Evaluating interactive support for secure programming
Evaluating interactive support for secure programming
复制标题
评估安全编程的交互式支持
DOI：
--
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
B. Chu
中科院分区：
文献类型：
--
作者：
Jing Xie;H. Lipford;B. Chu
实现安全代码是一项重要且经常被忽视的非功能需求。安全编程错误是程序错误的子集，它会导致商业软件中许多常见的隐私和安全漏洞。我们正在寻求为开发环境中的安全编程提供交互支持。在本文中，我们评估了我们的原型工具，它提供实时警告和代码生成，以减少程序员引入的安全编程错误。我们在两个对比用户研究中评估了ASSIDE在新手和专业开发人员中的潜在使用和有效性。我们的结果表明，交互支持可以帮助解决这一重要的非功能需求，并为这类工具提供支持程序员的指导方针。
Implementing secure code is an important and oft-overlooked non-functional requirement. Secure programming errors are a subset of program errors that result in many common privacy and security breaches in commercial software. We are seeking to provide interactive support for secure programming in the development environment. In this paper, we have evaluated our prototype tool, ASIDE, which provides real-time warnings and code generation to reduce secure programming errors introduced by programmers. We evaluate the potential use and effectiveness of ASIDE on both novice and professional developers in two comparison user studies. Our results demonstrate that the interactive support can help address this important non-functional requirement, and suggest guidelines for such tools to support programmers.