EAGER: Collaborative: Using Cognitive Techniques To Detect and Prevent Security Flaws

软件漏洞是一个重大问题，存在的部分原因是程序员的错误。一个常见的原因是，程序员对代码将执行的操作的理解与代码执行的实际操作之间存在认知鸿沟。这项工作朝着严格理解人类如何思考代码迈出了第一步，以(最终)通过构建更多人类可理解的编程语言和程序来帮助显着减少错误。该项目将进行一项试点研究，以确定如何理解此类安全漏洞，梳理出它们的关键方面，并将这种了解整合到专家辅导系统中，以帮助程序员发现它们。认知科学技术将通过将漏洞切片到其组件部分并评估由此产生的漏洞，来得出现有安全漏洞中的核心促成问题。这将产生对安全问题的普遍理解，从而能够容易地复制和复制类似的源代码，这是专家辅导工具的理想输入。由此产生的专家辅导工具将用于评估辅导在帮助程序员减少对类似错误的敏感度方面的有效性。

Software vulnerabilities are a substantial problem that exists in part due to programmer errors. A common cause is that programmers have a cognitive gap between their understanding of what actions code will perform and the actual actions the code performs. This work takes a first step toward rigorously understanding how humans think about code to (eventually) help to dramatically reduce bugs by building more human understandable programming languages and programs. This project will perform a pilot study to determine how to understand such security bugs, tease out the key aspects of them, and integrate this understanding into expert tutoring systems to help programmers detect them.Cognitive science techniques will be used to derive the core contributing issues in existing security vulnerabilities by slicing vulnerabilities into their component parts and evaluating the resulting bugs. This will create a generalized understanding of security issues which will enable easy reproduction and replication of similar source code, which is ideal input for an expert tutoring tool. The resulting expert tutoring tool will be used to evaluate the effectiveness of tutoring in helping programmers reduce reduce their susceptibility to similar bugs.