Luca Petrillo

John Bianchi, Shuya Dong, Luca Petrillo et al.

The draft candidate European Cybersecurity Certification Scheme for Cloud Services (EUCS) defines security controls that must be associated with measurable metrics to assess compliance. This association process is currently manual, time-consuming, and prone to inconsistencies. In this paper, we propose an automated approach based on Sentence Transformers to associate cloud security controls with quantifiable metrics by leveraging semantic similarity between their textual descriptions. We evaluate our method on a dataset of 70 controls derived from the EUCS framework. The proposed approach outperforms a FastText-based baseline, achieving a conditional Normalized Discounted Cumulative Gain at rank 10 score of 0.640 (+0.146) and improving the standard nDCG@10 score from 0.275 to 0.504. These results demonstrate that contextual embedding models significantly enhance both the likelihood of retrieving relevant metrics and their ranking quality. Our findings highlight the potential of transformer-based methods to support automated, scalable, and more reliable compliance processes in cloud cybersecurity certification.

John Bianchi, Luca Petrillo, Fabio Martinelli et al.

Mapping cloud security controls to technical metrics is currently a manual process. This paper proposes domain adaptation of Sentence Transformer models to automate it. We build a training corpus of 3,499 semantic pairs from five European security standards and a set of technical metrics, then expand it via back-translation and LLM-based paraphrasing to up to 13,996 samples across four scenarios. We fine-tune five architectures and evaluate their performance on two independent tasks: control-to-metric and cross-standard controls association. All fine-tuned models outperform their zero-shot baselines. On the control-to-metric task, the best model gains up to 23 nDCG@10 points, while on the cross-standard control task, \textit{multi-qa-mpnet-dot-v1} under back-translation reaches 0.870 nDCG@10. The results show that in-domain training data is a primary driver of performance for the considered case studies.