Collaborative Research: Supporting Secure Programming Education in the IDE

协作研究：支持 IDE 中的安全编程教育

• 批准号: 1044554
• 负责人: Dugald Hutchings
• 金额: $ 1.45万
• 依托单位: Elon University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2011
• 资助国家: 美国
• 起止时间: 2011-09-01 至 2014-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1044554&HistoricalAwards=false
• 关键词: Collaborative; Research; Supporting; Secure; Programming

The objective of this project is to develop the Application Security IDE (ASIDE) plug-in for Eclipse that warns programmers of potential vulnerabilities in their code and assists them in addressing these vulnerabilities. The tool serves as an always available reminder and educational opportunity during any coding activities. The tool is designed to address input validation vulnerabilities; output encoding; authentication and authorization; and several race condition vulnerabilities.The goals of this project are: (a) develop and deploy a usable tool that can serve a wide range of students and courses; (b) improve student awareness and understanding of security vulnerabilities in software; (c) increase utilization of secure programming techniques in assignments; and (d) have minimal impact on other course objectives and instructors. ASIDE is used in a range of programming courses, from CS1 to advanced Web programming, at three universities. The project evaluates how students use the tool, the impact on assignments, students' vulnerability awareness, and the impact on the course instructors. The proposed approach investigates whether integrating educational support into an IDE overcomes some of these challenges and provides effective training throughout a student's education. The ASIDE plug-in can be utilized by a wide variety of students throughout their academic and professional careers. The tool is expected to be adopted by a wide audience and has the potential to improve the security knowledge of students at all levels. The project has a direct impact on students at multiple levels at different institutions, including an HBCU and an undergraduate liberal arts university. The ASIDE plug-in is available for download on the project's website.

该项目的目标是开发用于Eclipse的应用程序安全IDE(旁注)插件，该插件警告程序员代码中的潜在漏洞，并帮助他们解决这些漏洞。在任何编码活动中，该工具都是一个随时可用的提醒和教育机会。该工具旨在解决输入验证漏洞、输出编码、身份验证和授权以及几个竞争条件漏洞。该项目的目标是：(A)开发和部署可为广泛的学生和课程服务的可用工具；(B)提高学生对软件安全漏洞的认识和理解；(C)增加作业中安全编程技术的使用；以及(D)对其他课程目标和教师的影响最小。在三所大学的一系列编程课程中，从CS1到高级网络编程，都使用了Alside。该项目评估学生如何使用该工具，对作业的影响，学生的脆弱性意识，以及对课程教师的影响。建议的方法调查将教育支持集成到集成开发环境中是否克服了其中的一些挑战，并在学生的整个教育过程中提供有效的培训。各种各样的学生在他们的学术和职业生涯中都可以使用Aside插件。该工具预计将被广泛的受众采用，并有可能提高各级学生的安全知识。该项目对不同机构的多个层次的学生产生了直接影响，包括HBCU和一所本科文科大学。可以在该项目的网站上下载Aside插件。