Study finds security NFRs hardest to trace in blockchain-IoT code
New paper reveals NFR-to-code traceability is 2x harder than FRs, especially for security.
Deep Dive
A manually curated traceability dataset from a real blockchain-IoT system was built, comparing functional (FR) and non-functional (NFR) requirement links. Using TF-IDF, BM25, LSI, and WMD baselines, the study found FR-to-code tracing is consistently easier, with security NFRs being the toughest. The main hurdle isn't requirement availability but scattered implementation evidence.
Key Points
- NFR-to-code tracing is consistently harder than FR-to-code tracing across all four retrieval methods (TF-IDF, BM25, LSI, WMD).
- Security-related NFRs are the most difficult subset to trace, likely because their implementation evidence is scattered.
- The main challenge is not requirement availability but rather that implementation evidence for NFRs is distributed and not clearly localized in code.
Why It Matters
Improving NFR traceability is critical for verifying security, performance, and compliance in complex blockchain-IoT systems.