Francesco Casillo

The utmost importance of privacy and security requirements in software development calls for adopting methods that enable the identification and proactive mitigation of these issues during the system development. Our survey of 45 primary studies provides an overview of the methods, document types, and datasets employed in tackling this challenge, along with an analysis of approaches demonstrating superior performance based on document types and specific identification problems. Analysis reveals a wide adoption of ML-based systems on diverse datasets, showcasing the effectiveness of leveraging various sources of information to identify privacy and security requirements in software development.

Stakeholders’ conversations in requirements elicitation meetings hold valuable insights into system and client needs. However, manually extracting requirements is time-consuming, labor-intensive, and prone to errors and biases. While current state-of-the-art methods assist in summarizing stakeholder conversations and classifying requirements based on their nature, there is a noticeable lack of approaches capable of both identifying requirements within these conversations and generating corresponding system requirements. These approaches would assist requirement identification, reducing engineers’ workload, time, and effort. They would also enhance accuracy and consistency in documentation, providing a reliable foundation for further analysis. To address this gap, this paper introduces RECOVER (Requirements EliCitation frOm conVERsations), a novel conversational requirements engineering approach that leverages natural language processing and large language models (LLMs) to support practitioners in automatically extracting system requirements from stakeholder interactions by analyzing individual conversation turns. The approach is evaluated using a mixed-method research design that combines statistical performance analysis with a user study involving requirements engineers, targeting two levels of granularity. First, at the conversation turn level, the evaluation measures RECOVER’s accuracy in identifying requirements-relevant dialogue and the quality of generated requirements in terms of correctness, completeness, and actionability. Second, at the entire conversation level, the evaluation assesses the overall usefulness and effectiveness of RECOVER in synthesizing comprehensive system requirements from full stakeholder discussions. Empirical evaluation of RECOVER shows promising performance, with generated requirements demonstrating satisfactory correctness, completeness, and actionability. The results also highlight the potential of automating requirements elicitation from conversations as an aid that enhances efficiency while maintaining human oversight.

Machine learning (ML) is increasingly being used as a key component of most software systems, yet serious concerns have been raised about the fairness of ML predictions. Researchers have been proposing novel methods to support the development of fair machine learning solutions. Nonetheless, most of them can only be used in late development stages, e.g., during model training, while there is a lack of methods that may provide practitioners with early fairness analytics enabling the treatment of fairness throughout the development lifecycle. This paper proposes ReFair, a novel context-aware requirements engineering framework that allows to classify sensitive features from User Stories. By exploiting natural language processing and word embedding techniques, our framework first identifies both the use case domain and the machine learning task to be performed in the system being developed; afterward, it recommends which are the context-specific sensitive features to be considered during the implementation. We assess the capabilities of ReFair by experimenting it against a synthetic dataset---which we built as part of our research---composed of 12,401 User Stories related to 34 application domains. Our findings showcase the high accuracy of ReFair, other than highlighting its current limitations.

ContextThe identification of security requirements in the early phases of system development ensures integrating necessary aspects into the IT network infrastructure and saving time and costs in the software development life cycle.AimsIn this work, we explore the impact of transformer language models on the task of detecting security-related requirements from text documents.MethodThe proposed approach adopts recent Natural Language Processing techniques for implementing sentence-level classifications of security requirements. We leverage three different BERT-based transformers, each combined with a sentence classification model, to determine whether a requirement is security-related. Our proposal is evaluated using three datasets of specificationsfromdifferentindustrydomains,andconsideringpredictionmodelstrained and validated on requirements of the same dataset (i.e., intra-domain) and of different datasets (i.e., inter-domain).ResultsThe analysis reveals that our approach achieves high performances with all the considered models. The best model outperforms existing approaches with F1-score improved of about 8% for intra-domain experiments (0.95 vs. 0.88) and of about 11% for inter-domain experiments (0.70 vs. 0.63).ConclusionThe results of our study should inspire software engineering researchers and practitioners to consider opportunities to automate security detection in the early stages of the software development process by taking advantage of recent transformer-based models.

ContextThe identification of security requirements in the early phases of system development ensures integrating necessary aspects into the IT network infrastructure and saving time and costs in the software development life cycle.AimsIn this work, we explore the impact of transformer language models on the task of detecting security-related requirements from text documents.MethodThe proposed approach adopts recent Natural Language Processing techniques for implementing sentence-level classifications of security requirements. We leverage three different BERT-based transformers, each combined with a sentence classification model, to determine whether a requirement is security-related. Our proposal is evaluated using three datasets of specificationsfromdifferentindustrydomains,andconsideringpredictionmodelstrained and validated on requirements of the same dataset (i.e., intra-domain) and of different datasets (i.e., inter-domain).ResultsThe analysis reveals that our approach achieves high performances with all the considered models. The best model outperforms existing approaches with F1-score improved of about 8% for intra-domain experiments (0.95 vs. 0.88) and of about 11% for inter-domain experiments (0.70 vs. 0.63).ConclusionThe results of our study should inspire software engineering researchers and practitioners to consider opportunities to automate security detection in the early stages of the software development process by taking advantage of recent transformer-based models.