AI-Enabled Common Criteria-Based Completeness Assessment of Security Requirements in IoT Smart Home Systems

Validating natural language security requirements (SRs) are fully specified remains a persistent challenge in SRs Engineering (SRE). Manual reviews are slow, error-prone, and rarely align systematically with international standards like the Common Criteria (CC). This article evaluates whether the requirement completeness in smart-home Internet-of-Things (IoT) specifications can be audited deterministically by constraining transformer-based semantic embeddings within bounded vector spaces. To test this, an automated completeness checking approach is developed within the proposed framework. The methodology integrates text processing tools (nltk, python-docx, PyPDF2, Crypto.Cipher) with fine-tuned BERT-base-uncased embeddings built using PyTorch and Hugging Face Transformers. The framework evaluates requirement completeness on two levels. First, term-level completeness is measured via cosine semantic similarity against expert-validated CC keywords. Second, relationship-level completeness is tracked using a dual metric combining cosine similarity and Euclidean distance. Additionally, an all-MiniLM-L6–v2 topic modeling layer automatically categorizes requirements into primary objectives: authentication, communication, and system configuration. Grounded on a 174-sample expert corpus and a 680-sample commercial IoT dataset, human expert annotations achieved a Fleiss Kappa interrater agreement of 0.602. Data scarcity constraints were resolved using context-aware synonym data augmentation and Repeated Stratified fivefold Cross-Validation. The model achieved a classification accuracy of 77.8% on expert data and 89.7% on commercial IoT specifications. The proposed framework significantly outperformed traditional Term Frequency-Inverse Document Frequency (TF-IDF) and Support Vector Machine (SVM) baselines.