  Software security is becoming a high priority for both large companies and
start-ups alike due to the increasing potential for harm that vulnerabilities
and breaches carry with them. However, attaining robust security assurance
while delivering features requires a precarious balancing act in the context of
agile development practices. One path forward to help aid development teams in
securing their software products is through the design and development of
security-focused automation. Ergo, we present a novel approach, called
SecureReqNet, for automatically identifying whether issues in software issue
tracking systems describe security-related content. Our approach consists of a
two-phase neural net architecture that operates purely on the natural language
descriptions of issues. The first phase of our approach learns high dimensional
word embeddings from hundreds of thousands of vulnerability descriptions listed
in the CVE database and issue descriptions extracted from open source projects.
The second phase then utilizes the semantic ontology represented by these
embeddings to train a convolutional neural network capable of predicting
whether a given issue is security-related. We evaluated SecureReqNet by
applying it to identify security-related issues from a dataset of thousands of
issues mined from popular projects on GitLab and GitHub. In addition, we also
applied our approach to identify security-related requirements from a
commercial software project developed by a major telecommunication company. Our
preliminary results are encouraging, with SecureReqNet achieving an accuracy of
96% on open source issues and 71.6% on industrial requirements.
