TY - GEN

T1 - Can we use LLMs to recover Trace Links between Source Code and Security Requirements?

AU - Paßlack, Jan Marc

AU - Specht, Alexander

AU - Herrmann, Marc

AU - Elsofi, Duaa Adel Ali

AU - Ehl, Marco

AU - Großer, Katharina

AU - Jürjens, Jan

AU - Schneider, Kurt

N1 - Publisher Copyright: © 2025 IEEE.

PY - 2025/9/1

Y1 - 2025/9/1

N2 - In software development, many different artifacts are created during the process. At the beginning, requirements for the respective software are defined and then written down in a specification. This is followed by other artifacts, such as source code, test cases, or various UML diagrams. Different standards, including ISO 26262 for the automotive industry, require that safety and security requirements be explicitly traced for these different artifacts. However, tracing of requirements in source code is very time-consuming, error-prone, and costly. To reduce the effort involved, various approaches have been developed that use different techniques, such as information retrieval or machine learning, to automate this process. However, these approaches also have problems, so that practical use, especially in safety and security domains, is limited. In this paper, we have therefore developed a plugin for VSCode and a new approach based on LLMs to recover trace links between safety and security requirements and source code. Our results show that the used LLMs are capable of performing this task because they have both code and textual understanding. In various combinations, Llama showed satisfying results in terms of precision (0.8).

AB - In software development, many different artifacts are created during the process. At the beginning, requirements for the respective software are defined and then written down in a specification. This is followed by other artifacts, such as source code, test cases, or various UML diagrams. Different standards, including ISO 26262 for the automotive industry, require that safety and security requirements be explicitly traced for these different artifacts. However, tracing of requirements in source code is very time-consuming, error-prone, and costly. To reduce the effort involved, various approaches have been developed that use different techniques, such as information retrieval or machine learning, to automate this process. However, these approaches also have problems, so that practical use, especially in safety and security domains, is limited. In this paper, we have therefore developed a plugin for VSCode and a new approach based on LLMs to recover trace links between safety and security requirements and source code. Our results show that the used LLMs are capable of performing this task because they have both code and textual understanding. In various combinations, Llama showed satisfying results in terms of precision (0.8).

KW - Large Language Models

KW - Safety Requirements

KW - Security Requirements

KW - Source Code

KW - Tracing

UR - http://www.scopus.com/inward/record.url?scp=105020905218&partnerID=8YFLogxK

U2 - 10.1109/REW66121.2025.00035

DO - 10.1109/REW66121.2025.00035

M3 - Conference contribution

AN - SCOPUS:105020905218

SN - 979-8-3315-3835-4

T3 - Proceedings -International Requirements Engineering Conference Workshops

SP - 223

EP - 232

BT - Proceedings - 2025 IEEE 33rd International Requirements Engineering Conference Workshops, REW 2025

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 33rd IEEE International Requirements Engineering Conference Workshops, REW 2025

Y2 - 1 September 2025 through 5 September 2025

ER -