SaTc: EDU: Collaborative: An Assessment Driven Approach to Self-Directed Learning in Secure Programming (SecTutor)

软件开发领域需要开发人员编写安全代码，并不断响应不断变化的威胁，调整系统设计以满足新的安全需求。这要求开发人员深入理解安全编程的基本概念，并不断学习和练习防御性、安全和健壮的编码。鉴于目前大多数计算程序缺乏一致和全面的安全编程培训，并且任何培训都需要发展以满足新的要求，因此必须具有使安全编程培训自适应和智能化的机制。该项目的目标是开发一种这样的机制，名为SecTutor，这是一个两用的自适应测试和智能辅导系统。使用SecTutor，学习者将能够识别他们目前在安全编程中缺失的知识和误解领域，并访问内容以按照自己的速度改进学习。SecTutor将提供即时反馈和学习分析，以激励和指导学习者。该项目将采用以评估为导向的个性化学习方法：严格的评估测试学习者的知识和技能水平，以便智能教学系统可以直接向学习者校准教学。具体地说，该项目的第一步将是构建一个适应性测试，以诊断学习者当前在安全编程方面的基础理解水平。这项适应性测试将基于严格构建的安全编程概念清单。这项测试还将诊断学习者发现困难或根本不理解的主题。该项目的下一步将是建立一个智能教程系统，为学习者提供内容和指导，以掌握安全编程的概念和技能。第三步是将学习分析纳入系统，不仅向个别学习者提供反馈，还为教师提供机制，以收集关于他们的学习者的信息，将他们与其他人口统计数据进行比较，分析安全编程问题，并调整他们的课程以应对特定的挑战或定制的要求。SecTutor最终将被整合到其他现有的安全编程资源中，并将被广泛用于安全编程培训。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The field of software development needs developers to write secure code, as well as to continuously respond to evolving threats and adapt system designs to meet new security needs. This requires developers to gain a deep understanding of foundational concepts in secure programming, and continuously learn and practice defensive, secure, and robust coding. Given the current lack of consistent and comprehensive secure programming training in most computing programs, and the need for any training to evolve to meet new requirements, it is essential to have mechanisms that make secure programming training adaptive and intelligent. The goal for this project is to develop one such mechanism, named SecTutor, which is a dual-purpose adaptive testing and intelligent tutoring system. Using SecTutor, learners will be able to identify their current missing knowledge and areas of misunderstanding in secure programming, and access content to improve learning at their own pace. SecTutor will provide immediate feedback and learning analytics to motivate and guide learners.The project will take an assessment-driven approach for personalized, self-directed learning: a rigorous assessment tests the learner's level of knowledge and skill so that the intelligent tutoring system can calibrate the instruction directly to the learner. Specifically, the first step of the project will be to construct an adaptive test to diagnose learners' current level of foundational understanding in secure programming. This adaptive test will be based on a rigorously constructed secure programming concept inventory. This test will also diagnose what topics the learner is finding difficult or is fundamentally not understanding. The next step of the project will be to build an intelligent tutorial system that will provide both content and guidance for the learner to master secure programming concepts and skills. The third step will be to incorporate learning analytics into the system that will not only provide feedback to individual learners, but also provide mechanisms for instructors to gather information about their learners, compare them to other demographics, analyze secure programming questions, and adapt their curriculum to address specific challenges or customized requirements. SecTutor will eventually be integrated into other existing secure programming resources and will be adopted broadly for secure programming training.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.