This paper proposes using domain adaptation of Sentence Transformer models to automate the manual process of mapping cloud security controls to technical metrics.
- The authors constructed a training corpus of 3,499 semantic pairs from five European security standards and expanded it to 13,996 samples using back-translation and LLM-based paraphrasing across four scenarios.
- Five architectures were fine-tuned and evaluated on control-to-metric and cross-standard controls association tasks.
- On the control-to-metric task, the best model improved nDCG@10 by up to 23 points compared to zero-shot baselines.
- For the cross-standard control task, the multi-qa-mpnet-dot-v1 model under back-translation achieved an nDCG@10 of 0.870.
The results indicate that in-domain training data is a primary driver of performance for these automation tasks.