontology is based on two ontologies: 1- the risk analysis ontology that is developed based on MAGERIT [@magerit2006methodology], and identifies five types of risk elements: *asset*, *threat*, *safeguard*, *valuation dimension*, *valuation criteria*, and 2- the requirements ontology that models reusable requirements along with their relationships.

**CIT\_33 [@liu2003security],**

:   “*Security and Privacy Requirements Analysis within a Social Setting*”. Liu et al. [@liu2003security] propose a framework for dealing with security and privacy requirements within an agent-oriented modeling framework. They extend *i*\* modeling language to deal with security and privacy requirements, where *i*\* language allows for analyzing security/privacy issues within their social context, which enables for a systematic way of deriving vulnerabilities and threats. Moreover, *i*\* models make it possible to conduct different countermeasure analyses for addressing vulnerabilities and suggesting countermeasures for them.

**IEEE\_12 [@souag2013using],**

:   “*Using Security and Domain ontologies for Security Requirements Analysis*”. Souag et al. [@souag2013using] introduce an ontology-based method for discovering Security Requirements (SR). The process that underlies this method has three main steps, and it starts with the elicitation step that constructs an initial *i*\* requirements model from the stakeholders’ needs/concerns about security. The second step is the SR analysis that depends on production rules to exploit the security-specific ontology to discover threats, vulnerabilities, countermeasures, and resources. These concepts are used to enrich the requirements model by adding new elements (malicious tasks, vulnerability points, etc.). Finally, the domain specific SR analysis step, in which another set of rules explores the domain ontology to improve the requirements model with resources, actors and other concepts that are more specific to the domain at hand.

**IEEE\_15 [@tsoumas2006towards],**

:   “*Towards an Ontology-based Security Management*”. Tsoumas and Gritzalis [@tsoumas2006towards] introduce a security management framework that proposes a Security Ontology (SO), which contains the following concepts, a *stakeholder* possesses an *asset*, which in turn can be compromised by a *vulnerability*. While a *threat* initiated by a *threat agent* targets an *asset* and exploits a *vulnerability* of the asset in order to achieve its goal. Exploitation of a *vulnerability* leads to the realization of an unwanted *incident*, which has a certain *impact*. Furthermore, *countermeasures* reduce the impact of the *threat* with the use of *controls*. Finally, *security policy* formulates the *controls* into a manageable security framework possessed by *stakeholders*.

**IEEE\_50 [@Giorgini2005],**

:   “*Modeling Security Requirements through Ownership, Permission and Delegation*”. Giorgini et al. [@Giorgini2005] introduce Secure Tropos, a formal framework for modeling and analyzing security requirements in their social and organizational context. Secure Tropos proposes several concepts including, an *actor* that covers two concepts (a *role* and an *agent*), a *goal* that can be refined through and/or-decompositions of a root *goal* into finer *sub-goals*, a *task*, and a *resource*. Secure Tropos adopts the notion of *delegation* to model the transfer of objectives (*goals* and *tasks*) from one actor to another, and it adopts *resource provision* among actors. Moreover, it introduces the *ownership* concept that capture the relation between *actors* and *resources* they own. Finally, it provides the *trust* concept to capture the *actors’* expectations in one another concerning their social dependencies, and it introduce the *monitoring* concept to compensate the lack of trust/distrust among *actors* concerning social dependencies.

**IEEE\_57 [@kang2013security],**

:   “*A Security Ontology with MDA for Software Development*”. Kang and Liang [@kang2013security] propose security ontology for software development based on Model Driven Architecture (MDA) paradigm. The ontology includes most popular security concerns mentioned in literature such as *auditing*, *threats*, *accountability*, *non-repudiation*, *risk*, *attacks*, *availability*, *frauds*, *confidentiality*, *asset*, *integrity*, *prevention*, and *Reputation*.

**SCH\_18 [@kang2013security],**

:   “*Eliciting Security Requirements with Misuse Cases*”. Sindre and Opdahl [@kang2013security] present a systematic approach to eliciting security requirements based on *use cases*. They extend the traditional *use case* approach to also consider *misuse cases* that represent unwanted behavior in the system to be developed. In particular, a *use case* diagram contains both, *use cases* and *actors*, as well as *misuse cases* and *misusers*. In addition, *misuse cases* adopts the ordinary *use case* relationships such as *include*, *extend*, and *generalize*. A *use case* is related to a *misuse case* using a directed *association*, which means that a *misuse case* *threatens* the *use case*. Moreover, a use case diagram can contain *security use cases*, which are special *use cases* that can *mitigate* *misuse cases*. In summary, an ordinary *use cases* represent requirements, *security cases* represent security requirements, and *misuse cases* represent security *threats*.

**SCH\_24 [@kalloniatis2008addressing],**

:   “*Addressing Privacy Requirements in System Design. the PriS Method*”. Kalloniatis et al. [@kalloniatis2008addressing] introduce PriS, a security requirements engineering method that consider users’ privacy requirements. PriS considers privacy requirements as business goals and provides a methodological approach for analysing their effect onto the organizational processes. The conceptual model of PriS is based on the Enterprise Knowledge Development (EKD) framework [@loucopoulos1999enterprise], and it includes a set of concepts for modeling privacy requirements, such as: *stakeholders*, *goals* that can be either *strategic goals* or *operational goals*, and *goals* can be *realized* by *processes*. On the other hand, *privacy requirements* are a special type of *goals* (*privacy goals*), which constraint the causal transformation of organizational goals into processes. *Privacy goals* may be decomposed in simpler goals or may *support*/ *conflict* the achievement of other *goals*. Moreover, eight types of *privacy goals* have been identified corresponding to the eight privacy concerns namely, authentication, authorisation, identification, data protection, anonymity, pseydonymity, unlinkability, and unobservability.

**SCH\_28 [@mouratidis2007secure],**

:   “*Secure Tropos: a Security-oriented Extension of the Tropos Methodology*”. Mouratidis and Giorgini [@mouratidis2007secure] introduce extensions to the Tropos methodology [@bresciani2004tropos] to model security concerns throughout the whole development process. Secure Tropos adopts from Tropos methodology concepts for modeling *actors*, *goals*, *resources*, along with their different relations and social dependencies. In addition, it introduces concepts for modeling security requirements, such as a *security constraint* (e.g., privacy, integrity, and availability), which can be decomposed into one or more security sub-constraints. *Security constraint* modeling is divided into *security constraint delegation*, *security constraint assignment*, and *security constraint analysis*. Secure Tropos also introduces *secure entity*, *security features*, *security mechanisms*, a *secure capability*, a *secure dependency*, and the *threat* concept.

**SCH\_41 [@solove2006taxonomy],**

:   “*A Taxonomy of Privacy*”. Solove [@solove2006taxonomy] provides taxonomy for understanding a wide range of privacy related problems. The taxonomy specifies four main groups of possible harmful activities: **(i) information collection**: creates disruption based on the process of data gathering Two sub-classifications of information collection have been identified, *surveillance* and *interrogation*. **(ii) information processing**: refers to the use, storage, and manipulation of data that has been collected. Five different sub-classifications of information processing have been identified: *aggregation*, *identification*, *insecurity*, *secondary use*, and *Exclusion*. **(iii) information dissemination**: in which the data holders transfer the information to others. Seven different sub-classifications of information dissemination have been identified: *breach of confidentiality*, *disclosure*, *exposure*, *increased accessibility*, *blackmail*, *appropriation*, and 7- *distortion*. **(iv) invasion**: involves impingements directly on the individual. Two different sub-classifications of information invasion have been identified: *intrusion* and 2-*decisional interference*.

**Spgr\_07 [@massacci2011extended],**

:   “*An Extended Ontology for Security Requirements*. Massacci et al. [@massacci2011extended] propose ontology for security requirements engineering, the ontology adopts concepts from Secure Tropos methodology [@massacci2007computer], Problem Frame [@haley2008security], and several industrial case studies. The most general concept in the ontology is *Thing*. An *object* is a *thing* that persists, and an *event* is an instantaneous happening that changes some *objects*. The *object* concept can be specialized into *proposition*, *situation*, *entity* and *relationship*. A *proposition* is an *object* representing a true/false statement. A *situation* is a partial world described by a *proposition*. An *entity* is an *object* that has a distinct, separate existence from all other *things*, though that existence need not be material. *Entity* is specialized into *Actor*, *Action*, *Process*, *Resource*, and *Asset*. *Relationship* can be specialized into *do-dependency*, *can-dependency*, *trust-dependency*, *and/or* refinement, *contributes*, *provides*, *uses*. In addition, *damages* is a *relationship* between an *attack* and an *asset*, where the *attack* causes *harm* to the *asset*. *Exploits* is a *relationship* between *attack* and *vulnerability*. *Protects* relates a *security goal* to an *asset*. Finally, *denies* relates an *anti-goal* to a *requirement*. Finally, a *specification* is an *entity* consisting of *actions*, quality propositions, and domain assumptions. *Vulnerability* is a specialization of Situation and is adopted from the Security domain. While a *threat*consists of a situation that includes an attacker and one or more vulnerabilities.

**Spgr\_13 [@elahi2009modeling],**

:   “*A Modeling Ontology for Integrating Vulnerabilities into Security Requirements Conceptual Foundation*”. Elahi et al. [@elahi2009modeling] propose a vulnerability-centric modeling ontology, which integrates empirical knowledge of vulnerabilities into the system development process. They identify a set of core concepts for security requirements elicitation, and they identify another set of concepts for capturing vulnerabilities and their effects on the system. The ontology contains several concepts, including: a *concrete element* that is a tangible entity (e.g., an *activity*, *task*, etc.), and it may *bring* a *vulnerability* into the system. *Exploitation* of *vulnerabilities* can have effects on other elements (*affected elements*), where the *effect* relation is characterized by the *severity* attribute. An *attack* involves the execution of *malicious actions* that one or more *actors* perform to satisfy some *malicious goal*. A *concrete element* may have a *security impact* on *attacks*, which can be interpreted as a *security countermeasure* that can be used to patch *vulnerabilities*.

**Spgr\_02\_01 [@asnar2007trust],**

:   “*From Trust to Dependability Through Risk Analysis*”. Asnar et al. [@asnar2007trust] present an extension of the Tropos Goal-Risk framework. In particular, they introduce an approach to assess risk on the basis of trust relations among actors. In particular, they introduce the notion of trust to extend the risk assessment process. Using this framework, an actor can assess the risk in delegating the fulfillment of his objectives and decide whether or not the risk is acceptable. They also introduce the notion of trust level proposing three trust levels: *Trust*, *Distrust*, and *NTrust* (i.e., neither trust nor distrust), where a low level of trust increases the risk perceived by the depender about the achievement of his objectives.

**Spgr\_02\_02 [@asnar2006risk],**

:   “*Risk Modeling and Reasoning in Goal Models*”. Asnar et al. [@asnar2006risk] propose a goal-oriented approach for modeling and reasoning about risks at requirements level, where risks are introduced and analyzed along the stakeholders’ goals and countermeasures. Their proposed framework is based on the Tropos methodology and extends it with new concepts and qualitative reasoning mechanisms to consider risks since the early phases of the requirements analysis. In their framework, a *risk* is an *event* that has a negative impact on the satisfaction of a *goal*, while a *treatment* is a *countermeasure* that can be adopted in order to mitigate the effects of the *risk*. Moreover, they consider *likelihood* as a property of the *event*, and they capture the *likelihood* by the level of evidence that supports and prevents the occurrence of the *event* (SAT and DEN). On the other hand, *impact* is used to capture the influence of an event to the *goal* fulfillment, and they classify impact under: *strong positive*, *positive*, *negative*, and *strong negative*.

**Spgr\_03\_01 [@avizienis2004basic],**

:   “*Basic Concepts and Taxonomy of Dependable and Secure Computing*”. Avizienis et al. [@avizienis2004basic] propose a new taxonomy for dependable and secure computing based on an extensive analysis of the related literature. The authors provide precise definitions characterizing the various concepts that come into play when addressing the dependability and security of computing and communication systems. The three top-level dimensions of this taxonomy are: *attribute*, *threat*, and *means*. The concept of *attribute* is analyzed in terms of: *availability*; *reliability*; *safety*; *confidentiality*; *integrity*; and *maintainability*. The concept of *threat* is further refined in terms of *fault*, *error*, and *failure*. While the concept of *means* is used to attain the various attributes of dependability and security, where these means can be grouped into four main categories: *fault prevention*; *fault tolerance*; *fault removal*; and *fault forecasting*.

**Spgr\_07\_02 [@zannone2006requirements],**

:   “*A Requirements Engineering Methodology for Trust, Security, and Privacy*”. Zannone [@zannone2006requirements] introduces the Secure i\* (SI\*) methodology that adopts from Secure Tropos the concepts of *actors*, *goals*, *resources*, along with their different relations and social dependencies, and it proposes new relation among roles, namely *supervision*. In SI\*, an *actor* is defined along with a set of *objectives*, *capabilities*, and *entitlements*, which can be modeled through relations between actors and services (goals, tasks, and resources), namely: (1) *require* indicates that an actor intends to achieve a *service*, (2) *be entitled* indicates that an *actor* is the legitimate *owner* of a *service*, and (3) *provide* indicates that the *actor* has the capability to achieve a *service*. The delegation concept is refined in SI\* into: (1) *Delegation of execution (De)*, and (2) *Delegation of permission (De)*. In addition, the trust concept is refined to cope with the refinement of delegation they propose into: (1) *Trust of execution (Te)*, and (2) *Trust of permission (Tp)*.

**Spgr\_07\_03 [@lin2003introducing],**

:   “*Introducing Abuse Frames for Analysing Security Requirements*”. Lin et al. [@lin2003introducing] develop an approach using Problem Frames to analyze security problems in order to determine security vulnerabilities. In particular, they introduce the notion of an anti-requirement as the requirement of a malicious user that can subvert an existing requirement, and they incorporate anti-requirements into abuse frames to represent the notion of a security threat that is imposed by malicious users in a particular problem context.

**Spgr\_08\_01 [@mayer2009model],**

:   “*Model-based Management of Information System Security Risk*”. Mayer [@mayer2009model] proposes ISSRM (Information System Security Risk Management), a security risk management model. The ISSRM reference model addresses risk management at three different levels, combining together *asset*, *risk*, and *risk treatment* views, and it proposes concepts that are ordered in three main groups: **(i) Asset-related concepts** describe what assets are important to protect, and what criteria guarantee asset security; **(ii) Risk-related concepts** present how the risk itself is defined. A *risk* is the combination of a *threat* with one or more *vulnerabilities* leading to a negative impact harming the *assets*; and **(iii) Risk treatment-related concepts** describe what decisions, requirements and controls should be defined and implemented in order to mitigate possible *risks*.

**Spgr\_08\_03 [@dritsas2006knowledge],**

:   “*A Knowledge-based Approach to Security Requirements for E-health Applications*”. Dritsas et al. [@dritsas2006knowledge] propose an ontology that includes the main security related concepts, and use the ontology for designing and developing a set of security patterns that address a subset of these requirements for applications that provide e-health services. The concepts used in the proposed ontology includes: *stakeholder*, *objective*, *threat*, *countermeasure*, *asset*, *vulnerability*, *deliberate attack*, *security pattern* and *security pattern context*. A *security pattern* provides a specific set of *countermeasures*, and a *security pattern context* is defined as a set of *asset*, *vulnerability*, and *deliberate attack* triplets. Therefore, one can start from the generic *security objectives*, find the *security pattern contexts* that match them and choose specific *security pattern*, which ensures that the high level *security objectives* can be fulfilled by implementing the respective *countermeasures*.

**Spgr\_13\_01 [@asnar2008risk],**

:   “*Risk as Dependability Metrics for the Evaluation of Business Solutions: a Model-driven Approach*”. Asnar et al. [@asnar2008risk] adopt and extend the Tropos Goal Model [@asnar2006risk; @asnar2007trust] by considering also the interdependency among the actors within an organization. Through this extension analysts can assess the risk perceived by each actor, taking into account the organizational environment where the actor acts. Based on such analysis, we have provided a method to assist analysts in determining the treatments to be introduced in order to make risks be acceptable by all actors.

**Spgr\_13\_02 [@den2003coras],**

:   “*The CORAS Methodology: Model-based Risk Assessment Using UML and UP*”. Braber [@den2003coras] introduces the CORAS methodology in which the Unified Modeling Language (UML) and Unified Process (UP) are combined to support a model-based risk assessment of security-critical systems. The CORAS ontology propose several concepts, such as *context* that influences the *target*, which contains *assets* and has its *security requirements*. *Security requirements* lead to *security policies*, which protect *assets* by reducing its related *vulnerabilities* that can be exploited by *threats*, which might reduce the *value* of the *asset*. A *Risk* contains an *unwanted incident* that has a certain *consequence* and *frequency* of occurrence.

**Spgr\_13\_03 [@elahi2010vulnerability],**

:   “*A Vulnerability-centric Requirements Engineering Framework: Analyzing Security Attacks, Countermeasures, and Requirements based on Vulnerabilities*. Elahi et al. [@elahi2010vulnerability] adopt and extend their previous work [@elahi2009modeling] by proposing an agent- and goal-oriented framework for eliciting and analyzing security requirements. They refined the goal model evaluation method that helps analysts verifying whether top goals are satisfied with the risk of vulnerabilities and attacks and assess the efficacy of security countermeasures against such risks. More specifically, the evaluation does not only specify if the goals are satisfied, but also makes it possible to understand why and how the goals are satisfied (or denied) by tracing back the evaluation to vulnerabilities, attacks, and countermeasures.

**Spgr\_13\_04 [@jurjens2002umlsec],**

:   “*UMLsec: Extending UML for Secure Systems Development*”. J[ü]{}rjens [@jurjens2002umlsec] proposes UMLsec that is an extension to UML modeling language, which allows for integrating security requirements modeling and analysis within the system development process. UMLsec is able to model security related features such as secrecy, integrity, access control, etc. It represents security feature on UML diagrams by providing several extension mechanisms, namely: (1) stereotypes: a new types of modeling elements that extends the semantics of existing types in the UML meta-model; (2) tagged values: that is used to associate data with model elements and (3) constraints: that are used to define criteria to determine whether requirements are met or not by the system design. In UMLsec, integrity is modeled as a constraint, which can restrict unwanted modification (e.g., insert), but information quality can be affected in several other ways that cannot be captured by this approach.

**Spgr\_13\_05 [@matulevivcius2008adapting],**

:   “*Adapting Secure Tropos for Security Risk Management in the Early Phases of Information Systems Development*”. Matulevi[č]{}ius et al. [@matulevivcius2008adapting] have analyzed how Secure Tropos can be applied to analyze security risks at the early IS development phases. Their analysis suggested a number of improvements for Secure Tropos in order to deal better with security risk management activities. In particular, Secure Tropos could be improved with additional constructs adopted from existing security risk management models (e.g., ISSRM (Information System Security Risk Management)) such as risk, risk treatment, and control. More specifically, among the suggested risk-related concepts is a risk that presents how the risk itself is defined, what are the major principles that should be taken into account when defining the possible risks. The risk is described by the cause of the risk, and the impact of the risk captures the potential negative consequence of the risk, which can be represented by a negative contribution link between the attack and the related security constraint, i.e., the impact negates the security criteria.

**Spgr\_13\_07 [@rostad2006extended],**

:   “*An Extended Misuse Case Notation: Including Vulnerabilities*”. R[ø]{}stad [@rostad2006extended] proposes an extended misuse case notation that includes the ability to represent vulnerabilities and the insider threat. In particular, beside the main concepts of misuse case notation (e.g., *actors*, *use cases*, *misuse cases*, *misusers*, etc.). R[ø]{}stad introduce the *insider* concept to capture inside attackers, since the *misuser* concept in misuse cases was mainly proposed to address outside attackers. More specifically, an *insider* is a *misusers* that is also member of an authorized group for the entity being attacked. In addition, she introduce the *vulnerability* concept that is a weakness in the system, which can be *exploited* by the *insider*.

**Spgr\_18\_03 [@fenz2009formalizing],**

:   “*Formalizing Information Security Knowledge*”. Fenz and Ekelhar [@fenz2009formalizing] introduce security ontology for information security domain knowledge. In their ontology, a *vulnerability* is the absence of a proper safeguard,which could be exploited by a *threat*. A *threat* might threaten an *asset*, and it can be *exploited* by predefined *threat*, and *mitigation* is achieved by the implementation of one or more *control*. In addition, the *severity* of each *vulnerability* is rated by a three-point scale (high, medium, and low). A *threat* has a *source*, and a related *security objectives*. An *asset* is categorized either as a tangible or an intangible asset. While the *data* concept comprises meta-data on the knowledge of an organization. The *person* concept is used to model physical *persons* in the ontology, and the *organization* concept comprises organizations in the broadest sense and assigns *roles* to them. A *role* is a physical person or organization relevant to the organization. Finally, a *location* is used to relate location and threat information in order to assign a priori threat probabilities.

**SCH\_24\_02 [@hong2004privacy],**

:   “*Privacy Risk Models for Designing Privacy-sensitive Ubiquitous Computing Systems*”. Hong et al. [@hong2004privacy] propose a privacy risk model that captures privacy concerns at high abstraction level, and then refining them into concrete issues for specific applications. The privacy risk model consists of two parts: (1) a *privacy risk analysis* that poses a series of questions to help designers think about the social and organizational context in which an application will be used, the technology used to implement that application, and control and feedback mechanisms that end-users will use; and (2) *privacy risk management* that takes the unordered list of privacy risks from the privacy risk analysis, prioritizes them, and helps design teams identify solutions for helping end-users manage those issues.

**SCH\_28\_01 [@paja2014sts],**

:   “*STS-Tool: Security Requirements Engineering for Socio-Technical*”. Paja et al. [@paja2014sts] present the STS-Tool, a modeling and analysis support tool for STS-ml (Socio-Technical Security modeling language), a security requirements modeling language for socio-technical systems. STS-ml consists of three complementary views: 1- The social view, 2- The information view, 3- The authorization view. Through these views, STS-ml supports different types of security needs: (1) *Interaction (security) needs* are security-related constraints on goal delegations and document provisions; (2) *Authorisation needs* determine which information can be used, how, for which purpose, and by whom; (3) *Organisational constraints* constrain the adoption of roles and the uptake of responsibilities. In addition, STS-ml supports the following interaction security needs: 1. Over goal delegations: (a) *No-redelegation*, (b) *Non-repudiation*, (c) *Redundancy*, (d) *Trustworthiness*, and (e) *Availability*. 2. Over-document provisions: (a) *Integrity of transmission*, (b) *Confidentiality of transmission*, (c) *Availability*. 3. From organizational constraints: (a) *Separation of duties (SoD)*, and (b) *Combination of duties (CoD)*.

**SCH\_43\_01 [@van2003handbook],**

:   “*Handbook of Privacy and Privacy-enhancing Technologies*”. Van Blarkom et al. [@van2003handbook] investigate several active areas related to privacy, Privacy-Enhancing Technologies (PET), intelligent software agents, and the inter-relations among these areas. Furthermore, they discussed the concepts of privacy and data protection, the European Directives that rule the protection of personal data and the relevant definitions. In particular, they investigate when personal data items become non-identifiable, the sensitivity of data, automated decisions, privacy preferences, and policies. In addition, they discussed existing technological solutions that offer agent user privacy protection, known under the name Privacy-Enhancing Technologies (PETs), the set of technologies/ principles that underlying PETs, and the legal basis for PET. Moreover, they discussed the Common Criteria for Information Technology Security Evaluation (CC) supplies important information for building privacy secure agents.

**RQ2:** *What are the main concepts/relations that have been used for capturing privacy requirements?* Each of the 34 selected studies has been deeply investigated to identify any concept/relation that can be used for capturing privacy requirements. We have focused on identifying any concept/relation that can be used for capturing privacy requirements in their social and organizational context. More specifically, we tried to identify any concept that is related to privacy, social and organizational threats that might threaten privacy needs, treatment/countermeasures that can be used to mitigate threats concerning privacy needs. The result is shown in Table \[table:rq\], which presents the concepts/relations that have been identified in each selected studies. In particular, 55 concepts and relations[^2] have been identified, which have been grouped into four main groups based on their types:

[&gt;c c c| p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} | p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |p[0.3cm]{} | p[0.3cm]{} |]{}

& & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &\
& & & & & [X]{} & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &\
& & **role** & & & [X]{} & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &\
& & **agent** & & & [X]{} & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &\
& & user & & - & - & & & & & & & & & & & & & & & & & & & & & & & & & - & & & & - & & -\
& & stakeholder & & & & & & & & & - & & & - & & & - & & & & & & & & & & & - & & & & & & - & &\
& & person & & & & & & & & & & & & & & & & & & - & & & & & & & & & & & & & & & &\
& & **is\_a** & & & [X]{} & & & & & && & & & & & & & & & & & & & & & & & & & & & & & &\
& & **plays** & & & [X]{} & & & & & && & & & & & & & & & & & & & & & & & & & & & & & &\
& & **goal** & & & [X]{} & & & & & && & & & & & & & & & & & & & & & & & & & & & & & &\
& & objective & & & & & & & & & & & & - & & - & & & & & & & & & & - & & - & & & & & & & &\
& & task & & & & & & & - & - & & - & & & - & & & - & & & - & & - & & - & & & & - & & & - & - & & - &\
& & action & & - & - & & & & - & - & - & & & - & & & & &- & & & & & & & & & & & & & & & & &\
& & **refinement** & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & & &\
& & asset & - & & & - & & - & & - & - & & - & - & & & & &- & - & & - & & & - & & - & - & & - & & & & & &\
& & **informational** & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & & &\
& & data & & - & - & & & & & & & & & & & & & & - & - & & & & & & & & & & & & & & - & & -\
& & resource & & & & - & & & - & - & & - & & - & - & & & - & & & & & - & & & & & & & & & & & & &\
& & **personal info** & & & & & & &&&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & sensitive info & & & & & & & & & & & & & & & & & - & & & & & & & & & - & & & & & & & & -\
& & **part\_of** & & & & & & &&&&& & & & & & & & & & & & & & & & & & & & & & & &\
& & **own** & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & & &\
& & **obj deleg.** & & && & & & &&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & **perm. deleg.** & & && & & & &&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & **info provision** & & && & & & &&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & **monitor** & & && & & &&&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & **obj trust** & & && & & &&&& & & & & & & & & & & & & & & & & & & & & & & & &\
& & **perm trust** & & && & & &&&& & & & & & & & & & & & & & & & & & & & & & & & &\
& risk & & & & - & & & & & - & & - & & & & & & & & - & - & & & - & & & & & & & - & - & - & - & -\
& **threat** & & & & & & && & & & & & & & & & & & & & & & & & & & & & & & & & &\
& **inten. threat** & & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & &\
& **casual threat** & & & & & & &&& & & & && & & & & & & & & & & & & & & & & & & & &\
& **vulnerability** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& attack & & & & - & - & & - & & - & & - & - & - & & & - & & & & & - & - & & & & - & & & & & & & &\
& **attacker** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& **attack method** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& **impact** & & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & &\
& **threaten** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& **exploit** & & & & & & & & & && & & & & & & && & & & & & & & & & & & & & & &\
& countermeasure & - & & & & - & - & - & - & - & & - & & & & & & & & - & - & & - & - & - & & - & & & - & & - & & &\
& **mitigate** & & & & & & && & && & & & & & & & & & & & & & & & & & & & & & & &\
& control & & & & & & & & - & - & & & & & & & & & - & & & & & - & & - & & & & & & & & & -\
& treatment & & & & & & & & & & & & & & & & & & & & & & & & - & & & & & & & & & &\
& **s/p goal** & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & &\
& **s/p constraint** & & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & &\
& **s/p policy** & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & & & &\
& **s/p mechanism** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& **sec/priv req.** & & & & & & & && && & & & & & & & & & & & & & & & & & & & & & & &\
& **confidentiality** & & & & & & & & & && & & & & & & & & & & & & & & & & & & & & & & &\
& integrity & - & & & & & & - & - & - & - & - & & & & & - & & & & & - & - & & & & - & - & & - & & & & - &\
& availability & - & & & & & & - & & - & - & - & & & & & - & & & & & - & - & & & & - & - & & - & & & & - &\
& **non-repudiation** & & & & & & &&& & && & & & & & & & & & & & & & & & & & & & & & &\
& **notice** & & & & & & &&& && & & & & & & & & & & & & & & & & & & & & & & &\
& **anonymity** & & & & & & &&& && & & & & & & & & & & & & & & & & & & & & & & &\
& **transparency** & & & & & & &&& && & & & & & & & & & & & & & & & & & & & & & & &\
& **accountability** & & & & & & &&& && & & & & & & & & & & & & & & & & & & & & & & &\

\[table:rq\]

**Organizational.**

:   27 concepts and relations have been identified for capturing the agentive entities of the system in terms of their objectives, entitlements, dependencies and their expectations concerning such dependencies. The organizational concepts and relations are further grouped into four sub-categories:

    **Agentive entities.**

    :   8 concepts and relations have been identified for capturing the active entities of the system (e.g., actor, user, etc. ).

    **Intentional entities.**

    :   5 concepts and relations have been identified for capturing objectives that active entities aim for achieve/want to perform (e.g., goal, task, activity, etc. ).

    **Informational entities.**

    :   8 concepts and relations have been identified for capturing informational assets (e.g., data, asset, information, etc.).

    **Entities interactions.**

    :   6 concepts and relations have been identified for capturing the entities dependencies and expectations concerning such dependencies (e.g., delegation, dependency, provision, trust, etc. ).

<!-- -->

**Risk.**

:   10 concepts and relations have been identified for capturing risk related aspects (e.g., risk, threat, vulnerabilities, attack, etc.).

**Treatment.**

:   8 concepts and relations have been identified for capturing treatment related aspects (e.g., treatment, countermeasure, mitigate etc.).

**Privacy.**

:   9 concepts and relations have been identified for capturing privacy related aspects (e.g., anonymity, confidentiality, etc.).

Among the 55 identified concepts and relations, we have selected 38 main concepts and relations that can be used for capturing privacy requirements in their social and organizational context. In particular, these concepts and relations are 17 organizational, 9 risk, 5 treatment, and 7 privacy concepts, and they are shown in **Bold** typeset in Table \[table:rq\]. Each of the selected concepts and relations has been chosen based on the following two criteria: (1) its importance for capturing privacy requirements; and (2) the frequency of its appearance in the selected studies, which is shown in Table \[table:iteration\].

**RQ3:** *Do existing privacy studies cover the main privacy concepts/relations?* We answer *RQ3* by comparing the privacy related concepts/relations presented in each selected study with the main privacy concepts/relations identified while answering *RQ2*. In Table \[table:rq\], we use () when the study presents a main privacy concept/relation, and (-) when the study presents a normal privacy concept/relation. In addition, we use () to mark when a study misses a main concept/relation. Table \[table:limitation\] summarizes the percentage of the main privacy concepts/relations identified in each selected study with respect to the main four categories (organizational, risk, treatment, and privacy). Considering Table \[table:rq\] and Table \[table:limitation\], it is easy to note that most studies miss main privacy related concepts/relations, i.e., none of them cover all the main privacy related concepts/relations. In **RQ4**, we discuss the limitation of each selected study.

\[table:iteration\]

\[table:limitation\]

**RQ4:** *RQ4 What are the limitations of existing privacy studies?* We answer this question by categorizing the studies into four groups (**Group1-4**) [^3] based on the concepts categories (e.g., organizational, risk, treatment, and privacy) that the studies do not appropriately cover:

**Group 1,**

:   contains studies that do not appropriately cover the organizational concepts. In this group, we have identified 25 studies out of the 34 selected ones, including: ACM\_03 Lamsweerde [@van2004elaborating], ACM\_14 Labda et al. [@labda2014modeling], ACM\_16 Braghin et al. [@braghin2008introducing], ACM\_35 Singhal and Wijesekera [@singhal2010ontologies], ACM\_40 Wang and Guo [@wang2009ovm], CIT\_07 Lasheras et al. [@velasco2009modelling], IEEE\_12 Souag et al. [@souag2013using], IEEE\_15 Tsoumas and Gritzalis [@tsoumas2006towards], IEEE\_57 Kang and Liang [@kang2013security], Spgr\_7 Massacci et al. [@massacci2011extended], Spgr\_13 Elahi et al. [@elahi2009modeling], SCH\_18 Sindre and Opdahl [@sindre2005eliciting], SCH\_24 Kalloniatis et al. [@kalloniatis2008addressing], Spgr\_18\_03 Fenz and Ekelhart [@fenz2009formalizing], Spgr\_13\_01 Asnar et al. [@asnar2008risk], Spgr\_13\_02 Braber et al. [@den2003coras], Spgr\_13\_04 Jürjens [@jurjens2002umlsec], Spgr\_13\_07 R[ø]{}stad [@rostad2006extended], Spgr\_08\_01 Mayer [@mayer2009model], Spgr\_08\_03 Dritsas et al. [@dritsas2006knowledge], Spgr\_07\_03 Lin et al. [@lin2003introducing], Spgr\_03\_01 Avi[ž]{}ienis et al. [@avizienis2004basic], Spgr\_02\_01 Asnar et al. [@asnar2007trust], Spgr\_02\_02 Asnar et al. [@asnar2006risk], SCH\_24\_02 Hong et al. [@hong2004privacy], SCH\_43\_01 Blarkom et al. [@van2003handbook].

**Group 2,**

:   contains studies that do not appropriately cover risk concepts. In this group, we have identified 22 studies out of the 34 selected ones, including: ACM\_14 Labda et al. [@labda2014modeling], ACM\_16 Braghin et al. [@braghin2008introducing], ACM\_35 Singhal and Wijesekera [@singhal2010ontologies], CIT\_07 Lasheras et al. [@velasco2009modelling], IEEE\_50 Giorgini et al. [@Giorgini2005], IEEE\_57 Kang and Liang [@kang2013security], SCH\_18 Sindre and Opdahl [@sindre2005eliciting], SCH\_24 Kalloniatis et al. [@kalloniatis2008addressing], SCH\_28 Mouratidis and Giorgini [@mouratidis2007secure], SCH\_41 Solove [@solove2006taxonomy], Spgr\_13\_01 Asnar et al. [@asnar2008risk], Spgr\_13\_02 Braber et al. [@den2003coras], Spgr\_13\_04 Jürjens [@jurjens2002umlsec], Spgr\_08\_03 Dritsas et al. [@dritsas2006knowledge], Spgr\_07\_02 Zannone [@zannone2006requirements], Spgr\_07\_03 Lin et al. [@lin2003introducing], Spgr\_03\_01 Avi[ž]{}ienis et al. [@avizienis2004basic], Spgr\_02\_01 Asnar et al. [@asnar2007trust], Spgr\_02\_02 Asnar et al. [@asnar2006risk], SCH\_24\_02 Hong et al. [@hong2004privacy], SCH\_28\_01 Paja et al. [@paja2014sts], SCH\_43\_01 Blarkom et al. [@van2003handbook].

**Group 3,**

:   contains studies that do not appropriately cover treatment concepts. In this group, we have identified 31 studies out of the 34 selected ones, including: ACM\_03 Lamsweerde [@van2004elaborating], ACM\_14 Labda et al. [@labda2014modeling], ACM\_16 Braghin et al. [@braghin2008introducing], ACM\_35 Singhal and Wijesekera [@singhal2010ontologies], ACM\_40 Wang and Guo [@wang2009ovm], CIT\_07 Lasheras et al. [@velasco2009modelling], IEEE\_12 Souag et al. [@souag2013using], IEEE\_50 Giorgini et al. [@Giorgini2005], IEEE\_57 Kang and Liang [@kang2013security], Spgr\_7 Massacci et al. [@massacci2011extended], Spgr\_13 Elahi et al. [@elahi2009modeling], SCH\_18 Sindre and Opdahl [@sindre2005eliciting], SCH\_24 Kalloniatis et al. [@kalloniatis2008addressing], SCH\_41 Solove [@solove2006taxonomy], Spgr\_18\_03 Fenz and Ekelhart [@fenz2009formalizing], Spgr\_13\_01 Asnar et al. [@asnar2008risk], Spgr\_13\_02 Braber et al. [@den2003coras], Spgr\_13\_03 Elahi et al. [@elahi2010vulnerability], Spgr\_13\_04 Jürjens [@jurjens2002umlsec], Spgr\_13\_05 Matulevi[č]{}ius et al. [@matulevivcius2008adapting], Spgr\_13\_07 R[ø]{}stad [@rostad2006extended], Spgr\_08\_01 Mayer [@mayer2009model], Spgr\_08\_03 Dritsas et al. [@dritsas2006knowledge], Spgr\_07\_02 Zannone [@zannone2006requirements], Spgr\_07\_03 Lin et al. [@lin2003introducing], Spgr\_03\_01 Avi[ž]{}ienis et al. [@avizienis2004basic], Spgr\_02\_01 Asnar et al. [@asnar2007trust], Spgr\_02\_02 Asnar et al. [@asnar2006risk], SCH\_24\_02 Hong et al. [@hong2004privacy], SCH\_28\_01 Paja et al. [@paja2014sts], SCH\_43\_01 Blarkom et al. [@van2003handbook].

**Group 4,**

:   contains studies that do not appropriately cover the privacy concepts. In this group, we have identified 31 studies out of the 34 selected ones, including: ACM\_03 Lamsweerde [@van2004elaborating], ACM\_14 Labda et al. [@labda2014modeling], ACM\_16 Braghin et al. [@braghin2008introducing], ACM\_35 Singhal and Wijesekera [@singhal2010ontologies], ACM\_40 Wang and Guo [@wang2009ovm], CIT\_07 Lasheras et al. [@velasco2009modelling], CIT\_33 Liu et al. [@liu2003security], IEEE\_12 Souag et al. [@souag2013using], IEEE\_15 Tsoumas and Gritzalis [@tsoumas2006towards], IEEE\_50 Giorgini et al. [@Giorgini2005], Spgr\_7 Massacci et al. [@massacci2011extended], Spgr\_13 Elahi et al. [@elahi2009modeling], SCH\_18 Sindre and Opdahl [@sindre2005eliciting], SCH\_24 Kalloniatis et al. [@kalloniatis2008addressing], SCH\_28 Mouratidis and Giorgini [@mouratidis2007secure], SCH\_41 Solove [@solove2006taxonomy], Spgr\_18\_03 Fenz and Ekelhart [@fenz2009formalizing], Spgr\_13\_01 Asnar et al. [@asnar2008risk], Spgr\_13\_02 Braber et al. [@den2003coras], Spgr\_13\_03 Elahi et al. [@elahi2010vulnerability], Spgr\_13\_04 Jürjens [@jurjens2002umlsec], Spgr\_13\_05 Matulevi[č]{}ius et al. [@matulevivcius2008adapting], Spgr\_13\_07 R[ø]{}stad [@rostad2006extended], Spgr\_08\_01 Mayer [@mayer2009model], Spgr\_08\_03 Dritsas et al. [@dritsas2006knowledge], Spgr\_07\_02 Zannone [@zannone2006requirements], Spgr\_07\_03 Lin et al. [@lin2003introducing], Spgr\_03\_01 Avi[ž]{}ienis et al. [@avizienis2004basic], Spgr\_02\_01 Asnar et al. [@asnar2007trust], Spgr\_02\_02 Asnar et al. [@asnar2006risk], SCH\_24\_02 Hong et al. [@hong2004privacy].

Based on the previous categories, we have 15 studies that do not appropriately cover all the four concepts categories, and 13 studies that do not appropriately cover three categories. 5 studies do not appropriately cover two categories, and one study does not appropriately cover only one categories. A detailed description of the concepts and relations that each of these studies does not cover can be obtained from Table \[table:rq\].

Note that most of these studies have not been developed to address privacy related issues. Therefore, it is not a negative thing when they do not cover privacy related concepts. **RQ4** has been considered in this study to assist authors of selected studies, if they aim to extend their frameworks and approaches to cover privacy concerns.

A novel privacy ontology
========================

Several resent studies stress the need for addressing privacy concerns during the system design (e.g., Privacy by Design (PbD) [@kalloniatis2008addressing; @labda2014modeling]). Nevertheless, based on the results of this review, it is easy to note that no existing study covers all the main privacy concepts/relations that have been identified in the review, i.e., no existing ontology enables for capturing main privacy aspects and without such ontology it is almost impossible to address privacy concerns during the system design. Therefore, proposing such ontology would be a viable solution for this problem. To this end, we propose a novel privacy ontology based on the main privacy concepts/relations identified in Table \[table:rq\]. The meta-model of our ontology is depicted in Figure \[fig:onto\], and the concepts of the ontology are organized into four main dimensions:

**Organizational dimension:**

:   proposes concepts to capture the social and technical components of the system in terms of their capabilities, objectives, and dependencies.

**Risk dimension:**

:   proposes concepts to capture risks that might endanger privacy needs at the social and organizational levels.

**Treatment dimension:**

:   proposes concepts to capture countermeasure techniques to mitigate risks to privacy needs.

**Privacy dimension:**

:   proposes concepts to capture the stakeholders’ (actors) privacy requirements/needs concerning their personal information.

In what follows, we define each of these dimensions in terms of their concepts and relations

**(1) Organizational dimension.** Most current complex systems consist of several autonomous components that interact and depend on one another for achieving their objectives. Therefore, this dimension includes the organizational concepts of the system, which have been further organized into several categories, including: intentional entities, entities’ objectives, informational assets, entities interactions, and entities expectations concerning such interactions (social trust). In what follows, we define each of these dimensions along with their concepts and relations.

represent the active entities of the system, we have selected three concepts along with two relations:

**Actor**

:   represents an autonomous entity that has intentionality and strategic goals within the system. Actor can be decomposed into sub-units:

**Role**

:   is an abstract characterization of an actor in terms of a set of behaviors and functionalities within some specialized context. A role can be a specialization (**is\_a**) of one another.

**Agent**

:   is an autonomous entity that has a specific manifestation in the system. An agent can **plays** a role or more within the system, i.e., an agent inherits the properties of the roles it plays.

the behavior of actors is, usually, determined by the objectives they aim to achieve. Therefore, we adopted the goal concept and and/or decomposition (refinement) relations to represent such objectives.

**Goal**

:   is a state of affairs that an actor intends to achieve. When a goal is too coarse to be achieved, it can be refined through *and/or-decompositions* of a root goal into finer sub-goals.

**And-decomposition**

:   implies that the achievement of the root-goal requires the achievement of all its sub-goals.

**Or-decomposition**

:   is used to provide different alternatives to achieve the root goal, and it implies that the achievement of the root-goal requires the achievement of any of its sub-goals.

information is one of the most important concepts when we speak about privacy. Among the available concepts for capturing informational asset, e.g., data [@labda2014modeling], a resource (physical or informational) [@Giorgini2005; @zannone2006requirements; @mouratidis2007secure; @massacci2011extended], asset [@kang2013security; @elahi2010vulnerability], etc., we have adopted the following concepts and relations:

**Information**

:   represents any informational entity without intentionality. Information can be atomic or composite (composed of several parts), and we rely on *part\_of* relation to capture the relation between an information entity and its sub-parts. In the context of this work, we differentiate between two main types of information:

    **Personal information**

    :   any information that can be *related* (directly or indirectly) to an identified or identifiable legal entity (e.g., names, addresses, medical records, etc.), who has the right to control how such information can be used by others [@braghin2008introducing; @van2003handbook].

    **Public information**

    :   any information that cannot be *related* (directly or indirectly) to an identified or identifiable legal entity, or personal information that has been made public by its legal entity [@labda2014modeling].

actors may use information to achieve their goals. Our ontology adopts three relations between goals and information(e.g., *produce*, *read*, and *modify*), where each of these relations can be defined as follows:

**Produce**

:   indicates that information can be created by achieving the goal that is responsible for its production;

**Read**

:   indicates that the goal achievement depends on consuming such information;

**Modify**

:   indicates that the goal achievement depends on modifying such information.

as previously mentioned, we differentiate between personal and public information if it can be *related* (directly or indirectly) to an identified or identifiable legal entity. In what follows, we define the *own* concept that relates personal information to its legal entity, and we specify how information owner controls the usage to its personal information.

**Own**

:   indicates that an actor is the legitimate owner of information, where information owner has full control over the use of information it owns.

\[fig:onto\]

**A permission**

:   is consent of a particular use of a particular object in a system [@sandhu1996role], i.e., the holder of the permission is allowed to perform some action(s) in the system. Information owner has the authority to control the use of its own information, i.e., the owner can control the delegated permissions over information it owns. In our ontology, information permissions are classified under (P)roduce, (R)ead, (M)odify permissions, which covers the three relations between goals and information that our ontology propose.

actors may not have the required capabilities to achieve their own objectives by themselves (e.g., achieve a goal, furnish information, etc.). Therefore, they depend on one another for such objectives. In what follows, we discuss the concepts that are used for capturing the different actors’ social interactions and dependencies.

**Information provision**

:   indicates that an actor has the capability to deliver information to another one, where the source of the provision relation is the provider and the destination is the requester. Information provision has one attribute that describes the provisioning type, which can be either *confidential* or *non-confidential*, where the first guarantee the confidentiality of the transmitted information while the last does not.

<!-- -->

**Goal delegation**

:   indicates that one actor delegates the responsibility to achieve a goal to other actors, where the source of delegation called the delegator , the destination is called delegatee, and the subject of delegation is called delegatum.

**Permissions delegation**

:   indicates that an actor delegates the permissions to produce, read and/or modify over a specific information to another actor.

the need for trust arises when actors depend on one another for goals or permissions since such dependencies might entail risk [@chopra2003trust; @gharib2015analyzing]. More specifically, a delegator has no warranty that the delegated goal will be achieved or the delegated permissions will not be misused by the delegatee. Therefore, our ontology adopts the notion of trust and distrust to capture the actors’ expectations of one another concerning their delegations:

**Trust**

:   indicates the expectation of trustor that the trustee will behave as expected considering the trustum (e.g., trustee will achieve the delegated goal, or it will not misuse the delegated permission);

**Distrust**

:   indicates the expectation of trustor that the trustee will not behave as expected considering the trustum (e.g., trustee will not achieve the delegated goal, or it will misuse the delegated permission).

we rely on monitoring to compensate the lack of trust or distrust in the trustee concerning the trustum [@gans2001modeling; @zannone2006requirements].

**Monitoring**

:   can be defined as the process of observing and analyzing the performance of an actor in order to detect any undesirable performance [@guessoum2004monitoring], where the source of monitoring is called the monitor and the destination is called monitoree.

**(2) Risk dimension.** Risk can be defined as an event that has a negative impact on the system, i.e., it is the possibility that a particular threat will harm one or more asset of a system by exploiting a vulnerability [@kang2013security; @singhal2010ontologies; @mayer2009model; @elahi2009modeling]. In our ontology, risk is not a primitive concept and we do not include it into the ontology, since it can be captured by other concepts such as threat, vulnerabilities, attack, etc. In what follows, we define the risk dimension related concepts along with their interrelations:

**A threat**

:   is a potential incident that *threaten* an asset (personal information) by *exploiting* a *vulnerability* concerning such asset [@mayer2009model; @singhal2010ontologies; @kang2013security]. A *threat* can be either natural (e.g. earthquake, etc.), accidental (e.g. hardware/software failure, etc.), or intentional (e.g. theft of personal information, etc.)[@fenz2009formalizing; @velasco2009modelling; @souag2015security]. Therefore, the ontology differentiates between two types of threat:

**Casual threat**

:   (natural or accidental): a threat that does not require a *threat actor* nor an *attack method*.

**Intentional threat**

:   a threat that require a *threat actor* and a presumed *attack method* [@lin2003introducing; @massacci2011extended].

**Threat actor**

:   is an actor that aims for achieving the *intentional threat* [@rostad2006extended; @mayer2009model; @elahi2009modeling].

**Attack method**

:   is a standard means by which a *threat actor* carries out an *intentional threat* [@mayer2009model; @elahi2010vulnerability; @souag2015security].

**Impact**

:   is the consequence of the *threat* *over* the asset, and it can be characterized by a *severity* attribute that captures the level of the impact (e.g. high, medium or low) [@wang2009ovm; @souag2015security].

**A vulnerability**

:   is a weakness in the system, asset (personal information), etc. that can be *exploited* by a *threat* [@rostad2006extended; @mayer2009model; @singhal2010ontologies].

**(3) Treatment dimension.** This dimension introduces countermeasure concepts to mitigate risks, we adopted a high abstraction level countermeasure concepts to capture the required protection/treatment level (e.g., privacy goal), which can be refined into concrete protection/treatment constraints (e.g., mechanisms or policies) that can be implemented. The concepts of the treatment dimension are:

**A privacy goal**

:   is an aim to counter threats and prevents harm to personal information by satisfying privacy criteria concerning such information.

**A privacy constraint**

:   is a restriction that is used to realize/satisfy a privacy goal, constraints can be either a privacy policy or privacy mechanism.

**A privacy policy**

:   is a privacy statement that defines the permitted and/or forbidden actions to be carried out by actors of the system toward information.

**A privacy mechanism**

:   is a concrete technique to be implemented for helping towards the satisfaction of privacy goal (attribute).

**(4) Privacy dimension.** Introduce concepts to capture the stakeholders’ (actors) privacy requirements/needs concerning their personal information. The concepts of the privacy dimension are:

**Privacy requirement**

:   is used to capture the actors’ (personal information owner/subject) privacy needs at a high abstraction level, and it is specialized from the *privacy goal* concept. Moreover, privacy requirement concept is further specialized into five more refined concepts.

**Confidentiality,**

:   means personal information should be kept secure from any potential leaks and improper access [@solove2006taxonomy; @dritsas2006knowledge; @labda2014modeling]. We rely on the following principles to analyze confidentiality:

    **Non-disclosure,**

    :   personal information can only be disclosed if the owner’s consent is provided, i.e., the disclosure of the personal information should be under the control of its legitimate owner [@solove2006taxonomy; @dritsas2006knowledge; @braghin2008introducing; @labda2014modeling]. Note that *non-disclosure* also cover information transmission that is why we differentiate between two types of information provision (confidential and non-confidential).

    **Need to know (NtK),**

    :   an actor should only use information if it is strictly necessary for completing a certain task [@labda2014modeling; @paja2014sts].

    **Purpose of use,**

    :   personal information should only be used for specific, explicit, legitimate purposes and not further used in a way that is incompatible with those purposes [@van2003handbook; @solove2006taxonomy; @dritsas2006knowledge]. *Purpose of use* is able to address situations where an actor might be granted a permission to use some personal information for a legitimate purpose, yet after accessing it, he/she might use the information for some other purpose.

**Notice,**

:   the data subject (information owner) should be notified when its information is being collected [@van2003handbook; @solove2006taxonomy; @dritsas2006knowledge]. Notice is considered mainly to address situations where personal information *related* to a legitimate entity (data subject) is being collected without his/her knowledge.

**Anonymity,**

:   the identity of the information owner should not be disclosed unless it is required [@dritsas2006knowledge; @solove2006taxonomy], i.e., the primary/secondary identifiers of the data subject (e.g., name, social security number, address, etc. ) should be removed if they are not required and information still can be used for the same purpose after their removal. We rely on *part\_of* relation to model the internal structure of personal information, i.e., we link the identifiers of the data subject with the rest of the information item by the *part\_of* relation. If the identifiers are not required for the task, they can be easily removed, and information can be used without linking it back to its owner/data subject (unlinkability).

**Transparency,**

:   information owner should be able to know who is using his/her information and for what purposes [@van2003handbook; @dritsas2006knowledge; @kang2013security]. We rely on the following principles to analyze transparency:

    **Authentication,**

    :   a mechanism that aims at verifying whether actors are who they claim they are [@paja2014sts].

    **Authorization,**

    :   a mechanism that aims at verifying whether actors can use information in accordance with their credentials [@dritsas2006knowledge].

**Accountability,**

:   information owner should have a mechanism available to them to hold information users accountable for their actions concerning information [@dritsas2006knowledge; @kang2013security]. We rely on the following principles to analyze accountability:

    **Non-repudiation,**

    :   the delegator cannot repudiate he/she delegated; and the delegatee cannot repudiate he/she accepted the delegation [@kang2013security; @paja2014sts].

    **Not-re-delegation,**

    :   the delegatee is requested by the delegator not to re-delegate the delegatum, i.e., the re-delegation of a goal/permission is forbidden [@paja2014sts].

Threats to validity
===================

After presenting and discussing our systematic literature review, we discuss the threats to its validity in this section. Following Runeson et al. [@runeson2009guidelines], we classify threats to validity under four types: construct, internal, external and reliability:

**1- Construct threats:** is concerned with to what extent a test measures what it claims to be measuring [@runeson2009guidelines]. Construct validity is particularly important, since it might influence the internal validity as well [@mackenzie2003dangers]. We have identified the following threats:

Poor conceptualization of the construct:

:   occurs when the predicted outcome of the study is defined too narrowly [@mackenzie2003dangers], i.e., using only one factor to analyze the subject of the study. To avoid this threat, the research objective has been transformed into several research questions and for each of these questions, several factors were specified to evaluate whether they have been properly answered. In addition, we followed the best practices in the area to define the criteria while searching for and selecting the related studies (e.g., inclusion and exclusion criteria, quality assessment criteria, etc.).

Systematic error:

:   may occur while designing and conducting the review. To avoid such threat, the review protocol has been carefully designed based on well-adopted methods, and it has been strictly followed during the different phases of the review.

**2- Internal threats:** is concerned with factors that have not been considered in the study, and they could have influenced the investigated factors in the study [@trochim2006research; @runeson2009guidelines]. One internal threat has been identified:

Publication bias:

:   publication bias is a common threat to the validity of systematic reviews, and it refers to a situation where positive research results are more likely to be reported than negatives ones [@keele2007guidelines]. Our review focused on finding privacy related concepts/relations by reviewing the related literature, and there are no positive nor negative research results in such case. Despite this, we have specified very clear inclusion and exclusion criteria, and quality assessment criteria while searching for and selecting the related studies.

**3- External threats:** is concerned with to what extent the results of the study can be generalized [@runeson2009guidelines]. One internal threat has been identified:

Completeness:

:   it is almost impossible to capture all related studies, yet our review protocol and search strategy were very carefully designed to cover as much as possible of the related studies. In addition, we might exclude some relevant non-English published studies since we only considered English studies in this review. To mitigate this limitation we performed a manual scan of the references of all the primary selected studies in order to identify those studies that were missed during the first search stage. However, we cannot guarantee that we have identified all the main available studies, which can be used to answer our research questions.

**4- Reliability threats:** is concerned with to what extent the study is dependent on the researcher(s), i.e., if another researcher(s) conducted the same study, the result should be the same. The search terms, search sources, inclusion and exclusion criteria, quality assessment questions, etc. are all available, and any researcher can repeat the review and he should get similar results. However, the researcher should take into consideration the time when the studies search process was performed, i.e., the researcher should limit the search time to March 2016.

Related work
============

There are few systematic reviews concerning privacy/securities ontologies. For instance, Souag et al. [@souag2012ontologies] performed a systematic review that proposes an analysis and a typology of existing security ontologies. While Blanco et al. [@blanco2008systematic] conducted a systematic review with a main aim for identifying, extracting and analyzing the main proposals for security ontologies. Fabian et al. [@fabian2010comparison] present a conceptual framework for security requirements engineering by mapping the diverse terminologies of different security requirements engineering methods to that framework. Moreover, a security ontology for capturing security requirements have been presented in [@souag2015security]. However, the focus of all the previously mentioned studies was security ontology.

On the other hand, Blanco et al. [@blanco2011basis] conduct a systematic review for extracting the key requirements that an integrated and unified security ontology should have. While Mellado et al. [@mellado2010systematic] carried out a systematic review of the existing literature concerning security requirements engineering in order to summarize the current contributions and to provide a road map for future research in this area. Iankoulova and Daneva [@iankoulova2012cloud] performed a systematic review concerning the security requirements of cloud computing. In particular, they have classified the main identified security requirements under nine sub-areas: access control, attack/harm detection, non-repudiation, integrity, security auditing, physical protection, privacy, recovery, and prosecution. Li [@li2011empirical] conducted a systematic review concerning online information privacy concerns, consequences, and moderating effects. Based on the review outcome, he proposed a framework to illustrate the relationships between the previously mentioned factors and to highlight opportunities for further improvement. Finally, Fern[á]{}ndez-Alem[á]{}n et al. [@fernandez2013security] performed systematic literature review for identifying and analyzing critical privacy and security aspects of the electronic health record systems.

Conclusions and Future Work
===========================

In this paper, we argued that many wrong design decisions might be made due to the insufficient knowledge about the privacy-related concepts, and we advocate that a well-defined privacy ontology that captures the privacy related concepts along with their interrelations can solve this problem. Therefore, we conduct a systematic review concerning the existing privacy/security literature with a main purpose of identifying the main concepts along with their interrelation for capturing privacy requirements. The objectives of the research were considered to have been achieved since the research questions posed have been answered. Moreover, we used the identified concepts/relations for proposing a privacy ontology to be used by software engineers while dealing with privacy requirements.

For future work, we aim to develop core privacy ontology to be used by software/security engineers when dealing with privacy requirements. To achieve that, we are planning to contact the authors of the selected studies to get their feedback concerning the proposed privacy ontology. In addition, we will conduct a controlled experiment with software/security engineers to evaluate the usability of the ontology. Finally, we plan to evaluate the completeness and validity of the ontology by deploying it to capture the privacy requirements for two real case studies that belong to different domains (e.g., medical sector and public administration).

[100]{}

Simont: A security information management ontology framework. In [*Secure and Trust Computing, Data Management and Applications*]{}. Springer, 2011, pp. 201–208.

Is there a cost to privacy breaches? an event study. (2006), 94.

: Context correlation for trust bootstrapping in pervasive environment. In [*4th International Conference on Intelligent Environments (IET)*]{} (2008), IET, pp. 1–8.

Ontology of e-learning security. In [*Information Society (i-Society), 2010 International Conference on*]{} (2010), IEEE, pp. 652–655.

Model driven security engineering for the realization of dynamic security requirements in collaborative systems. In [*Models in Software Engineering*]{}. Springer, 2006, pp. 278–287.

Agent models and different user ontologies for an electronic market place. , 1 (2004), 1–41.

Hipaa compliance and smart cards: Solutions to privacy and security requirements. (2003).

A scheme for privacy-preserving ontology mapping. In [*Proceedings of the 18th International Database Engineering & Applications Symposium*]{} (2014), ACM, pp. 87–95.

A framework for modular erdf ontologies. , 3-4 (2013), 189–249.

Analyzing website privacy requirements using a privacy goal taxonomy. In [*Requirements Engineering, 2002. Proceedings. IEEE Joint International Conference on*]{} (2002), IEEE, pp. 23–31.

Gene ontology: tool for the unification of biology. , 1 (2000), 25–29.

An interoperable security framework for connected healthcare. In [*Consumer Communications and Networking Conference (CCNC), 2011 IEEE*]{} (2011), IEEE, pp. 116–120.

From trust to dependability through risk analysis. In [*The Second InternationalConference on Availability, Reliability and Security, ARES’07.*]{} (2007), IEEE, pp. 19–26.

Risk modelling and reasoning in goal models, technical report [DIT]{}-06-008. Tech. rep., Universit[á]{} degli studi di Trento, 2006.

Risk as dependability metrics for the evaluation of business solutions: a model-driven approach. In [*Third Conference on Availability, Reliability and Security, ARES08*]{} (2008), IEEE, pp. 1240–1247.

Basic concepts and taxonomy of dependable and secure computing. , 1 (2004), 11–33.

A framework for exploiting security expertise in application development. In [*Trust and Privacy in Digital Business*]{}. Springer, 2006, pp. 62–70.

Privacy-preserving reasoning on the semanticweb. In [*International Conference on Web Intelligence, IEEE/WIC/ACM*]{} (2007), IEEE, pp. 791–797.

Ontology-based identification of research gaps and immature research areas. In [*Multidisciplinary Research and Practice for Information Systems*]{}. Springer, 2012, pp. 1–16.

Semantic matching of web services security policies. In [*Risk and Security of Internet and Systems (CRiSIS), 2012 7th International Conference on*]{} (2012), IEEE, pp. 1–8.

What is computer security? , 1 (2003), 67–69.

A security ontology for incident analysis. In [*Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research*]{} (2010), ACM, p. 46.

Basis for an integrated security ontology according to a systematic review of existing proposals. , 4 (2011), 372–388.

A systematic review and comparison of security ontologies. In [*3rd Conference on Availability, Reliability and Security, ARES ’08*]{} (2008), IEEE, pp. 813–820.

Enhancing privacy and authorization control scalability in the grid through ontologies. , 1 (2009), 16–24.

Intelligent security and privacy solutions for enabling personalized telepathology. , Suppl 1 (2011), S4.

The image protector-a flexible security rule specification toolkit. In [*Security and Cryptography (SECRYPT), 2011 Proceedings of the International Conference on*]{} (2011), IEEE, pp. 345–350.

Introducing privacy in a hospital information system. In [*Proceedings of the fourth international workshop on Software engineering for secure systems*]{} (2008), ACM, pp. 9–16.

. School of Information Technologies, University of Sydney, 2004.

Analyzing regulatory rules for privacy and security requirements. , 1 (2008), 5–20.

Eddy, a formal language for specifying and analyzing data flow specifications for conflicting privacy requirements. , 3 (2014), 281–307.

Tropos: An agent-oriented software development methodology. , 3 (2004), 203–236.

Designing for trust. In [*Trust, reputation, and security: Theories and practice*]{}. Springer, 2002, pp. 15–29.

The economic cost of publicly announced information security breaches: empirical evidence from the stock market. , 3 (2003), 431–448.

Security conscious web service composition. In [*International Conference on Web Services ICWS’06*]{} (2006), IEEE, pp. 489–496.

Privacy by design: Origins, meaning, and prospects. (2011), 170.

Privacy by design: The 7 foundational principles. (2009).

Managing identities via interactions between ontologies. In [*On The Move to Meaningful Internet Systems OTM Workshops*]{} (2003), Springer, pp. 732–740.

Knowledge modeling for privacy-by-design in smart surveillance solution. In [*Advanced Video and Signal Based Surveillance (AVSS), 2013 10th IEEE International Conference on*]{} (2013), IEEE, pp. 171–176.

Improving privacy and security in multi-authority attribute-based encryption. In [*Proceedings of the 16th ACM conference on Computer and communications security*]{} (2009), ACM, pp. 121–130.

An ontology for context-aware pervasive computing environments. , 03 (2003), 197–207.

The [SOUPA]{} ontology for pervasive computing. In [*Ontologies for agents: Theory and experiences*]{}. Springer, 2005, pp. 233–258.

Intelligent agents meet the semantic web in smart spaces. , 6 (2004), 69–79.

Soupa: Standard ontology for ubiquitous and pervasive applications. In [*Mobile and Ubiquitous Systems: Networking and Services, 2004. MOBIQUITOUS 2004. The First Annual International Conference on*]{} (2004), IEEE, pp. 258–267.

An ontological study of data purpose for privacy policy enforcement. In [*Privacy, Security, Risk and Trust (PASSAT) and Third Inernational Conference on Social Computing (SocialCom)*]{} (2011), IEEE, pp. 1208–1213.

The design of an ontology-based service-oriented architecture framework for traditional chinese medicine healthcare. In [*14th International Conference on e-Health Networking, Applications and Services (Healthcom)*]{} (2012), IEEE, pp. 353–356.

Trust in electronic environments. In [*System Sciences, 2003. Proceedings of the 36th Annual Hawaii International Conference on*]{} (2003), Ieee, pp. 10–pp.

Private information retrieval. , 6 (1998), 965–981.

Capturing semantics for information security and privacy assurance. In [*Ubiquitous Intelligence and Computing*]{}. Springer, 2008, pp. 105–118.

Enabling access control and privacy through ontology. In [*Innovations in Information Technology, 2007. IIT’07. 4th International Conference on*]{} (2007), IEEE, pp. 168–172.

Ontology-based matching of security attributes for personal data access in e-health. In [*On the Move to Meaningful Internet Systems: OTM 2011*]{}. Springer, 2011, pp. 605–616.

Context ontology for secure interoperability. In [*Availability, Reliability and Security, 2008. ARES 08. Third International Conference on*]{} (2008), IEEE, pp. 821–827.

How to capture, model, and verify the knowledge of legal, security, and privacy experts: a pattern-based approach. In [*Proceedings of the 11th international conference on Artificial intelligence and law*]{} (2007), ACM, pp. 149–153.

Dealing with the formal analysis of information security policies through ontologies: A case study. In [*Proceedings of the Third Australasian Workshop on Advances in Ontologies-Volume 85*]{} (2007), Australian Computer Society, Inc., pp. 55–60.

An ontology for run-time verification of security certificates for soa. In [*7th International Conference on Availability, Reliability and Security (ARES)*]{} (2012), IEEE, pp. 525–533.

Pattern-based security requirements specification using ontologies and boilerplates. In [*Requirements Patterns (RePa), 2012 IEEE Second International Workshop on*]{} (2012), IEEE, pp. 54–59.

Coresec: an ontology of security aplied to the business process of management. In [*Proceedings of the 2008 Euro American Conference on Telematics and Information Systems*]{} (2008), ACM, p. 13.

Regulatory ontologies: An intellectual property rights approach. In [*On The Move to Meaningful Internet Systems 2003: OTM 2003 Workshops*]{} (2003), Springer, pp. 621–634.

The [CORAS]{} methodology: model-based risk assessment using [UML]{} and up. (2003), 332–357.

Security for daml web services: Annotation and matchmaking. In [*The Semantic Web-ISWC*]{}. Springer, 2003, pp. 335–350.

. Springer, 2006.

Toward a security ontology. , 3 (2003), 0006–7.

A knowledge-based approach to security requirements for e-health applications. (2006).

Security requirements for a semantic service-oriented architecture. In [*Availability, Reliability and Security, 2007. ARES 2007. The Second International Conference on*]{} (2007), IEEE, pp. 366–373.

Ontology-based reasoning in requirements elicitation. In [*Software Engineering and Formal Methods, 2009 Seventh IEEE International Conference on*]{} (2009), IEEE, pp. 263–272.

Reasoning with rules and ontologies. In [*Reasoning web*]{}. Springer, 2006, pp. 93–127.

Ontological mapping of common criteria’s security assurance requirements. In [*New Approaches for Security, Privacy and Trust in Complex Environments*]{}. Springer, 2007, pp. 85–95.

Security ontologies: Improving quantitative risk analysis. In [*System Sciences, 2007. HICSS 2007. 40th Annual Hawaii International Conference on*]{} (2007), IEEE, pp. 156a–156a.

Security ontology: Simulating threats to corporate assets. In [*International Conference on Information Systems Security*]{} (2006), Springer, pp. 249–259.

Privacy and security in e-learning. , 4 (2003), 1–19.

A modeling ontology for integrating vulnerabilities into security requirements conceptual foundations. In [*ER 2009*]{}. Springer, 2009, pp. 99–114.

A vulnerability-centric requirements engineering framework: analyzing security attacks, countermeasures, and requirements based on vulnerabilities. , 1 (2010), 41–62.

Semantic access control in web based communities. In [*Computing in the Global Information Technology, 2008. ICCGI’08. The Third International Multi-Conference on*]{} (2008), IEEE, pp. 131–136.

Isn’t the time ripe for a standard ontology on security of information and networks? In [*Proceedings of the 7th International Conference on Security of Information and Networks*]{} (2014), ACM, p. 1.

Socio-technical systems. management sciences, models and techniques. churchman cw et al, 1960.

Ontology-based security adaptation at run-time. In [*4th IEEE International Conference on Self-Adaptive and Self-Organizing Systems (SASO)*]{} (2010), IEEE, pp. 204–212.

Limiting privacy breaches in privacy preserving data mining. In [*Proceedings of the twenty-second ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems*]{} (2003), ACM, pp. 211–222.

A comparison of security requirements engineering methods. , 1 (2010), 7–40.

Ontologies: A silver bullet for knowledge management and electronic-commerce (2000). .

Ontology-based generation of it-security metrics. In [*Proceedings of the 2010 ACM Symposium on Applied Computing*]{} (2010), ACM, pp. 1833–1839.

Formalizing information security knowledge. In [*Proceedings of the 4th international Symposium on information, Computer, and Communications Security*]{} (2009), ACM, pp. 183–194.

Information security fortification by ontological mapping of the iso/iec 27001 standard. In [*Dependable Computing, 2007. PRDC 2007. 13th Pacific Rim International Symposium on*]{} (2007), IEEE, pp. 381–388.

Security and privacy in electronic health records: A systematic literature review. , 3 (2013), 541–562.

Surveillance ontology for legal, ethical and privacy protection based on skos. In [*Digital Signal Processing (DSP), 2013 18th International Conference on*]{} (2013), IEEE, pp. 1–5.

Security and privacy for web databases and services. In [*Advances in Database Technology-EDBT 2004*]{}. Springer, 2004, pp. 17–28.

Engineering safety and security related requirements for software intensive systems. In [*ICSE Companion*]{} (2007), p. 169.

Security use cases. , 3 (2003).

A taxonomy of security-related requirements. In [*International Workshop on High Assurance Systems (RHAS’05)*]{} (2005), Citeseer.

The ontological interpretation of informational privacy. , 4 (2005), 185–200.

A security architecture for computational grids. In [*Proceedings of the 5th ACM conference on Computer and communications security*]{} (1998), ACM, pp. 83–92.

Ontology guided risk analysis: From informal specifications to formal metrics. In [*Advances in Information and Intelligent Systems*]{}. Springer, 2009, pp. 227–249.

Discovering multidimensional correlations among regulatory requirements to understand risk. , 4 (2011), 16.

Semantic web technologies to reconcile privacy and context awareness. , 3 (2004), 241–260.

Modeling the impact of trust and distrust in agent networks. In [*Proc. of AOIS’01*]{} (2001), pp. 45–58.

An approach for privacy protection based-on ontology. In [*Networks Security Wireless Communications and Trusted Computing (NSWCTC), 2010 Second International Conference on*]{} (2010), vol. 2, IEEE, pp. 397–400.

Towards a base ontology for privacy protection in service-oriented architecture. In [*Service-Oriented Computing and Applications (SOCA), 2009 IEEE International Conference on*]{} (2009), IEEE, pp. 1–8.

Privacy, consumers, and costs: How the lack of privacy costs consumers and why business studies of privacy costs are biased and incomplete. In [*Ford Foundation*]{} (2002).

Analyzing trust requirements in socio-technical systems: A belief-based approach. In [*IFIP Working Conference on The Practice of Enterprise Modeling*]{} (2015), Springer, pp. 254–270.

Privacy requirements: Findings and lessons learned in developing a privacy platform. In [*24nd International Requirements Engineering Conference (RE), to appear*]{} (2016), IEEE.

Modeling security requirements through ownership, permission and delegation. In [*13th International Conference on Requirements Engineering*]{} (2005), IEEE, pp. 167–176.

A framework for security driven software evolution. In [*Automation and Computing (ICAC), 2014 20th International Conference on*]{} (2014), IEEE, pp. 194–199.

, vol. 46. IOS press, 1998.

Monitoring and organizational-level adaptation of multi-agent systems. In [*Proceedings of the Third International Joint Conference on Autonomous Agents and Multiagent Systems-Volume 2*]{} (2004), IEEE Computer Society, pp. 514–521.

Engineering privacy by design. (2011).

Use of ontology technology for standardization of medical records and dealing with associated privacy issues. In [*Industrial Technology, 2006. ICIT 2006. IEEE International Conference on*]{} (2006), IEEE, pp. 2839–2845.

Case study [I]{}: Ontology-based multi-agent system for human disease studies. In [*Ontology-Based Multi-Agent Systems*]{}. Springer, 2009, pp. 179–216.

Security requirements engineering: A framework for representation and analysis. , 1 (2008), 133–153.

A framework for modeling privacy requirements in role engineering. In [*Proc. of REFSQ*]{} (2003), vol. 3, pp. 137–146.

Privacy support and evaluation on an ontological basis. In [*23rd International Conference on Data Engineering Workshop*]{} (2007), IEEE, pp. 221–227.

Privacy ontology support for e-commerce. , 2 (2008), 54–61.

Multi-agent security service architecture for mobile learning. In [*Information Technology: Research and Education, 2004. ITRE 2004. 2nd International Conference on*]{} (2004), IEEE, pp. 91–95.

Ontology-enabled access control and privacy recommendations. In [*Mining, Modeling, and Recommending’Things’ in Social Media*]{}. Springer, 2015, pp. 35–54.

Event-based applications and enabling technologies. In [*Proceedings of the Third ACM International Conference on Distributed Event-Based Systems*]{} (2009), ACM, p. 1.

Privacy risk models for designing privacy-sensitive ubiquitous computing systems. In [*Proceedings of the 5th conference on Designing interactive systems: processes, practices, methods, and techniques*]{} (2004), ACM, pp. 91–100.

Towards combining ontologies and model weaving for the evolution of requirements models. In [*Innovations for requirement analysis. From stakeholders’ needs to formal designs*]{}. Springer, 2007, pp. 85–102.

A light-weight ranger intrusion detection system on wireless sensor networks. In [*Fifth International Conference on Genetic and Evolutionary Computing (ICGEC)*]{} (2011), IEEE, pp. 49–52.

Cloud computing security requirements: A systematic review. In [*2012 Sixth International Conference on Research Challenges in Information Science (RCIS)*]{} (2012), IEEE, pp. 1–7.

Specifying an access control model for ontologies for the semantic web. In [*Secure Data Management*]{}. Springer, 2005, pp. 73–85.

Intrusion correlation using ontologies and multi-agent systems. In [*Information Security and Assurance*]{}. Springer, 2010, pp. 51–63.

Risk evaluation for personal identity management based on privacy attribute ontology. In [*Conceptual Modeling-ER 2008*]{}. Springer, 2008, pp. 183–198.

Guidelines on security and privacy in public cloud computing. (2011), 144.

Decision support for partially moving applications to the cloud: the example of business intelligence. In [*Proceedings of the 2013 international workshop on Hot topics in cloud services*]{} (2013), ACM, pp. 35–42.

Umlsec: Extending [UML]{} for secure systems development. In [*UML The Unified Modeling Language*]{}. Springer, 2002, pp. 412–425.

Introducing the common non-functional ontology. In [*Enterprise Interoperability II*]{}. Springer, 2007, pp. 633–645.

User-centric social context information management: an ontology-based approach and platform. , 5 (2014), 1061–1083.

Security and privacy challenges in open and dynamic environments. , 6 (2006), 89–91.

Authorization and privacy for semantic web services. , 4 (2004), 50–56.

Using domain ontology as domain knowledge for requirements elicitation. In [*Requirements Engineering, 14th IEEE International Conference*]{} (2006), IEEE, pp. 189–198.

Dealing with privacy issues during the system design process. In [*Signal Processing and Information Technology, 2005. Proceedings of the Fifth IEEE International Symposium on*]{} (2005), IEEE, pp. 546–551.

Addressing privacy requirements in system design: the [P]{}ri[S]{} method. , 3 (2008), 241–255.

Ontology alignment in rfid privacy protection. In [*Complex, Intelligent and Software Intensive Systems, 2009. CISIS’09. International Conference on*]{} (2009), IEEE, pp. 718–723.

A security ontology with mda for software development. In [*Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), 2013 International Conference on*]{} (2013), IEEE, pp. 67–74.

An ontology for secure e-government applications. In [*Availability, Reliability and Security, 2006. ARES 2006. The First International Conference on*]{} (2006), IEEE, pp. 5–pp.

An ontology-based approach to context-aware access control for software services. In [*Web Information Systems Engineering–WISE 2013*]{}. Springer, 2013, pp. 410–420.

A semantic policy framework for context-aware access control applications. In [*12th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)*]{} (2013), IEEE, pp. 753–762.

. Guidelines for performing systematic literature reviews in software engineering. Tech. rep., Keele University, 2007.

Security oriented service composition: A framework. In [*Innovations in Information Technology (IIT), 2012 International Conference on*]{} (2012), IEEE, pp. 48–53.

Security ontology for annotating resources. In [*OTM Confederated International Conferences“ On the Move to Meaningful Internet Systems”*]{} (2005), Springer, pp. 1483–1499.

Procedures for performing systematic reviews. , 2004 (2004), 1–26.

Contrology-an ontology-based cloud assurance approach. In [*4th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE)*]{} (2015), IEEE, pp. 105–107.

Privacy analysis using ontologies. In [*Proceedings of the second ACM conference on Data and Application Security and Privacy*]{} (2012), ACM, pp. 205–216.

Privacy verification using ontologies. In [*Availability, Reliability and Security (ARES), 2011 Sixth International Conference on*]{} (2011), IEEE, pp. 627–632.

Deriving implementation-level policies for usage control enforcement. In [*Proceedings of the second ACM conference on Data and Application Security and Privacy*]{} (2012), ACM, pp. 83–94.

Modeling of privacy-aware business processes in bpmn to protect personal data. In [*Proceedings of the 29th Annual ACM Symposium on Applied Computing*]{} (2014), ACM, pp. 1399–1405.

A conceptual meta-model for secured information systems. In [*Proceedings of the 7th International Workshop on Software Engineering for Secure Systems*]{} (2011), ACM, pp. 22–28.

Privacy by design—principles of privacy-aware ubiquitous systems. In [*Ubicomp 2001: Ubiquitous Computing*]{} (2001), Springer, pp. 273–291.

Ontology of secure service level agreement. In [*High Assurance Systems Engineering (HASE), 2015 IEEE 16th International Symposium on*]{} (2015), IEEE, pp. 166–172.

Building problem domain ontology from security requirements in regulatory documents. In [*Proceedings of the 2006 international workshop on Software engineering for secure systems*]{} (2006), ACM, pp. 43–50.

Data security and privacy in wireless body area networks. , 1 (2010), 51–58.

Empirical studies on online information privacy concerns: literature review and an integrative framework. , 1 (2011), 453–496.

Ontology-based negotiation of security requirements in cloud. In [*Computational Aspects of Social Networks (CASoN), 2012 Fourth International Conference on*]{} (2012), IEEE, pp. 192–197.

Introducing abuse frames for analysing security requirements. In [*11th Requirements Engineering International Conference*]{} (2003), IEEE, pp. 371–372.

A proxy for privacy: the discreet box. In [*The International Conference on Computer as a Tool, EUROCON*]{} (2007), IEEE, pp. 966–973.

Ontology-based requirements conflicts analysis in activity diagrams. In [*Computational Science and Its Applications–ICCSA 2009*]{}. Springer, 2009, pp. 1–12.

Security and privacy requirements analysis within a social setting. In [*11th International Requirements Engineering Conference*]{} (2003), IEEE, pp. 151–161.

Enterprise knowledge management and conceptual modelling. In [*Conceptual Modeling*]{}. Springer, 1999, pp. 123–143.

A collaborative ontology development tool for information security managers. In [*Proceedings of the 4th Symposium on Computer Human Interaction for the Management of Information Technology*]{} (2010), ACM, p. 5.

The dangers of poor construct conceptualization. , 3 (2003), 323–326.

Methodology for information systems risk analysis and management, 2006.

Detecting privacy in attention aware system. In [*Intelligent Environments, 2006. IE 06. 2nd IET International Conference on*]{} (2006), vol. 2, IET, pp. 231–239.

Retracted: shared ontology for pervasive computing. In [*Advances in Computer Science–ASIAN 2005. Data Management on the Web*]{}. Springer, 2005, pp. 64–78.

An extended ontology for security requirements. In [*Advanced Information Systems Engineering Workshops*]{} (2011), Springer, pp. 622–636.

Computer-aided support for secure tropos. , 3 (2007), 341–364.

An ontology for secure socio-technical systems. (2007), 469.

Using a security requirements engineering methodology in practice: the compliance with the italian data protection legislation. , 5 (2005), 445–455.

Detecting conflicts between functional and security requirements with secure tropos: John rusnak and the allied irish bank. (2008).

Adapting [S]{}ecure [T]{}ropos for security risk management in the early phases of information systems development. In [*Advanced Information Systems Engineering*]{} (2008), Springer, pp. 541–555.

The production rule framework: developing a canonical set of software requirements for compliance with law. In [*proceedings of the 1st ACM International Health Informatics Symposium*]{} (2010), ACM, pp. 629–636.

. PhD thesis, University of Namur, 2009.

Towards a risk-based security requirements engineering framework. In [*Workshop on Requirements Engineering for Software Quality. In Proc. of REFSQ*]{} (2005), vol. 5.

Use of ontologies in pervasive computing environments. (2003).

A systematic review of security requirements engineering. , 4 (2010), 153–165.

Development of an ontology-based smart card system reference architecture. In [*Ontologies*]{}. Springer, 2007, pp. 841–863.

Ontology-based evaluation of iso 27001. In [*I3E*]{} (2010), Springer, pp. 93–102.

Privacy-preserving ontology matching. In [*AAAI Workshop on Context and Ontologies*]{} (2005).

Privacy-preserving semantic interoperation and access control of heterogeneous databases. In [*Proceedings of the 2006 ACM Symposium on Information, computer and communications security*]{} (2006), ACM, pp. 66–77.

A legal ontology to support privacy preservation in location-based services. In [*On the Move to Meaningful Internet Systems: OTM Workshops*]{} (2006), Springer, pp. 1755–1764.

Semantic annotations for security policy matching in ws-policy. In [*Security and Cryptography (SECRYPT), 2011 Proceedings of the International Conference on*]{} (2011), IEEE, pp. 443–449.

Secure [Tropos]{}: A security-oriented extension of the [Tropos]{} methodology. , 2 (2007), 285–309.

An ontology for modelling security: The tropos approach. In [*Knowledge-Based Intelligent Information and Engineering Systems*]{} (2003), Springer, pp. 1387–1394.

Surprise: user-controlled granular privacy and security for personal data in smartercontext. In [*Proceedings of the 2012 Conference of the Center for Advanced Studies on Collaborative Research*]{} (2012), IBM Corp., pp. 131–145.

Accounting for social, spatial, and textual interconnections. In [*Computer Applications for Handling Legal Evidence, Police Investigation and Case Argumentation*]{}. Springer, 2012, pp. 483–765.

Cryptographic approach to “privacy-friendly” tags. In [*RFID privacy workshop*]{} (2003), vol. 82, Cambridge, USA.

Managing security and privacy in ubiquitous ehealth information interchange. In [*Proceedings of the 5th International Conference on Ubiquitous Information Management and Communication*]{} (2011), ACM, p. 26.

Database privacy: balancing confidentiality, integrity and availability. , 2 (2002), 20–27.

-tool: Security requirements engineering for socio-technical systems. In [*Engineering Secure Future Internet Services and Systems*]{}. Springer, 2014, pp. 65–96.

Efficient projection of ontologies.

Leveraging ontologies upon a holistic privacy-aware access control model. In [*Foundations and Practice of Security*]{}. Springer, 2014, pp. 209–226.

An information security ontology incorporating human-behavioural implications. In [*Proceedings of the 2nd International Conference on Security of Information and Networks*]{} (2009), ACM, pp. 46–55.

An ontology based approach to information security. In [*Metadata and Semantic Research*]{}. Springer, 2009, pp. 183–192.

Spins: Security protocols for sensor networks. , 5 (2002), 521–534.

Property attestation—scalable and privacy-friendly security assessment of peer computers.

Privacy compliance in european healthgrid domains: An ontology-based approach. In [*Computer-Based Medical Systems, 2009. CBMS 2009. 22nd IEEE International Symposium on*]{} (2009), IEEE, pp. 1–8.

Ontology views: a theoretical perspective. In [*On the Move to Meaningful Internet Systems 2006: OTM 2006 Workshops*]{} (2006), Springer, pp. 1814–1824.

Ontologies in a pervasive computing environment. In [*Workshop on Ontologies in Distributed Systems at IJCAI, Acapulco, Mexico*]{} (2003), Citeseer.

Ontology in information security: a useful theoretical foundation and methodological tool. In [*Proceedings of the 2001 workshop on New security paradigms*]{} (2001), ACM, pp. 53–59.

Preserving privacy in web services. In [*Proceedings of the 4th international workshop on Web information and data management*]{} (2002), ACM, pp. 56–62.

A survey on ontologies for human behavior recognition. , 4 (2014), 43.

An extended misuse case notation: Including vulnerabilities and the insider threat. In [*International Working Conference on Requirements Engineering: Foundation for Software Quality*]{} (2006), Springer, pp. 33–34.

Guidelines for conducting and reporting case study research in software engineering. , 2 (2009), 131–164.

Ontology-based platform for trusted regulatory compliance services. In [*On The Move to Meaningful Internet Systems Workshops OTM*]{} (2003), Springer, pp. 675–689.

A privacy preference ontology (ppo) for linked data. In [*LDOW*]{} (2011), Citeseer.

Role-based access control models yz. , 2 (1996), 38–47.

Secure enterprise interoperability ontology for semantic integration of business to business applications. In [*P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC), 2013 Eighth International Conference on*]{} (2013), IEEE, pp. 68–75.

Towards knowledge level privacy and security using rdf/rdfs and rbac. In [*Semantic Computing (ICSC), 2015 IEEE International Conference on*]{} (2015), IEEE, pp. 264–267.

The epistemology of computer security. , 6 (2009), 8–10.

What are information security ontologies useful for? In [*Metadata and Semantics Research*]{}. Springer, 2015, pp. 51–61.

Eliciting security requirements with misuse cases. , 1 (2005), 34–44.

A comparative study of cloud security ontologies. In [*Reliability, Infocom Technologies and Optimization (ICRITO)(Trends and Future Directions), 2014 3rd International Conference on*]{} (2014), IEEE, pp. 1–6.

Revisiting security ontologies. (2014).

Ontologies for modeling enterprise level security metrics. In [*Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research*]{} (2010), ACM, p. 58.

An information privacy taxonomy for collaborative environments. , 4 (2006), 382–394.

Conceptualizing privacy. (2002), 1087–1155.

A taxonomy of privacy. (2006), 477–564.

Large-scale complex [IT]{} systems. , 7 (2012), 71–77.

Ict tools and systems supporting innovation in product/process development. (2009), 113–152.

Towards a new generation of security requirements definition methodology using ontologies. In [*24th International Conference on Advanced Information Systems Engineering (CAiSE’12)*]{} (2012), pp. 1–8.

Reusable knowledge in security requirements engineering: a systematic mapping study. (2015), 1–33.

Ontologies for security requirements: A literature survey and classification. In [*Advanced Information Systems Engineering Workshops*]{} (2012), Springer, pp. 61–69.

A security ontology for security requirements elicitation. In [*Engineering Secure Software and Systems*]{}. Springer, 2015, pp. 157–177.

Using security and domain ontologies for security requirements analysis. In [*Computer Software and Applications Conference Workshops (COMPSACW), 2013 IEEE 37th Annual*]{} (2013), IEEE, pp. 101–107.

Evaluating automatically a text miner for ontologies: a catch-22 situation? In [*On the Move to Meaningful Internet Systems: OTM 2008*]{}. Springer, 2008, pp. 1404–1422.

Achieving privacy in trust negotiations with an ontology-based approach. , 1 (2006), 13–30.

Safe: Secure and big data-adaptive framework for efficient cross-domain communication. In [*Proceedings of the First International Workshop on Privacy and Secuirty of Big Data*]{} (2014), ACM, pp. 19–28.

Ontology guided xml security engine. , 3 (2004), 209–223.

Privacy preserving modules for ontologies. In [*Perspectives of Systems Informatics*]{}. Springer, 2009, pp. 380–387.

Trust-terms ontology for defining security requirements and metrics. In [*Proceedings of the Fourth European Conference on Software Architecture: Companion Volume*]{} (2010), ACM, pp. 175–180.

Towards cross-domain security properties supported by ontologies. In [*Web Information Systems (WISE) Workshops*]{} (2004), Springer, pp. 58–69.

Security and privacy challenges in cloud computing environments. , 6 (2010), 24–31.

Security issues in a soa-based provenance system. In [*Provenance and Annotation of Data*]{}. Springer, 2006, pp. 203–211.

A framework for multi-agent system engineering using ontology domain modelling for security architecture risk assessment in e-commerce security services. In [*3rd IEEE International Symposium on Network Computing and Applications(NCA)*]{} (2004), IEEE, pp. 409–412.

Hit considerations: Informatics and technology needs and considerations. In [*Integration of Medical and Dental Care and Patient Data*]{}. Springer, 2012, pp. 25–137.

. Cengage Learning, 2006.

Introducing privacy awareness in network monitoring ontologies. In [*Trustworthy Internet*]{}. Springer, 2011, pp. 317–331.

Towards an ontology-based security management. In [*20th International Conference on Advanced Information Networking and Applications (AINA)*]{} (2006), vol. 1, IEEE, pp. 985–992.

Security-by-ontology: A knowledge-centric approach. In [*Security and Privacy in Dynamic Environments*]{}. Springer, 2006, pp. 99–110.

Modeling computer attacks: An ontology for intrusion detection. In [*Recent Advances in Intrusion Detection*]{} (2003), Springer, pp. 113–135.

Ontologies: Principles, methods and applications. , 02 (1996), 93–136.

Handbook of privacy and privacy-enhancing technologies. (2003).

Elaborating security requirements by construction of intentional anti-models. In [*Proceedings of the 26th International Conference on Software Engineering*]{} (2004), IEEE Computer Society, pp. 148–157.

Modelling reusable security requirements based on an ontology framework. , 2 (2009), 119.

Privacy protection for smartphones: an ontology-based firewall. In [*Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication*]{}. Springer, 2011, pp. 371–380.

An ontological approach applied to information security and trust. (2007), 114.

Security attack ontology for web services. In [*Semantics, Knowledge and Grid, 2006. SKG’06. Second International Conference on*]{} (2006), IEEE, pp. 42–42.

Specifying dynamic security properties of web service based systems. In [*Semantics, Knowledge and Grid, 2006. SKG’06. Second International Conference on*]{} (2006), IEEE, pp. 34–34.

An ontology framework for managing security attacks and defences in component based software systems. In [*Software Engineering, 2008. ASWEC 2008. 19th Australian Conference on*]{} (2008), IEEE, pp. 552–561.

Ontology-based analysis of information security standards and capabilities for their harmonization. In [*Proceedings of the 3rd international conference on Security of information and networks*]{} (2010), ACM, pp. 137–141.

: an ontology for vulnerability management. In [*Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research*]{} (2009), ACM, p. 34.

Environmental metrics for software security based on a vulnerability ontology. In [*Secure Software Integration and Reliability Improvement, 2009. SSIRI 2009. Third IEEE International Conference on*]{} (2009), IEEE, pp. 159–168.

Using ontologies to perform threat analysis and develop defensive strategies for mobile security. , 1–25.

A taxonomy for privacy. Tech. rep., DTIC Document, 1981.

Internet of things - new security and privacy challenges. , 1 (2010), 23–30.

Mining and analysing security goal models in health information systems. In [*Software Engineering in Health Care, 2009. SEHC’09. ICSE Workshop on*]{} (2009), IEEE, pp. 42–52.

Research on semantic-based security services model of soa. In [*E-Business and Information System Security, 2009. EBISS’09. International Conference on*]{} (2009), IEEE, pp. 1–4.

The design and enforcement of a rule-based constraint policy language for service composition. In [*Social Computing (SocialCom), 2010 IEEE Second International Conference on*]{} (2010), IEEE, pp. 873–880.

. Springer, 2004.

Ontology-based information content security analysis. In [*Fuzzy Systems and Knowledge Discovery, 2008. FSKD’08. Fifth International Conference on*]{} (2008), vol. 5, IEEE, pp. 479–483.

A framework for specifying and managing security requirements in collaborative systems. In [*Autonomic and Trusted Computing*]{}. Springer, 2006, pp. 500–510.

Hierarchical situation modeling and reasoning for pervasive computing. In [*Software Technologies for Future Embedded and Ubiquitous Systems, 2006 and the 2006 Second International Workshop on Collaborative Computing, Integration, and Assurance. SEUS 2006/WCCIA 2006. The Fourth IEEE Workshop on*]{} (2006), IEEE, pp. 6–pp.

An adaptable security framework for service-based systems. In [*10th International Workshop on Object-Oriented Real-Time Dependable Systems (WORDS)*]{} (2005), IEEE, pp. 28–35.

Designing for privacy and other competing requirements. In [*2nd Symposium on Requirements Engineering for Information Security (SREIS’02), Raleigh, North Carolina*]{} (2002), Citeseer, pp. 15–16.

Enforcing a security pattern in stakeholder goal models. In [*Proceedings of the 4th ACM Workshop on Quality of Protection*]{} (2008), ACM, pp. 9–14.

. PhD thesis, University of Trento, 2006.

Developing a privacy ontology for privacy control in context-aware systems. Tech. rep., 2006.

Appendix A: Quality assessment application {#appendix-a-quality-assessment-application .unnumbered}
==========================================

[ | p[0.6cm]{} | p[2.3cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.3cm]{} | p[0.6cm]{} | p[2.3cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.5cm]{} | p[0.3cm]{} | ]{}

**N & **ID & **Q1 & **Q2 & **Q3 & **Q4 & **Q5 & **S. & **N & **ID & **Q1 & **Q2 & **Q3 & **Q4 & **Q5 & **S\
********************************

****1** & ACM\_02 [@chase2009improving] & ****-** & ****-** & ****-** & ****1** & ****1** & ****2** &**************

****2** & ACM\_03 [@van2004elaborating] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****3** & ACM\_04 [@rezgui2002preserving] & ****-** & ****-** & ****-** & ****1** & ****1** & ****2** &****************************

****4** & ACM\_05 [@kost2012privacy] & ****1** & ****1** & ****-** & ****-** & ****-** & ****2**\
****5** & ACM\_06 [@gandhi2011discovering] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****6** & ACM\_07 [@hinze2009event] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****7** & ACM\_08 [@oladimeji2011managing] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****8** & ACM\_10 [@srinivasan2014safe] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****9** & ACM\_11 [@weber2009mining] & ****-** & ****-** & ****-** & ****-** & ****1** & ****1** &****************************

****10** & ACM\_13 [@munoz2012surprise] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2**\
****11** & ACM\_14 [@labda2014modeling] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4** &****************************

****12** & ACM\_16 [@braghin2008introducing] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
****13** & ACM\_17 [@compagna2007capture] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****14** & ACM\_18 [@yu2008enforcing] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****15** & ACM\_19 [@maxwell2010production] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****16** & ACM\_22 [@studer2009privacy] & ****1** & ****1** & ****-** & ****1** & ****-** & ****3**\
****17** & ACM\_23 [@mitra2006privacy] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****18** & ACM\_24 [@sullivan2010trust] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0**\
****19** & ACM\_26 [@mace2010collaborative] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****20** & ACM\_28 [@schaefer2009epistemology] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0**\
****21** & ACM\_30 [@yau2006framework] & ****1** & ****1** & ****-** & ****1** & ****-** & ****3** &****************************

****22** & ACM\_32 [@alam2006model] & ****1** & ****1** & ****-** & ****-** & ****-** & ****2**\
****23** & ACM\_34 [@fenz2010ontology] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-** &****************************

****24** & ACM\_35 [@singhal2010ontologies] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
****25** & ACM\_36 [@blackwell2010security] & ****-** & ****-** & ****1** & ****-** & ****-** & ****1** &****************************

****26** & ACM\_37 [@da2007dealing] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0**\
****27** & ACM\_40 [@wang2009ovm] & ****1** & ****1** & ****1** & ****-** & ****1** & ****4** &****************************

****28** & IEEE\_03 [@kost2011privacy] & ****1** & ****1** & ****-** & ****-** & ****-** & ****2**\
****29** & IEEE\_09 [@rahmouni2009privacy] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****30** & IEEE\_11 [@liccardo2012ontology] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****31** & IEEE\_12 [@souag2013using] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****32** & IEEE\_13 [@daramola2012pattern] & ****-** & ****1** & ****-** & ****-** & ****-** & ****1**\
****33** & IEEE\_14 [@yau2006hierarchical] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****34** & IEEE\_15 [@tsoumas2006towards] & ****1** & ****1** & ****1** & ****-** & ****1** & ****4**\
****35** & IEEE\_18 [@squicciarini2006achieving] & ****1** & ****1** & ****-** & ****1** & ****-** & ****3** &****************************

****36** & IEEE\_19 [@firesmith2007engineering] & ****1** & ****1** & ****-** & ****-** & ****-** & ****2**\
****37** & IEEE\_21 [@wang2009environmental] & ****1** & ****-** & ****1** & ****1** & ****-** & ****3** &****************************

****38** & IEEE\_25 [@chen2004soupa] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****39** & IEEE\_26 [@akmayeva2010ontology] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0** &****************************

****40** & IEEE\_28 [@coma2008context] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****41** & IEEE\_30 [@maisonnasse2006detecting] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****42** & IEEE\_33 [@gao2010approach] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0**\
****43** & IEEE\_35 [@chandramouli2013knowledge] & ****1** & ****1** & ****-** & ****1** & ****-** & ****3** &****************************

****44** & IEEE\_36 [@singh2014comparative] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****45** & IEEE\_38 [@lee15ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****46** & IEEE\_41 [@garcia2009towards] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****47** & IEEE\_42 [@fenz2007information] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****48** & IEEE\_48 [@chowdhury2007enabling] & ****1** & ****-** & ****-** & ****1** & ****-** & ****3**\
****49** & IEEE\_49 [@bishop2003computer] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****50** & IEEE\_50 [@Giorgini2005] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****51** & IEEE\_51 [@hecker2008privacy] & ****1** & ****1** & ****1** & ****-** & ****-** & ****3** &****************************

****52** & IEEE\_52 [@hadzic2006use] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****53** & IEEE\_54 [@blanquer2009enhancing] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****54** & IEEE\_56 [@torrellas2004framework] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****55** & IEEE\_57 [@kang2013security] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4** &****************************

****56** & IEEE\_58 [@vorobiev2006security] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****57** & IEEE\_59 [@yan2008ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****58** & IEEE\_60 [@ekelhart2007security] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4**\
****59** & CIT\_01 [@poritz2004property] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****60** & CIT\_07 [@velasco2009modelling] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****61** & CIT\_09 [@breaux2008analyzing] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****62** & CIT\_12 [@chor1998private] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****63** & CIT\_13 [@souag2012towards] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-** &****************************

****64** & CIT\_15 [@ekclhart2007ontological] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2**\
****65** & CIT\_18 [@Massacci2007] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****66** & CIT\_23 [@zhangdeveloping] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****67** & CIT\_26 [@langheinrich2001privacy] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****68** & CIT\_29 [@vorobiev2008ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2**\
****69** & CIT\_31 [@ranganathan2003ontologies] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****70** & CIT\_33 [@liu2003security] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****71** & Spgr\_01 [@kim2005security] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****72** & Spgr\_02 [@fabian2010comparison] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-**\
****73** & Spgr\_03 [@souag2012ontologies] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-** &****************************

****74** & Spgr\_07 [@massacci2011extended] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
****75** & Spgr\_08 [@souag2015security] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-** &****************************

****76** & Spgr\_13 [@elahi2009modeling] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
****77** & Spgr\_14 [@tsoumas2006security] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****78** & Spgr\_18 [@milicevic2010ontology] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****79** & Spgr\_19 [@dhiah2006ontology] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****80** & Spgr\_20 [@vincent2011privacy] & ****-** & ****-** & ****-** & ****-** & ****-** & ****1**\
****81** & Spgr\_22 [@gandhi2009ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****82** & Spgr\_28 [@heupel2015ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2**\
****83** & Spgr\_31 [@chen2005soupa] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****84** & Spgr\_32 [@mouratidis2003ontology] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2**\
****85** & Spgr\_34 [@mitre2006legal] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****86** & Spgr\_35 [@chowdhury2008capturing] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****87** & Spgr\_36 [@pereira2009ontology] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1** &****************************

****88** & Spgr\_38 [@delgado2003regulatory] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
**************

**N & **ID & **Q1 & **Q2 & **Q3 & **Q4 & **Q5 & **S & **N & **ID & **Q1 & **Q2 & **Q3 & **Q4 & **Q5 & **S\
********************************

****89** & Spgr\_41 [@iwaihara2008risk] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &**************

****90** & Spgr\_55 [@ekelhart2006security] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****91** & Spgr\_56 [@abulaish2011simont] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2** &****************************

****92** & Spgr\_58 [@ciuciu2011ontology] & ****1** & ****-** & ****-** & ****-** & ****-** & ****1**\
****93** & Spgr\_60 [@breaux2014eddy] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****94** & SCH\_02 [@chen2003ontology] & ****1** & ****1** & ****-** & ****-** & ****1** & ****3**\
****95** & SCH\_03 [@massacci2005using] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****96** & SCH\_06 [@sacco2011privacy] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2**\
****97** & SCH\_16 [@firesmith2003security] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****98** & SCH\_18 [@sindre2005eliciting] & ****1** & ****-** & ****1** & ****1** & ****1** & ****4**\
****99** & SCH\_20 [@anton2002analyzing] & ****1** & ****1** & ****-** & ****-** & ****1** & ****3** &****************************

****100** & SCH\_24 [@kalloniatis2008addressing] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****101** & SCH\_26 [@haley2008security] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****102** & SCH\_27 [@he2003framework] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3**\
****103** & SCH\_28 [@mouratidis2007secure] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****104** & SCH\_32 [@donner2003toward] & ****-** & ****-** & ****-** & ****-** & ****-** & ****0**\
****105** & SCH\_36 [@alliance2003hipaa] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****106** & SCH\_41 [@solove2006taxonomy] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****107** & SCH\_43 [@skinner2006information] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****108** & Spgr\_18\_01 [@karyda2006ontology] & ****1** & ****-** & ****-** & ****1** & ****-** & ****3**\
****109** & Spgr\_18\_02 [@raskin2001ontology] & ****-** & ****-** & ****-** & ****-** & ****1** & ****1** &****************************

****110** & Spgr\_18\_03 [@fenz2009formalizing] & ****1** & ****1** & ****1** & ****-** & ****1** & ****4**\
****111** & Spgr\_13\_01 [@asnar2008risk] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****112** & Spgr\_13\_02 [@den2003coras] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4**\
****113** & Spgr\_13\_03 [@elahi2010vulnerability] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****114** & Spgr\_13\_04 [@jurjens2002umlsec] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4**\
****115** & Spgr\_13\_05 [@matulevivcius2008adapting] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****116** & Spgr\_13\_06 [@mayer2005towards] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****117** & Spgr\_13\_07 [@rostad2006extended] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****118** & Spgr\_13\_08 [@singh2014revisiting] & ****1** & ****1** & ****-** & ****-** & ****1** & ****3**\
****117** & Spgr\_13\_07 [@rostad2006extended] & ****1** & ****-** & ****-** & ****1** & ****1** & ****3** &****************************

****118** & Spgr\_13\_08 [@singh2014revisiting] & ****1** & ****1** & ****-** & ****-** & ****1** & ****3**\
****119** & Spgr\_08\_01 [@mayer2009model] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5** &****************************

****120** & Spgr\_08\_02 [@velasco2009modelling] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
****121** & Spgr\_08\_03 [@dritsas2006knowledge] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4** &****************************

****122** & Spgr\_07\_01 [@blanco2008systematic] & ****-** & ****-** & ****-** & ****-** & ****-** & ****-**\
****123** & Spgr\_07\_02 [@zannone2006requirements] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4** &****************************

****124** & Spgr\_07\_03 [@lin2003introducing] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2**\
****125** & Spgr\_03\_01 [@avizienis2004basic] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4** &****************************

****126** & Spgr\_03\_02 [@firesmith2005taxonomy] & ****1** & ****-** & ****-** & ****-** & ****1** & ****2**\
****127** & Spgr\_02\_01 [@asnar2007trust] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4** &****************************

****128** & Spgr\_02\_02 [@asnar2006risk] & ****1** & ****1** & ****-** & ****1** & ****1** & ****4**\
****129** & SCH\_24\_01 [@kalloniatis2005dealing] & ****1** & ****-** & ****-** & ****1** & ****-** & ****2** &****************************

****130** & SCH\_24\_02 [@hong2004privacy] & ****1** & ****1** & ****1** & ****1** & ****1** & ****5**\
****131** & SCH\_28\_01 [@paja2014sts] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4** &****************************

****132** & SCH\_43\_01 [@van2003handbook] & ****1** & ****1** & ****1** & ****1** & ****-** & ****4**\
**************

Appendix B: Overview of all the considered studies {#appendix-b-overview-of-all-the-considered-studies .unnumbered}
==================================================

[ | p[0.6cm]{} | p[1.7cm]{} | p[3cm]{} | p[2.9cm]{} | p[1cm]{} | p[0.9cm]{} | p[1.7cm]{} | ]{}

****N** & ****ID** & ****Title** & ****Author(s)** & ****Pub Year** & ****\# Cited** & ****Decision**\
**************

001 & ACM\_01 [@olivier2002database] & Database Privacy, Balancing Conﬁdentiality, Integrity and Availability & Martin S Olivier & 2002 & 30 & Excluded stage 1\

002 & ACM\_02 [@chase2009improving] & Improving privacy and security in multi-authority attribute-based encryption & Melissa Chase, Sherman S.M. Chow & 2009 & 375 & Excluded stage 2\

003 & ACM\_03 [@van2004elaborating] & Elaborating Security Requirements by Construction of Intentional Anti-Models & Axel van Lamsweerde & 2004 & 337 & Selected\

004 & ACM\_04 [@rezgui2002preserving] & Preserving Privacy in Web Services & Abdelmounaam Rezgui, Mourad Ouzzani, Athman Bouguettaya, Medjahed Brahim & 2002 & 102 & Excluded stage 2\

005 & ACM\_05 [@kost2012privacy] & Privacy analysis using ontologies & Martin Kost, Johann Christoph Freytag & 2012 & 9 & Excluded stage 2\

006 & ACM\_06 [@gandhi2011discovering] & Discovering Multidimensional Correlations among Regulatory Requirements to Understand Risk & Robin A. Gandhi, Seok Won Lee & 2011 & 7 & Excluded stage 2\

007 & ACM\_07 [@hinze2009event] & Event-based applications and enabling technologies & Hinze Annika Kai Sachs, Alejandro Buchmann & 2009 & 110 & Excluded stage 2\

008 & ACM\_08 [@oladimeji2011managing] & Managing security and privacy in ubiquitous eHealth information interchange & Ebenezer A. Oladimeji, Lawrence Chung, Hyo Taeg Jung, Kim Jaehyoun & 2011 & 12 & Excluded stage 2\

009 & ACM\_09 [@kumari2012deriving] & Deriving implementation-level policies for usage control enforcement & Prachi Kumari, Alexander Pretschner & 2012 & 18 & Excluded stage 1\

010 & ACM\_10 [@srinivasan2014safe] & SAFE: Secure and Big Data-Adaptive Framework for Efficient Cross-Domain Communication & Avinash Srinivasan, Wu Jie, Zhu Wen & 2014 & 1 & Excluded stage 2\

011 & ACM\_11 [@weber2009mining] & Mining and Analysing Security Goal Models in Health Information Systems & Jens H. Weber-Jahnke, Onabajo Adeniyi & 2009 & 6 & Excluded stage 2\

012 & ACM\_12 [@juan2013decision] & Decision support for partially moving applications to the cloud: the example of business intelligence & Adrian Juan-Verdejo, Henning Baars & 2013 & 10 & Excluded stage 2\

013 & ACM\_13 [@munoz2012surprise] & Surprise: user-controlled granular privacy and security for personal data in Smarter Context & Juan C. Muñoz, Tamura Gabriel, Norha M. Villegas, and Hausi A. Müller & 2012 & 5 & Excluded stage 2\

014 & ACM\_14 [@labda2014modeling] & Modeling of privacy-aware business processes in BPMN to protect personal data & Wadha JLabda, Nikolay Mehandjiev, Pedro Sampaio & 2014 & 0 & Selected\

015 & ACM\_15 [@lammari2011conceptual] & A conceptual meta-model for secured information systems & Nadira Lammari, Jean-Sylvain Bucumi, Jacky Akoka, Isabelle Comyn-Wattiau & 2011 & 2 & Excluded stage 1\

016 & ACM\_16 [@braghin2008introducing] & Introducing privacy in a hospital information system & Stefano Braghin, Alberto Coen-Porisini, Pietro Colombo, Sabrina Sicari, Alberto Trombetta & 2008 & 9 & Selected\

017 & ACM\_17 [@compagna2007capture] & How to capture, model, and verify the knowledge of legal, security, and privacy experts: a pattern-based approach & Luca Compagna, Paul El Khoury, Fabio Massacci, Thomas Reshma, Nicola Zannone & 2007 & 29 & Excluded stage 2\

018 & ACM\_18 [@yu2008enforcing] & Enforcing a Security Pattern in Stakeholder Goal Models & Yijun Yu, Kaiya Haruhiko, Washizaki Hironori, Xiong Yingfei, Hu Zhenjiang, Yoshioka Nobukazu & 2008 & 17 & Excluded stage 2\

019 & ACM\_19 [@maxwell2010production] & The production rule framework: developing a canonical set of software requirements for compliance with law & Jeremy C. Maxwell, Annie I. Antón & 2010 & 15 & Excluded stage 2\

020 & ACM\_20 [@tan2006security] & Security issues in a SOA-Based provenance system & Victor Tan, Paul Groth, Simon Miles, Sheng Jiang, Steve Munroe, Sofia Tsasakou, Luc Moreau & 2006 & 73 & Excluded stage 1\

021 & ACM\_21 [@amagasa2014scheme] & A scheme for privacy-preserving ontology mapping & Toshiyuki Amagasa,Fan Zhang, Jun Sakuma, Hiroyuki Kitagawa & 2014 & 0 & Excluded stage 1\

022 & ACM\_22 [@studer2009privacy] & Privacy preserving modules for ontologies & Thomas Studer & 2010 & 4 & Excluded stage 2\

023 & ACM\_23 [@mitra2006privacy] & Privacy-preserving semantic interoperation and access control of heterogeneous databases & Prasenjit Mitra, Chi-Chun Pan, Peng Liu, and Vijayalakshmi Atluri & 2006 & 35 & Excluded stage 2\

024 & ACM\_24 [@sullivan2010trust] & Trust-terms ontology for defining security requirements and metrics & Kieran Sullivan, Jim Clarke, Barry P. Mulcahy & 2010 & 3 & Excluded stage 2\

025 & ACM\_25 [@kabir2014user] & User-centric social context information management: an ontology-based approach and platform & Muhammad Ashad Kabir, Jun Han, Jian Yu, Alan Colman & 2014 & 9 & Excluded stage 1\

026 & ACM\_26 [@mace2010collaborative] & A collaborative ontology development tool for information security managers & John C. Mace, Simon Parkin, Aad van Moorsel & 2010 & 6 & Excluded stage 2\

027 & ACM\_27 [@bao2007privacy] & Privacy-Preserving Reasoning on the Semantic Web & Jie Bao, Giora Slutzki, Vasant Honavar & 2007 & 37 & Duplicated\

028 & ACM\_28 [@schaefer2009epistemology] & The Epistemology of Computer Security & Robert Schaefer & 2009 & 6 & Excluded stage 2\

029 & ACM\_29 [@rodriguez2014survey] & A Survey on Ontologies for Human Behavior Recognition & Rodríguez, Natalia Díaz and Cuéllar, Manuel P Lilius, Johan Calvo-Flores, Miguel Delgado & 2014 & 17 & Excluded stage 1\

030 & ACM\_30 [@yau2006framework] & A framework for specifying and managing security requirements in collaborative systems & Stephen S. Yau, Chen Zhaoji & 2006 & 17 & Excluded stage 2\

031 & ACM\_31 [@elcci2014isn] & Isn’t the Time Ripe for a Standard Ontology on Security of Information and Networks? & Atilla El[ç]{}i & 2014 & 3 & Excluded stage 1\

032 & ACM\_32 [@alam2006model] & Model driven security engineering for the realization of dynamic security requirements in collaborative systems & Muhammad Alam & 2007 & 14 & Excluded stage 1\

033 & ACM\_33 [@de2008coresec] & CoreSec: an ontology of security applied to the business process of management & Ryan Ribeiro de Azevedo, Fred Freitas, Silas Cardoso de Almeida, Marcelo José SC Almeida, Edson C. de Barros C Filho, Wendell Campos Veras & 2008 & 1 & Excluded stage 1\

034 & ACM\_34 [@fenz2010ontology] & Ontology-based generation of IT-security metrics & Stefan Fenz & 2010 & 21 & Excluded stage 2\

035 & ACM\_35 [@singhal2010ontologies] & Ontologies for Modeling Enterprise Level Security Metrics & Singhal Anoop, Wijesekera Duminda & 2010 & 7 & Selected\

036 & ACM\_36 [@blackwell2010security] & A Security Ontology for Incident Analysis & Clive Blackwell & 2007 & 7 & Excluded stage 2\

037 & ACM\_37 [@da2007dealing] & Dealing with the formal analysis of Information Security policies through ontologies: a case study & Da Silva, G. M. H., Rademaker, A., Vasconcelos, D. R., Amaral, F. N., Bazílio, C., Costa, V. G., Haeusler, E. H & 2007 & 3 & Excluded stage 2\

038 & ACM\_38 [@lee2006building] & Building problem domain ontology from security requirements in regulatory documents & Lee, Seok-Won, Robin Gandhi, Divya Muthurajan, Yavagal Deepak. Ahn Gail-Joon & 2006 & 42 & Excluded stage 1\

039 & ACM\_39 [@vorobiev2010ontology] & Ontology-based analysis of information security standards and capabilities for their harmonization & Vladimir I Vorobiev, Ludmila Fedorchenko, Vadim P Zabolotsky, Alexander V Lyubimov & 2010 & 2 & Excluded stage 1\

040 & ACM\_40 [@wang2009ovm]& OVM: an ontology for vulnerability management & Ju An Wang, Guo Minzhe & 2009 & 40 & Selected\

041 & IEEE\_01 [@kagal2004authorization] & Authorization and privacy for semantic Web services & Lalana Kagal, Tim Finin, Massimo Paolucci, Naveen Srinivasan, Katia Sycara, Grit Denker & 2004 & 242 & Excluded stage 1\

042 & IEEE\_02 [@fernandez2013surveillance] & Surveillance ontology for legal, ethical and privacy protection based on SKOS & Virginia Fernandez Arguedas, Ebroul Izquierdo, Krishna Chandramouli & 2013 & 1 & Excluded stage 1\

043 & IEEE\_03 [@kost2011privacy] & Privacy Verification Using Ontologies & Martin Kost, Johann-Christoph Freytag, Frank Kargl, Antonio Kung & 2011 & 10 & Excluded stage 2\

044 & IEEE\_04 [@kayes2013semantic] & A Semantic Policy Framework for Context-Aware Access Control Applications & ASM Kayes, Jun Han, Alan Colman & 2013 & 1 & Excluded stage 1\

045 & IEEE\_05 [@lioudakis2007proxy] & A Proxy for Privacy: the Discreet Box & Georgios V. Lioudakis, Eleftherios A. Koutsoloukas, Nikolaos Dellas, Sofia Kapellaki, George N. Prezerakos, Dimitra I. Kaklamani, Iakovos S. Venieris & 2007 & 9 & Excluded stage 1\

046 & IEEE\_06 [@modica2011semantic] & Semantic annotations for security policy matching in WS-Policy & Giuseppe Di Modica, Orazio Tomarchio & 2011 & 1 & Excluded stage 1\

047 & IEEE\_07 [@modica2011semantic] & Semantic Security Policy Matching in Service Oriented Architectures & Giuseppe Di Modica, Orazio Tomarchio & 2011 & 4 & Excluded stage 1\

048 & IEEE\_08 [@durbeck2007security] & Security Requirements for a Semantic Service-oriented Architecture & Stefan D[ü]{}rbeck, Rolf Schillinger, Jan Kolter & 2007 & 14 & Excluded stage 1\

049 & IEEE\_09 [@rahmouni2009privacy] & Privacy compliance in European health grid domains: An ontology-based approach & Hanene Boussi Rahmouni, Tony Solomonides, Marco Casassa Mont, Simon Shiu & 2009 & 9 & Excluded stage 2\

050 & IEEE\_10 [@chen2011ontological] & An Ontological Study of Data Purpose for Privacy Policy Enforcement & Shan Chen, Mary-Anne Williams & 2011 & 0 & Excluded stage 1\

051 & IEEE\_11 [@liccardo2012ontology] & Ontology-based Negotiation of Security Requirements in Cloud & Loredana Liccardo, Massimiliano Rak, Giuseppe Di Modica, Orazio Tomarchio & 2012 & 2 & Excluded stage 2\

052 & IEEE\_12 [@souag2013using] & Using Security and Domain ontologies for Security Requirements Analysis & Amina Souag, Camille Salinesi, Isabelle Wattiau, Haris Mouratidis & 2013 & 4 & Selected\

053 & IEEE\_13 [@daramola2012pattern] & Pattern-based security requirements specification using ontologies and boilerplates & Olawande Daramola, Guttorm Sindre, Tor Stalhane & 2012 & 4 & Excluded stage 2\

054 & IEEE\_14 [@yau2006hierarchical] & Hierarchical Situation Modeling and Reasoning for Pervasive Computing & Stephen S Yau, Junwei Liu & 2006 & 83 & Excluded stage 2\

055 & IEEE\_15 [@tsoumas2006towards] & Towards an Ontology-based Security Management & TSOUMAS Bill, GRITZALIS Dimitris & 2006 & 88 & Selected\

056 & IEEE\_16 [@khan2012security] & Security oriented service composition: A framework & Khaled M Khan, Abdelkarim Erradi, Saleh Alhazbi, Jun Han & 2012 & 3 & Excluded stage 1\

057 & IEEE\_17 [@hentea2004multi] & Multi-agent security service architecture for mobile learning & Manana Hentea & 2004 & 6 & Excluded stage 1\

058 & IEEE\_18 [@squicciarini2006achieving] & Achieving privacy in trust negotiations with an ontology-based approach & A. C. Squicciarini, E. Bertino, E. Ferrari, I. Ray & 2006 & 50 & Excluded stage 2\

059 & IEEE\_19 [@firesmith2007engineering] & Engineering Safety and Security Related Requirements for Software Intensive Systems & Donald G. Firesmith & 2007 & 30 & Excluded stage 2\

060 & IEEE\_20 [@chen2004intelligent] & Intelligent agents meet the semantic Web in smart spaces & Harry Chen, Tim Finin, Anupam Joshi, Lalana Kagal, Filip Perich, Dipanjan Chakraborty & 2004 & 277 & Excluded stage 1\

061 & IEEE\_21 [@wang2009environmental] & Environmental Metrics for Software Security Based on a Vulnerability Ontology & Ju An Wang, Minzhe Guo, Hao Wang, Min Xia, Linfeng Zhou & 2009 & 4 & Excluded stage 2\

062 & IEEE\_22 [@bouna2011image] & The image protector - A flexible security rule specification toolkit & Bechara Al Bouna, Richard Chbeir, Alban Gabillon & 2011 & 9 & Excluded stage 1\

063 & IEEE\_23 [@ben2012semantic] & Semantic matching of web services security policies & Monia Ben Brahim, Tarak Chaari, Maher Ben Jemaa, Mohamed Jmaiel & 2012 & 1 & Excluded stage 1\

064 & IEEE\_24 [@chen2012design] & The design of an ontology-based service-oriented architecture framework for traditional Chinese medicine healthcare & Shih-Wei Chen, Yu-Ting Tseng, Tsai-Ya Lai & 2012 & 0 & Excluded stage 1\

065 & IEEE\_25 [@chen2004soupa] & Soupa: Standard ontology for ubiquitous and pervasive applications & Harry Chen, Filip Perich, Tim Finin, Anupam Joshi & 2004 & 634 & Excluded stage 2\

066 & IEEE\_26 [@akmayeva2010ontology] & Ontology of e-Learning security & Galyna Akmayeva, Charles Shoniregun & 2010 & 2 & Excluded stage 2\

067 & IEEE\_27 [@wei2010design] & The Design and Enforcement of a Rule-based Constraint Policy Language for Service Composition & Wei Wei, Ting Yu & 2010 & 1 & Excluded stage 1\

068 & IEEE\_28 [@coma2008context] & Context Ontology for Secure Interoperability & Celine Coma, Nora Cuppens-Boulahia1, Frederic Cuppens, Ana Rosa Cavalli & 2008 & 17 & Excluded stage 2\

069 & IEEE\_29 [@saripalle2015towards] & Towards knowledge level privacy and security using RDF/RDFS and RBAC & Rishi Kanth Saripalle, Alberto De la Rosa Algarin, Timoteus B. Ziminski & 2015 & 0 & Excluded stage 1\

070 & IEEE\_30 [@maisonnasse2006detecting] & Detecting privacy in attention aware system & Maisonnasse, Jéróme, Nicolas Gourier, Oliver Brdiczka, Patrick Reignier, James L. Crowley & 2006 & 4 & Excluded stage 2\

071 & IEEE\_31 [@vorobiev2006specifying] & Specifying Dynamic Security Properties of Web Service Based Systems & Artem Vorobiev, Jun Han & 2006 & 17 & Excluded stage 1\

072 & IEEE\_32 [@elahi2008semantic] & Semantic Access Control in Web Based Communities & Najeeb Elahi, Mohammad MR Chowdhury, Josef Noll & 2008 & 34 & Excluded stage 1\

073 & IEEE\_33 [@gao2010approach] & An Approach for Privacy Protection Based-On Ontology & Feng Gao, Jingsha He, Shufen Peng, Xu Wu, Xiu Liu & 2010 & 9 & Excluded stage 2\

074 & IEEE\_34 [@hsieh2011light] & A Light-Weight Ranger Intrusion Detection System on Wireless Sensor Networks & Chia-Fen Hsieh, Yung-Fa Huang, Rung-Ching Chen & 2011 & 8 & Excluded stage 1\

075 & IEEE\_35 [@chandramouli2013knowledge] & Knowledge modeling for privacy-by-design in smart surveillance solution & Krishna Chandramouli, Virginia Fernandez Arguedas, Ebroul Izquierdo & 2013 & 0 & Excluded stage 2\

076 & IEEE\_36 [@singh2014comparative] & A comparative study of Cloud Security Ontologies & Vaishali Singh, S.K. Pandey & 2014 & 0 & Excluded stage 2\

077 & IEEE\_37 [@bao2007privacy] & Privacy-Preserving Reasoning on the Semantic Web & Jie Bao, Giora Slutzki, Vasant Honavar & 2007 & 37 & Excluded stage 1\

078 & IEEE\_38 [@lee15ontology] & Ontology of Secure Service Level Agreement & Chen-Yu Lee, Krishna M. Kavi, Paul Raymond, Gomathisankaran Mahadevan & 2015 & 0 & Excluded stage 2\

079 & IEEE\_39 [@koinig2015contrology] & Contrology - An Ontology-Based Cloud Assurance Approach & Ulrich Koinig, Simon Tjoa, Jungwoo Ryoo & 2015 & 0 & Excluded stage 1\

080 & IEEE\_40 [@sardis2013secure] & Secure Enterprise Interoperability Ontology for Semantic Integration of Business to Business Applications & Emmanuel Sardis, Spyridon V Gogouvitis, Thanassis Bouras, Panagiotis Gouvas, Theodora Varvarigou & 2015 & 0 & Excluded stage 1\

081 & IEEE\_41 [@garcia2009towards] & Towards a base ontology for privacy protection in service-oriented architecture & Diego Garcia, M. Beatriz F. Toledo, Miriam A. M. Capretz, David S. Allison, Gordon S. Blair, Paul Grace, Carlos Flores & 2009 & 1 & Excluded stage 2\

082 & IEEE\_42 [@fenz2007information] & Information Security Fortification by Ontological Mapping of the ISO/IEC 27001 Standard & Fenz, Stefan, Gernot Goluch, Andreas Ekelhart, Bernhard Riedl, Edgar Weippl & 2007 & 45 & Excluded stage 2\

083 & IEEE\_43 [@ahamed2008cctb] & CCTB: Context Correlation for Trust Bootstrapping in Pervasive Environment & Ahamed, Sheikh Monjur, Mehrab, Mohammad Saiful Islam & 2008 & 9 & Excluded stage 1\

084 & IEEE\_44 [@asim2011interoperable] & An interoperable security framework for connected healthcare & Muhammad Asim, Milan Petkovi/’c, Mike Qu, Changjie Wang & 2011 & 2 & Excluded stage 1\

085 & IEEE\_45 [@guan2014framework] & A framework for security driven software evolution & Hui Guan, Xuan Wang, Hongj Yang & 2014 & 0 & Excluded stage 1\

086 & IEEE\_46 [@wei2009research] & Research on Semantic-Based Security Services Model of SOA & Cuncun Wei, Guanghua Chen, Qianqian Ge & 2009 & 0 & Excluded stage 1\

087 & IEEE\_47 [@ahamed2008cctb] & CCTB: Context Correlation for Trust Bootstrapping in Pervasive Environment & Ahamed, Sheikh I and Monjur, Mehrab and Islam, Mohammad Saiful & 2008 & 9 & Duplicated\

088 & IEEE\_48 [@chowdhury2007enabling] & Enabling Access Control and Privacy through Ontology & Mohammad M. R. Chowdhury, JosefNoll’ and Juan Miguel Gomez & 2007 & 8 & Excluded stage 2\

089 & IEEE\_49 [@bishop2003computer] & What is computer security? & Matt Bishop & 2003 & 1916 & Excluded stage 2\

090 & IEEE\_50 [@Giorgini2005] & Modeling security requirements through ownership, permission and delegation & Paolo Giorgini, Fabio Massacci, John Mylopoulos and Nicola Zannone & 2005 & 198 & Selected\

091 & IEEE\_51 [@hecker2008privacy] & Privacy Ontology Support for E-Commerce & Michael Hecker, Tharam S. Dillon, and Elizabeth Chang & 2008 & 31 & Excluded stage 2\

092 & IEEE\_52 [@hadzic2006use] & Use of Ontology Technology for Standardization of Medical Records and Dealing with Associated Privacy Issues & Maja Hadzic, Dillon Tharam, Elizabeth Chang & 2006 & 4 & Excluded stage 2\

093 & IEEE\_53 [@kanbe2009ontology] & Ontology Alignment in RFID Privacy Protection & Masakazu Kanbe, Shuichiro Yamamoto & 2009 & 2 & Excluded stage 1\

094 & IEEE\_54 [@blanquer2009enhancing] & Enhancing Privacy and Authorization Control Scalability in the Grid Through Ontologies & Ignacio Blanquer, Hernández Vicente, Segrelles Damiá, Erik Torres & 2009 & 25 & Excluded stage 2\

095 & IEEE\_55 [@evesti2010ontology] & Ontology-Based Security Adaptation at Run-Time & Antti Evesti, Eila Ovaska & 2010 & 12 & Excluded stage 1\

096 & IEEE\_56 [@torrellas2004framework] & A framework for multi-agent system engineering using ontology domain modelling for security architecture risk assessment in e-commerce security services & Gustavo A. Santana Torrellas & 2004 & 10 & Excluded stage 2\

097 & IEEE\_57 [@kang2013security] & A Security Ontology with MDA for Software Development & Wentao Kang, Liang Ying & 2013 & 1 & Selected\

098 & IEEE\_58 [@vorobiev2006security] & Security Attack Ontology for Web Services & Artem Vorobiev and Jun Han & 2006 & 64 & Excluded stage 2\

099 & IEEE\_59 [@yan2008ontology] & Ontology-Based Information Content Security Analysis & Pan Yan, Zhao Yanping, Sanxing Cao & 2008 & 7 & Excluded stage 2\

100 & IEEE\_60 [@ekelhart2007security] & Security Ontologies: Improving Quantitative Risk Analysis & Ekelhart, Andreas, Stefan Fenz, Markus Klemen, Edgar Weippl & 2007 & 88 & Excluded stage 2\

101 & IEEE\_61 [@d2012ontology]& An Ontology for Run-Time Verification of Security Certificates for SOA & Stefania D’Agostini, Valeria Di Giacomo, Claudia Pandolfo, Domenico Presenza & 2012 & 4 & Excluded stage 1\

102 & IEEE\_62 [@yau2005adaptable] & An adaptable security framework for service-based systems & Stephen S Yau, Yisheng Yao, Zhaoji Chen, Luping Zhu & 2005 & 13 & Excluded stage 1\
103 & CIT\_01 [@poritz2004property] & Property attestation—scalable and privacy-friendly security assessment of peer computers & Jonathan Poritz, Matthias Schunter, Els Van Herreweghen, and Michael Waidner & 2004 & 137 & Excluded stage 2\

104 & CIT\_02 [@guarino1998formal] & Formal Ontology and Information Systems & Nicola Guarino & 1998 & 4406 & Excluded stage 1\

105 & CIT\_03 [@souag2013using] & Using Security and Domain ontologies for Security Requirements Analysis & Amina Souag, Camille Salinesi, Isabelle Wattiau, Haris Mouratidis & 2013 & 4 & Duplicated\

106 & CIT\_04 [@kost2012privacy] & Privacy analysis using ontologies & Martin Kost, Johann-Christoph Freytag & 2012 & 9 & Duplicated\

107 & CIT\_05 [@fenselontologies] & Ontologies: A Silver Bullet for Knowledge Management and Electronic & Dieter Fensel & 2000 & 23 & Excluded stage 1\

108 & CIT\_06 [@kost2011privacy] & Privacy Verification using Ontologies & Martin Kost, Johann-Christoph Freytag & 2011 & 10 & Duplicated\

109 & CIT\_07 [@velasco2009modelling] & Modeling Reusable Security Requirements Based on an Ontology Framework & Joaquín Lasheras, Rafael Valencia-García, Jesualdo Tomás Fernández-Breis & 2009 & 30 & Selected\

110 & CIT\_08 [@foster1998security] & A Security Architecture for Computational Grids & Ian Foster, Carl Kesselman, Gene Tsudik, Steven Tuecke & 1998 & 1765 & Excluded stage 1\

111 & CIT\_09 [@breaux2008analyzing] & Analyzing regulatory rules for privacy and security requirements & Travis D. Breaux, Annie Antón & 2008 & 251 & Excluded stage 2\

112 & CIT\_10 [@kim2005security] & Security Ontology for Annotating Resources & Kim Anya, Jim Luo, Myong Kang & 2005 & 151 & Duplicated\

113 & CIT\_11 [@perrig2002spins]& SPINS: Security Protocols for Sensor Networks & Adrian Perrig, Robert Szewczyk, Justin Douglas Tygar, Victor Wen, David E Culler & 2002 & 4493 & Excluded stage 1\

114 & CIT\_12 [@chor1998private]& Private Information Retrieval & Benny Chor, Kushilevitz Eyal, Oded Goldreich, Madhu Sudan & 1998 & 1535 & Excluded stage 2\

115 & CIT\_13 [@souag2012towards] & Towards a new generation of security requirements definition methodology using ontologies & Amina Souag & 2012 & 4 & Excluded stage 2 - Survey paper\

116 & CIT\_14 [@floridi2005ontological] & The ontological interpretation of informational privacy & Luciano Floridi & 2005 & 109 & Excluded stage 1\

117 & CIT\_15 [@ekclhart2007ontological] & Ontological mapping of common criteria’s security assurance requirements & Andreas Ekclhart, Stefan Fenz, Gernot Goluch, Edgar Weippl & 2007 & 21 & Excluded stage 2\

118 & CIT\_16 [@vorobiev2006security] & Security Attack Ontology for Web Services & Artem Vorobiev, Jun Han & 2006 & 57 & Duplicated\

119 & CIT\_17 [@velasco2009modelling] & An Ontology for Modelling Security: The Tropos Approach & Haralambos Mouratidis, Paolo Giorgini, Gordon Manson & 2003 & 52 & Duplicated\

120 & CIT\_18 [@Massacci2007] & An Ontology for Secure Socio-Technical Systems & Fabio Massacci, John Mylopoulos, Nicola Zannone & 2007 & 45 & Excluded stage 2 - better version Spgr\_07\_02\

121 & CIT\_19 [@chen2003ontology] & An Ontology for Context-Aware Pervasive Computing Environments & Harry Chen, Tim Finin, Anupam Joshi & 2003 & 1023 & Duplicated\

122 & CIT\_20 [@squicciarini2006achieving] & Achieving Privacy in Trust Negotiations with an Ontology-Based Approach & Anna C. Squicciarini, Elisa Bertino, Elena Ferrari, Indrakshi Ray & 2006 & 50 & Duplicated\

123 & CIT\_21 [@parkin2009information] & An Information Security Ontology Incorporating Human-Behavioral Implications & Simon E Parkin, Aad van Moorsel, Robert Coles & 2009 & 33 & Excluded stage 1\

124 & CIT\_22 [@vorobiev2007ontological] & An Ontological Approach Applied to Information Security and Trust & Artem Vorobiev, Bekmamedova Nargiza & 2007 & 12 & Excluded stage 1\

125 & CIT\_23 [@zhangdeveloping] & Developing a privacy ontology for privacy control in context-aware systems & Ni Zhang, Chris Todd & 2005 & 0 & Excluded stage 2\

126 & CIT\_24 [@mitra2005privacy] & Privacy-preserving ontology matching & Prasenjit Mitra, Peng Liu, Chi-Chun Pan & 2005 & 10 & Excluded stage 1\

127 & CIT\_25 [@chen2004soupa] & SOUPA: Standard Ontology for Ubiquitous and Pervasive Applications & Harry Chen, Filip Perich, Tim Finin, Anupam Joshi & 2004 & 634 & Duplicated\

128 & CIT\_26 [@langheinrich2001privacy] & Privacy by Design - Principles of Privacy-Aware Ubiquitous Systems & Marc Langheinrich & 2001 & 769 & Excluded stage 2\

129 & CIT\_27 [@chen2005soupa] & The SOUPA Ontology for Pervasive Computing & Chen, Harry, Tim Finin, Anupam Joshi & 2005 & 179 & Duplicated\

130 & CIT\_28 [@hecker2007privacy] & Privacy support and evaluation on an ontological basis & Michael Hecker, Dillon Tharam & 2007 & 5 & Excluded stage 1\

131 & CIT\_29 [@vorobiev2008ontology] & An ontology framework for managing security attacks and defenses in component based software systems & Artem Vorobiev, Jun Han, Nargiza Bekmamedova & 2008 & 7 & Excluded stage 2\

132 & CIT\_30 [@gandhi2009ontology] & Ontology Guided Risk Analysis: From Informal Specifications to Formal Metrics & Robin Gandhi, Seok-Won Lee & 2009 & 1 & Duplicated\

133 & CIT\_31 [@ranganathan2003ontologies] & Ontologies in a pervasive computing environment & Anand Ranganathan, Robert E. McGrath, Roy H. Campbell, Mickunas M. Dennis & 2003 & 65 & Excluded stage 2\

134 & CIT\_32 [@eiter2006reasoning] & Reasoning with rules and ontologies & Thomas Eiter, Giovambattista Ianni, Axel Polleres, Roman Schindlauer, Hans Tompits & 2006 & 75 & Excluded stage 1\

135 & CIT\_33 [@liu2003security] & Security and Privacy Requirements Analysis within a Social Setting & Lin Liu, Eric Yu, John Mylopoulos & 2006 & 75 & Selected\

136 & CIT\_34 [@evfimievski2003limiting] & Limiting Privacy Breaches in Privacy Preserving Data Mining & Alexandre Evfimievski, Johannes Gehrke, Srikant Ramakrishnan & 2003 & 642 & Excluded stage 1\

137 & CIT\_35 [@mcgrath2003use] & Use of Ontologies in Pervasive Computing Environments & Robert E McGrath, Anand Ranganathan, Roy H Campbell, Mickunas M Dennis & 2003 & 33 & Excluded stage 1\
138 & Spgr\_01 [@kim2005security] & Security ontology for annotating resources & Kim Anya, Jim Luo, Myong Kang & 2005 & 151 & Excluded stage 2\

139 & Spgr\_02 [@fabian2010comparison] & A comparison of security requirements engineering methods & Fabian Benjamin, Seda Gurses, Maritta Heisel, Thomas Santen, Holger Schmidt & 2010 & 129 & Excluded stage 2 - Survey paper\

140 & Spgr\_03 [@souag2012ontologies] & Ontologies for security requirements: A literature survey and classification & Amina Souag, Camille Salinesi, Isabelle Wattiau & 2012 & 41 & Excluded stage 2 - Survey paper\

141 & Spgr\_04 [@studer2009privacy] & Privacy preserving modules for ontologies & Thomas Studer & 2010 & 4 & Duplicated\

142 & Spgr\_05 [@yau2006framework] & A framework for specifying and managing security requirements in collaborative systems & Stephen S. Yau, Chen Zhaoji & 2006 & 17 & Duplicated\

143 & Spgr\_06 [@alam2006model] & Model driven security engineering for the realization of dynamic security requirements in collaborative systems & Muhammad Alam & 2007 & 14 & Duplicated\

144 & Spgr\_07 [@massacci2011extended] & An Extended Ontology for Security Requirements & Fabio Massacci, John Mylopoulos, Federica Paci, Thein Thun Tun, Yijun Yu & 2011 & 16 & Selected\

145 & Spgr\_08 [@souag2015security] & A Security Ontology for Security Requirements Elicitation & Amina Souag, Camille Salinesi, Raúl Mazo, Isabelle Comyn-Wattiau & 2015 & 4 & Excluded stage 2 - Survey paper\

146 & Spgr\_09 [@souag2012ontologies] & Ontologies for Security Requirements: A Literature Survey and Classification & Amina Souag, Camille Salinesi, Isabelle Wattiau & 2012 & 29 & Duplicated\

147 & Spgr\_10 [@souag2015reusable]& Reusable knowledge in security requirements engineering: a systematic mapping study & Amina Souag, Raúl Mazo, Camille Salinesi, Isabelle Comyn-Wattiau & 2015 & 1 & Excluded stage 1\

148 & Spgr\_11 [@kim2005security]& Security Ontology for Annotating Resources & Kim Anya, Jim Luo, Myong Kang & 2005 & 151 & Duplicated\

149 & Spgr\_12 [@tropea2011introducing]& Introducing Privacy Awareness in Network Monitoring Ontologies & Giuseppe Tropea, Georgios V Lioudakis, Nicola Blefari-Melazzi, Dimitra I Kaklamani, Iakovos S Venieris & 2011 & 1 & Excluded stage 1\

150 & Spgr\_13 [@elahi2009modeling] & A Modeling Ontology for Integrating Vulnerabilities into Security Requirements Conceptual Foundation & Golnaz Elahi, Eric Yu, Nicola Zannone & 2009 & 21 & Selected\

151 & Spgr\_14 [@tsoumas2006security] & Security-by-Ontology: A Knowledge-Centric Approach & Bill Tsoumas, Panagiotis Papagiannakopoulos, Stelios Dritsas, Dimitris Gritzalis & 2006 & 12 & Excluded stage 2\

152 & Spgr\_15 [@sicilia2015information] & What are Information Security Ontologies Useful for? & Bill Sicilia, Miguel-Angel García-Barriocanal, Elena Javier Bermejo-Higuera, Salvador Sánchez-Alonso & 2015 & 0 & Excluded stage 1\

153 & Spgr\_16 [@papagiannakopoulou2014leveraging] & Leveraging Ontologies upon a Holistic Privacy-Aware Access Control Model & Eugenia I Papagiannakopoulou, Maria N Koukovini, Georgios V Lioudakis, Nikolaos Dellas, Joaquin Garcia-Alfaro, Dimitra I Kaklamani, Iakovos S Venieris, Nora Cuppens-Boulahia, Frédéric Cuppens & 2014 & 4 & Excluded stage 1\

154 & Spgr\_17 [@sure2004towards] & Towards Cross-Domain Security Properties Supported by Ontologies & York Sure, Jochen Haller & 2004 & 5 & Excluded stage 1\

155 & Spgr\_18 [@milicevic2010ontology] & Ontology-Based Evaluation of ISO 27001. & Danijel Milicevic, Matthias Goeken & 2010 & 3 & Excluded stage 2\

156 & Spgr\_19 [@dhiah2006ontology] & An Ontology-Based Approach for Managing and Maintaining Privacy in Information Systems & Dhiah el Diehn, Abou-Tair I. Stefan Berlik & 2006 & 5 & Excluded stage 2\

157 & Spgr\_20 [@vincent2011privacy] & Privacy Protection for Smartphones: An Ontology-Based Firewall & Johann Vincent, Christine Porquet, Maroua Borsali, Harold Leboulanger & 2011 & 8 & Excluded stage 2\

158 & Spgr\_21 [@ionita2005specifying] & Specifying an Access Control Model for Ontologies for the Semantic Web & Cecilia Ionita, Osborn M, Sylvia L & 2005 & 9 & Excluded stage 1\

159 & Spgr\_22 [@gandhi2009ontology] & Ontology Guided Risk Analysis: From Informal Specifications to Formal Metrics & Robin Gandhi, Lee Seok-Won & 2009 & 1 & Excluded stage 2\

160 & Spgr\_23 [@torres2012hit] & HIT Considerations: Informatics and Technology Needs and Considerations & Miguel Humberto Torres-Urquidy, Valerie J. H. Powell, Franklin M. Din, Mark Diehl, Valerie Bertaud-Gounot, W. Ted Klein, Sushma Mishra, Shin-Mey Rose Yin Geist, Monica Chaudhari, Mureen Allen & 2012 & 0 & Excluded stage 1\

161 & Spgr\_24 [@hoss2007towards] & Towards Combining Ontologies and Model Weaving for the Evolution of Requirements Models & Allyson M Hoss, Doris L Carver & 2008 & 5 & Excluded stage 1\

162 & Spgr\_25 [@stoica2004ontology] & Ontology Guided XML Security Engine & Andrei Stoica, Csilla Farkas & 2004 & 27 & Excluded stage 1\

163 & Spgr\_26 [@wangusing] & Using ontologies to perform threat analysis and develop defensive strategies for mobile security & Ping Wang , Kuo-Ming Chao, Chi-Chun Lo, Yu-Shih Wang & 2015 & 1 & Excluded stage 1\

164 & Spgr\_27 [@weippl2004semanticlife] & SemanticLIFE Collaboration: Security Requirements and Solutions – Security Aspects of Semantic Knowledge Management & Edgar R. Weippl, Alexander Schatten, Shuaib Karim, A. Min Tjoa & 2004 & 13 & Excluded stage 1\

165 & Spgr\_28 [@heupel2015ontology] & Ontology-Enabled Access Control and Privacy Recommendations & Robin Gandhi, Lee Seok-Won & 2009 & 1 & Excluded stage 2\

166 & Spgr\_29 [@nissan2012accounting] & Accounting for Social, Spatial, and Textual Interconnections & Ephraim Nissan & 2012 & 0 & Excluded stage 1\

167 & Spgr\_30 [@hadzic2009case] & Case Study I: Ontology-Based Multi-Agent System for Human Disease Studies & Maja Hadzic, Pornpit Wongthongtham, Tharam Dillon, Elizabeth Chang & 2009 & 0 & Excluded stage 1\

168 & Spgr\_31 [@chen2005soupa] & The SOUPA Ontology for Pervasive Computing & Harry Chen, Tim Finin, Anupam Joshi & 2015 & 191 & Excluded stage 2\

169 & Spgr\_32 [@mouratidis2003ontology] & An Ontology for Modelling Security: The Tropos Approach & Haralambos Mouratidis, Paolo Giorgini, Gordon Manson & 2003 & 54 & Excluded stage 2\

170 & Spgr\_33 [@spyns2008evaluating] & Evaluating Automatically a Text Miner for Ontologies: A Catch-22 Situation? & Peter Spyns & 2008 & 2 & Excluded stage 1\

171 & Spgr\_34 [@mitre2006legal] & EA Legal Ontology to Support Privacy Preservation in Location-Based Services & Hugo A. Mitre, Ana Isabel González-Tablas, Benjamín Ramos, Arturo Ribagorda & 2006 & 6 & Excluded stage 2\

172 & Spgr\_35 [@chowdhury2008capturing] & Capturing Semantics for Information Security and Privacy Assurance & Mohammad M. R. Chowdhury, Javier Chamizo, Josef Noll, Juan Miguel Gómez & 2008 & 6 & Excluded stage 2\

173 & Spgr\_36 [@pereira2009ontology] & An Ontology Based Approach to Information Security & Teresa Pereira, Henrique Santos & 2009 & 10 & Excluded stage 2\

174 & Spgr\_37 [@panettoefficient] & Efficient Projection of Ontologies & Julius Köpke, Johann Eder, Michaela Schicho & 2013 & 1 & Excluded stage 1\

175 & Spgr\_38 [@delgado2003regulatory] & Regulatory Ontologies: An Intellectual Property Rights Approach & Haojun Yu, Sun Yuqing, Jinyan Hu & 2012 & 0 & Excluded stage 2\

176 & Spgr\_39 [@sorli2009ict] & ICT Tools and Systems Supporting Innovation in Product/Process Development & Mikel Sorli, Dragan Stokic & 2009 & 0 & Excluded stage 1\

177 & Spgr\_40 [@balopoulos2006framework] & A Framework for Exploiting Security Expertise in Application Development & Theodoros Balopoulos, Lazaros Gymnopoulos, Maria Karyda, Spyros Kokolakis, Stefanos Gritzalis, Sokratis Katsikas & 2006 & 0 & Excluded stage 1\

178 & Spgr\_41 [@iwaihara2008risk] & Risk Evaluation for Personal Identity Management Based on Privacy Attribute Ontology & Mizuho Iwaihara, Murakami Kohei, Ahn Gail-Joon , Masatoshi Yoshikawa & 2008 & 12 & Excluded stage 2\

179 & Spgr\_42 [@analyti2013framework] & A framework for modular ERDF ontologies & Analyti, Antoniou Anastasia, Grigoris and Damásio, Carlos Viegas, Ioannis Pachoulakis & 2013 & 3 & Excluded stage 1\

180 & Spgr\_43 [@kayes2013ontology] & An Ontology-Based Approach to Context-Aware Access Control for Software Services & Asm Kayes, Jun Han, Alan Colman & 2013 & 8 & Excluded stage 1\

181 & Spgr\_44 [@mezgar2007development] & Development of an Ontology-Based Smart Card System Reference Architecture & István Mezgár, Zoltán Kincses & 2007 & 0 & Excluded stage 1\

182 & Spgr\_45 [@kabilan2007introducing] & Introducing the Common Non-Functional Ontology & Vandana Kabilan, Paul Johannesson, Sini Ruohomaa, Pirjo Moen, Andrea Herrmann, Rose-Mharie Ahlfeldt, Hans Weigand & 2007 & 4 & Excluded stage 1\

183 & Spgr\_46 [@ryan2003ontology] & Ontology-Based Platform for Trusted Regulatory Compliance Services & Henry Ryan, Peter Spyns, Pieter De Leenheer, Richard Leary & 2003 & 7 & Excluded stage 1\

184 & Spgr\_47 [@isaza2010intrusion] & Intrusion Correlation Using Ontologies and Multi-agent Systems & Gustavo Isaza, Andrés Castillo, Marcelo López, Luis Castillo, Manuel López & 2010 & 6 & Excluded stage 1\

185 & Spgr\_48 [@albers2004agent] & Agent Models and Different User Ontologies for an Electronic Market Place & Marcel Albers, Catholijn M Jonker, Mehrzad Karami, Jan Treur, & 2004 & 27 & Excluded stage 1\

186 & Spgr\_49 [@rajugan2006ontology] & Ontology Views: A Theoretical Perspective & Rajagopal Rajugan, Elizabeth Chang, Tharam S Dillon, & 2006 & 11 & Excluded stage 1\

187 & Spgr\_50 [@undercoffer2003modeling] & Modeling Computer Attacks: An Ontology for Intrusion Detection & Jeffrey Undercoffer, Anupam Joshi, John Pinkston & 2003 & 136 & Excluded stage 1\

188 & Spgr\_51 [@denker2003security] & Security for DAML Web Services: Annotation and Matchmaking & Grit Denker, Lalana Kagal, Tim Finin, Massimo Paolucci, Katia Sycara & 2003 & 183 & Excluded stage 1\

189 & Spgr\_52 [@liu2009ontology] & Ontology-Based Requirements Conflicts Analysis in Activity Diagrams & Chi-Lun Liu & 2009 & 6 & Excluded stage 1\

190 & Spgr\_53 [@beckers2012ontology] & Ontology-Based Identification of Research Gaps and Immature Research Areas & Kristian Beckers, Stefan Eicker, Stephan Fa[ß]{}bender, Maritta Heisel, Holger Schmidt, Widura Schwittek & 2012 & 4 & Excluded stage 1\

191 & Spgr\_54 [@ceravolo2003managing] & Managing Identities via Interactions between Ontologies & Paolo Ceravolo & 2003 & 4 & Excluded stage 1\

192 & Spgr\_55 [@ekelhart2006security] & Security Ontology: Simulating Threats to Corporate Assets & Andreas Ekelhart, Stefan Fenz, Markus D. Klemen, Edgar R. Weippl & 2006 & 31 & Excluded stage 2\

193 & Spgr\_56 [@abulaish2011simont] & SIMOnt: A Security Information Management Ontology Framework & Muhammad Abulaish, Syed Irfan Nabi, Khaled Alghathbar, Azeddine Chikh & 2011 & 3 & Excluded stage 2\

194 & Spgr\_57 [@man2005retracted] & Retracted: Shared Ontology for Pervasive Computing & Junfeng Man, Aimin Yang, Xingming Sun & 2005 & 3 & Excluded stage 1\

195 & Spgr\_58 [@ciuciu2011ontology] & Ontology-Based Matching of Security Attributes for Personal Data Access in e-Health & Ioana Ciuciu, Brecht Claerhout, Louis Schilders, Robert Meersman & 2011 & 5 & Excluded stage 2\

196 & Spgr\_59 [@blobel2011intelligent] & Intelligent security and privacy solutions for enabling personalized telepathology & Bernd Blobel & 2011 & 5 & Excluded stage 1\

197 & Spgr\_60 [@breaux2014eddy] & Eddy, a formal language for specifying and analyzing data flow specifications for conflicting privacy & Travis D. Breaux, Hibshi Hanan, Rao Ashwini & 2014 & 16 & Excluded stage 2\
198 & SCH\_01 [@breaux2008analyzing] & Analyzing regulatory rules for privacy and security requirements & Travis D. Breaux, Annie Antón & 2008 & 230 & Duplicated\

199 & SCH\_02 [@chen2003ontology] & An Ontology for Context-Aware Pervasive Computing Environments & Harry Chen, Tim Finin, Anupam Joshi & 2003 & 1086 & Excluded stage 2\

200 & SCH\_03 [@massacci2005using] & Using a security requirements engineering methodology in practice: the compliance with the Italian data protection legislation & Fabio Massacci, Marco Prest, Nicola Zannone & 2005 & 82 & Excluded stage 2 - better version Spgr\_07\_02\

201 & SCH\_04 [@takabi2010security] & Security and privacy challenges in cloud computing environments & Hassan Takabi, James BD Joshi, Ahn Gail-Joon & 2010 & 660 & Excluded stage 1\

202 & SCH\_05 [@ashburner2000gene] & Gene Ontology: tool for the unification of biology & Ashburner M, Ball CA, Blake JA, Botstein D, Butler H, Cherry JM, Davis AP, Dolinski K, Dwight SS, Eppig JT, Harris MA, Hill DP, Issel-Tarver L, Kasarskis A, Lewis S, Matese JC, Richardson JE, Ringwald M, Rubin GM, Sherlock G. & 2000 & 15501 & Excluded stage 1\

203 & SCH\_06 [@sacco2011privacy] & A Privacy Preference Ontology (PPO) for Linked Data & Owen Sacco, Alexandre Passant & 2011 & 52 & Excluded stage 2\

204 & SCH\_07 [@poritz2004property] & Property attestation—scalable and privacy-friendly security assessment of peer computers & Jonathan Poritz, Matthias Schunter, Els Van Herreweghen, and Michael Waidner & 2004 & 132 & Duplicated\

205 & SCH\_08 [@chase2009improving] & Improving privacy and security in multi-authority attribute-based encryption & Melissa Chase, Sherman S.M. Chow & 2009 & 375 & Duplicated\

206 & SCH\_09 [@li2010data] & Data security and privacy in wireless body area networks & Ming Li, Wenjing Lou, Kui Ren & 2010 & 297 & Excluded stage 1\

207 & SCH\_10 [@ohkubo2003cryptographic] & Cryptographic approach to “privacy-friendly” tags & Miyako Ohkubo, Koutarou Suzuki, Shingo Kinoshita, and others & 2003 & 793 & Excluded stage 1\

208 & SCH\_11 [@chen2004soupa] & Soupa: Standard ontology for ubiquitous and pervasive applications & Harry Chen, Filip Perich, Tim Finin, Anupam Joshi & 2004 & 634 & Duplicated\

209 & SCH\_12 [@ferrari2004security] & Security and privacy for web databases and services & Elena Ferrari, Bhavani Thuraisingham & 2004 & 94 & Excluded stage 1\

210 & SCH\_13 [@weber2010internet] & Internet of Things – New security and privacy challenges & Rolf H Weber & 2010 & 297 & Excluded stage 1\

211 & SCH\_14 [@el2003privacy] & Privacy and Security in E-Learning & Khalil El-Khatib, Larry Korba, Yuefei Xu, George Yee & 2003 & 86 & Excluded stage 1\

212 & SCH\_15 [@ferrari2004security] & Security and privacy for web databases and services & Elena Ferrari, Bhavani Thuraisingham & 2004 & 94 & Excluded stage 1\

213 & SCH\_16 [@firesmith2003security] & Security use cases & Donald G. Firesmith & 2003 & 353 & Excluded stage 2\

214 & SCH\_17 [@squicciarini2006achieving] & Achieving privacy in trust negotiations with an ontology-based approach & Anna C. Squicciarini, Elisa Bertino, Elena Ferrari, Indrakshi Ray & 2006 & 50 & Duplicated\

215 & SCH\_18 [@sindre2005eliciting]& Eliciting security requirements with misuse cases & Guttorm Sindre, Andreas L. Opdahl & 2005 & 830 & Selected\

216 & SCH\_19 [@chen2005soupa] & The SOUPA ontology for pervasive computing & Chen, Harry, Tim Finin, Anupam Joshi & 2005 & 179 & Duplicated\

217 & SCH\_20 [@anton2002analyzing] & Analyzing website privacy requirements using a privacy goal taxonomy & Annie Antón, Julia B. Earp, Angela Reese & 2002 & 105 & Excluded stage 2\

218 & SCH\_21 [@jansen2011guidelines] & Guidelines on security and privacy in public cloud computing & Wayne Jansen, Timothy Grance, and others & 2011 & 502 & Duplicated\

219 & SCH\_22 [@van2004elaborating] & Elaborating security requirements by construction of intentional anti-models & Axel Van Lamsweerde & 2004 & 337 & Duplicated\

220 & SCH\_23 [@massacci2005using] & Using a security requirements engineering methodology in practice: the compliance with the Italian data protection legislation & Wayne Jansen, Timothy Grance, and others & 2011 & 502 & Excluded stage 1\

221 & SCH\_24 [@kalloniatis2008addressing] & Addressing privacy requirements in system design: the PriS method & Christos Kalloniatis, Evangelia Kavakli, Stefanos Gritzalis & 2008 & 76 & Selected\

222 & SCH\_25 [@carminati2006security] & Security conscious web service composition & Barbara Carminati, Elena Ferrari, Patrick CK Hung, & 2006 & 93 & Excluded stage 1\

223 & SCH\_26 [@haley2008security] & Security requirements engineering: A framework for representation and analysis & Charles B. Haley, Robin Laney, Jonathan D. Moffett, Bashar Nuseibeh & 2008 & 281 & Excluded stage 2\

224 & SCH\_27 [@he2003framework] & A framework for modeling privacy requirements in role engineering & Qingfeng He, Annie I. Antón & 2003 & 85 & Excluded stage 2\

225 & SCH\_28 [@mouratidis2007secure] & Secure Tropos: a security-oriented extension of the Tropos methodology & Haralambos Mouratidis, Paolo Giorgini & 2007 & 193 & Selected\

226 & SCH\_29 [@rezgui2002preserving] & Preserving privacy in web services & Abdelmounaam Rezgui, Mourad Ouzzani, Athman Bouguettaya, Brahim Medjahed & 2002 & 102 & Duplicated\

227 & SCH\_30 [@gandon2004semantic] & Semantic web technologies to reconcile privacy and context awareness & Fabien L Gandon, Norman M Sadeh & 2004 & 215 & Excluded stage 1\

228 & SCH\_31 [@hecker2008privacy] & Privacy ontology support for e-commerce & Michael Tharam S. Hecker, Elizabeth Chang Dillon & 2008 & 29 & Duplicated\

229 & SCH\_32 [@donner2003toward] & Toward a security ontology & Marc Donner & 2003 & 56 & Excluded stage 2\

230 & SCH\_33 [@gao2010approach] & An approach for privacy protection based-on ontology & Gao Feng, Jingsha He, Shufen Peng, Xu Wu, Xiu Liu & 2010 & 9 & Duplicated\

231 & SCH\_34 [@kim2005security] & Security ontology for annotating resources & Kim Anya, Jim Luo, Myong Kang & 2005 & 151 & Duplicated\

232 & SCH\_35 [@brar2004privacy] & Privacy and security in ubiquitous personalized applications & Ajay Brar, Judy Kay & 2004 & 38 & Excluded stage 1\

233 & SCH\_36 [@alliance2003hipaa] & HIPAA compliance and smart cards: Solutions to privacy and security requirements & Alliance, Smart Card & 2003 & 17 & Excluded stage 2\

234 & SCH\_37 [@mitra2005privacy] & Privacy-preserving ontology matching & Prasenjit Mitra, Peng Liu, Chi-Chun Pan & 2005 & 10 & Duplicated\

235 & SCH\_38 [@iwaihara2008risk] & Risk evaluation for personal identity management based on privacy attribute ontology & Mizuho Iwaihara, Murakami Kohei, Gail-Joon Ahn, Masatoshi Yoshikawa & 2008 & 12 & Duplicated\

236 & SCH\_39 [@kagal2006security] & Security and privacy challenges in open and dynamic environments & Lalana Kagal, Tim Finin, Anupam Joshi, Sol Greenspan, & 2006 & 27 & Excluded stage 1\

237 & SCH\_40 [@fabian2010comparison] & A comparison of security requirements engineering methods & Fabian Benjamin, Seda Gurses, Maritta Heisel, Thomas Santen, Holger Schmidt & 2010 & 121 & Duplicated\

238 & SCH\_41 [@solove2006taxonomy] & A taxonomy of privacy & Daniel J Solove & 2006 & 967 & Selected\

239 & SCH\_42 [@ware1981taxonomy] & A taxonomy for privacy & Willis H Ware & 1981 & 5 & Excluded stage 1\

240 & SCH\_43 [@skinner2006information] & An information privacy taxonomy for collaborative environments & Geoff Skinner, Song Han, Elizabeth Chang & 2006 & 24 & Excluded stage 2\
\

241 & Spgr\_18\_01 [@karyda2006ontology] & An ontology for secure e-government applications & M. Karyda, T. Balopoulos, S. Dritsas, L. Gymnopoulos, S. Kokolakis, C. Lambrinoudakis, S. Gritzalis & 2006 & 37 & Excluded stage 2\

242 & Spgr\_18\_02 [@raskin2001ontology] & Ontology in information security: a useful theoretical foundation and methodological tool & Victor Raskin, Christian F Hempelmann, Katrina E Triezenberg, Sergei Nirenburg & 2001 & 133 & Excluded stage 2\

243 & Spgr\_18\_03 [@fenz2009formalizing] & Formalizing information security knowledge & Stefan RaskinFenz, Andreas Ekelhart & 2009 & 144 & Selected\

244 & Spgr\_13\_01 [@asnar2008risk] & Risk as dependability metrics for the evaluation of business solutions: a model-driven approach & Yudistira Asnar, Rocco Moretti, Maurizio Sebastianis, Nicola Zannone & 2008 & 30 & Selected\

245 & Spgr\_13\_02 [@den2003coras] & The CORAS methodology. model-based risk assessment using UML and UP & Folker den Braber, Theo Dimitrakos, Bjorn A. Gran, Mass S. Lund, Ketil Stolen, Jan O. Aagedal & 2003 & 66 & Selected\

246 & Spgr\_13\_03 [@elahi2010vulnerability] & A vulnerability-centric requirements engineering framework. analyzing security attacks, countermeasures, and requirements based on vulnerabilities & Golnaz Elahi, Eric Yu, Nicola Zannone & 2010 & 73 & Selected\

247 & Spgr\_13\_04 [@jurjens2002umlsec] & UMLsec: Extending UML for secure systems development & Jürjens, Jan & 2002 & 583 & Selected\

248 & Spgr\_13\_05 [@matulevivcius2008adapting] & Adapting secure tropos for security risk management in the early phases of information systems development & Raimundas Matulevi[č]{}ius, Nicolas Mayer, Haralambos Mouratidis, Eric Dubois, Patrick Heymans, Nicolas Genon, & 2008 & 60 & Selected\

249 & Spgr\_13\_06 [@mayer2005towards] & Towards a risk-based security requirements engineering framework & Nicolas Mayer, André Rifaut, Eric Dubois, and others & 2005 & 52 & Excluded stage 2 - better version Spgr\_08\_01\

250 & Spgr\_13\_07 [@rostad2006extended] & An extended misuse case notation: Including vulnerabilities and the insider threat & Lillian R[ø]{}stad, & 2006 & 46 & Selected\

251 & Spgr\_13\_08 [@singh2014revisiting] & Revisiting Security Ontologies & Vaishali Singh, SK Pandey & 2014 & 2 & Excluded stage 2\

252 & Spgr\_08\_01 [@mayer2009model] & Model-based management of information system security risk & Nicolas Mayer & 2009 & 70 & Selected\

253 & Spgr\_08\_02 [@velasco2009modelling] & Modelling reusable security requirements based on an ontology framework & Joaquin Velasco, Lasheras Valencia-García, Rafael Fernández-Breis, Tomás Jesualdo, Ambrosio Toval, and others & 2009 & 31 & Excluded stage 2\

254 & Spgr\_08\_03 [@dritsas2006knowledge] & A knowledge-based approach to security requirements for e-health applications & S. Dritsas, L. Gymnopoulos, M. Karyda, T. Balopoulos, S. Kokolakis, C. Lambrinoudakis, S. Katsikas & 2006 & 17 & Selected\

255 & Spgr\_07\_01 [@blanco2008systematic] & A systematic review and comparison of security ontologies & Blanco, Carlos and Lasheras, Joaquin and Valencia-García, Rafael and Fernández-Medina, Eduardo and Toval, Ambrosio and Piattini, Mario & 2008 & 79 & Excluded stage 2 - Survey paper\

256 & Spgr\_07\_02 [@zannone2006requirements] & A requirements engineering methodology for trust, security, and privacy & Nicola Zannone & 2007 & 17 & Selected\

257 & Spgr\_07\_03 [@lin2003introducing] & Introducing abuse frames for analysing security requirements & Luncheng Lin, Bashar Nuseibeh, Darrel Ince, Michael Jackson, Jonathan Moffett & 2003 & 73 & Excluded stage 2\

258 & Spgr\_03\_01 [@avizienis2004basic] & Basic Concepts and Taxonomy of Dependable and Secure & Algirdas Avi[ž]{}ienis, Jean-Claude Laprie, Brian Randell, Carl Landwehr & 2004 & 3703 & Selected\

259 & Spgr\_03\_02 [@firesmith2005taxonomy] & A taxonomy of security-related requirements & Donald G Firesmith & 2005 & 44 & Excluded stage 2\

260 & Spgr\_02\_01 [@asnar2007trust] & From trust to dependability through risk analysis & Yudistira Asnar, Paolo Giorgini, Fabio Massacci, Nicola Zannone & 2007 & 57 & Selected\

261 & Spgr\_02\_02 [@asnar2006risk] & Risk modelling and reasoning in goal models & Yudistira Asnar, Paolo Giorgini, John Mylopoulos & 2006 & 17 & Selected\

262 & SCH\_24\_01 [@kalloniatis2005dealing] & Dealing with privacy issues during the system design process & Christos Kalloniatis, Evangelia Kavakli, Stefanos Gritzalis, & 2005 & 15 & Excluded stage 2\

263 & SCH\_24\_02 [@hong2004privacy] & Privacy risk models for designing privacy-sensitive ubiquitous computing systems & Jason I Hong, Jennifer Ng, Scott D Lederer, , James A Landay, & 2004 & 218 & Selected\

264 & SCH\_28\_01 [@paja2014sts] & STS-Tool Security Requirements Engineering for Socio-Technical Systems & Elda Paja, Fabiano Dalpiaz, Paolo Giorgini & 2014 & 2 & Selected\

265 & SCH\_43\_01 [@van2003handbook] & Handbook of privacy and privacy-enhancing technologies & GW Van Blarkom, JJ Borking, JGE Olk & 2003 & 69 & Selected\

[^1]: An overview of all considered studies is shown in Table \[table:papers\] in Appendix B

[^2]: When there are more than one concept with very close meaning, we have chosen the most appropriate one to represent all

[^3]: These groups are not mutually exclusive, i.e., a study may belong to all of them
