The invention discloses a
software security requirement acquisition method based on formal modeling in the technical field of
software security. The specific steps of the method are as follows: S1, identifying resources and information contained in a
software system; S2: identifying potential
threat behaviors caused by resources and information; S3: establishing security objectives and proposing security requirements, and verifying the security requirements; 4, establishing a formal model and verifying that model; 5, describing various attributes and
system behavior in that
system to obtain afinal state, to realize the interpretation, evaluation and
verification of the
software system. The invention firstly identifies information in a
software system, acquire the description of
information security threat, determines whether the phenomenon description of
problem domain meets the condition of security
threat, establishes formal model and verifying, which makes up for the shortcomings of traditional security
requirements analysis methods, and enables the requirements analysts to further capture the security requirements of software systems.