Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this article, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81 percent. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.

Complementarity between activities reveals that doing any one of them increases the returns to doing the others. In other words, complementarity leads to the synergistic effect that the whole is greater than the sum of its parts. Identifying and exploiting complementarity can benefit many cybernetic activities, where human-machine interactions are inherent and dominant. One such activity is requirements tracing that helps stakeholders to track the status of their goals. Although various kinds of support for human analysts in requirements tracing have been proposed, little is known about the nature of complementarity when different tracing practices are involved. In this paper, we explore the role of complementarity by considering together the tagging-to-trace (T2T) and learning-to-trace (L2T) activities. We present a novel approach to examining which T2T and L2T practices enhance the qualities of each other. Our approach also uncovers the environmental factors which the complementarity is sensitive to. Applying our approach to the logs of 140 analyst-tracing units offers operational insights into the rigorous detection of complementarity and shows the importance of understanding the cybernetic conditions under which the requirements tracing practices may in fact be complementary.

Software developers dedicate a major portion of their development effort towards testing and quality assurance (QA) activities, especially during and around the implementation phase. Nevertheless, we continue to see an alarmingly increasing trend in the cost and consequences of software failure. In an attempt to mitigate such loss and address software issues at a much earlier stage, researchers have recently emphasized on the successful coordination of requirements engineering and testing. In addition, the notion of requirements-based testing (RBT) has also emerged with a focus on checking the correctness, completeness, unambiguity, and logical consistency of requirements. One seminal work points out that requirements reside in the environment which is comprised of certain problem domain phenomena. Environmental assertions, which connect some of these phenomena in the indicative mood, play a key role in deciding whether a software solution is acceptable. Despite that requirements are located in the environment, little is known about if and how the environment assertions would impact testing and QA activities. In order to address this gap, we present a detailed empirical study, with 114 developers, on the prominence of environment assertions in RBT. Although the results suggest that paying attention to correct, complete, and useful environment assertions has a positive impact on RBT, developers often face difficulty in formulating good assertions from scratch. Our work, to that end, illuminates the potential usefulness of automated support in generating environment assertions.

In[1], Li Da Xu’s main affiliation should be Old Dominion University, Norfolk, VA 23529 USA.

Automated production systems are critical enablers for Industry 4.0 because these design-to-order, custom-built mechatronic systems are not only capable of delivering automation capabilities to satisfy the stakeholder requirements in the manufacturing/production domain, but doing so for a long period of time (e.g., several decades) during which numerous changing needs shall also be accounted for. Although traceability has long been recognized as key to sustain changes, little is known about how the traceability information is managed in place, i.e., in the native environments where the engineering artifacts reside. We contribute in this paper a survey of traceability support within state-of-the-practice tools: seven for programming logic controllers and six for building models in systems modeling language. We draw the similarities and differences from our survey results, and further present a design by leveraging the in-place traceability to better support the development and evolution of automated production systems.

Requirements traceability provides critical support throughout all phases of software engineering. Automated tracing based on information retrieval (IR) reduces the effort required to perform a manual trace. Unfortunately, IR-based trace recovery suffers from low precision due to polysemy, which refers to the coexistence of multiple meanings for a term appearing in different requirements. Latent semantic indexing (LSI) has been introduced as a method to tackle polysemy, as well as synonymy. However, little is known about the scope and significance of polysemous terms in requirements tracing. While quantifying the effect, we present a novel method based on artificial neural networks (ANN) to enhance the capability of automatically resolving polysemous terms. The core idea is to build an ANN model which leverages a term's highest-scoring coreferences in different requirements to learn whether this term has the same meaning in those requirements. Experimental results based on 2 benchmark datasets and 6 long-lived open-source software projects show that our approach outperforms LSI on identifying polysemous terms and hence increasing the precision of automated tracing.

To understand requirements traceability in practice, we contribute, in this paper, an automated approach to identifying questions from requirements repositories and examining their answering status. Applying our approach to 345 open-source projects results in 20622 questions, among which 53% and 15% are classified as successfully and unsuccessfully answered, respectively. By constructing a novel requirements socio-technical graph, we explore the impact of stakeholder-artifact relationships on traceability. The number of people, surprisingly, has little influence compared to other graph-theoretic measures like the clustering coefficient. Based on the repository mining results, we formulate a set of novel hypotheses about traceability. A case study supports some hypotheses while offering new insights.

In many critical industrial information systems, tracking a dependability requirement is instrumental to the verification and validation (V&V) of security, privacy, and other dependability concerns. Automated traceability tools employ information retrieval methods to recover candidate links, which saves much manual effort. Integrating relevance feedback (RF) could potentially improve the retrieval effectiveness by soliciting the relevance judgments on a subset of the retrieval results and then incorporating the feedback into subsequent retrieval. However, little is known about how to use RF to trace dependability requirements. In this paper, we propose a novel term-based RF algorithm that leverages the term usage context to recommend positive and negative feedback. Experiments on two software datasets show that our algorithm significantly outperforms the contemporary link-based RF tracing method. Our work not only contributes a new solution to dependability requirements' V&V, but also enables further automation to reduce the manual effort in the development life cycle of dependable industrial systems.

The value of traceability is in its use. How do different software engineering tasks affect the tracing of the same requirement? In this paper, we answer the question via an empirical study where we explicitly assign the participants into 3 trace-usage groups of one requirement: finding its implementation for verification and validation purpose, changing it within the original software system, and reusing it toward another application. The results uncover what we call "gray links"--around 20% of the total traces are voted to be true links with respect to only one task but not the others. We provide a mechanism to identify such gray links and discuss how they can be leveraged to advance the research and practice of value-based requirements traceability.

Group size is a key factor in collaborative software development and many other cybernetic applications where task assignments are important. While methods exist to estimate its value for proprietary projects, little is known about how group size affects distributed and decentralized cybernetic applications and in particular open source software (OSS) development. This paper presents a novel approach in which we frame developers' collective resolution of OSS change tasks as a social information foraging problem. This new perspective enables us to predict the optimal group size and quantify group size's effect on individual performance. We test the theory with data mined from two projects: 1) Firefox and 2) Mylyn. This paper not only uncovers the mismatch of optimal and actual group sizes, but also reveals the association of optimality with improved productivity. In addition, the social-level productivity gain is observed as project evolves. We show this paper's impact by extending the frontiers of knowledge in two areas: 1) social coding and 2) recommendation systems.