SaTc: EDU: Collaborative: An Assessment Driven Approach to Self-Directed Learning in Secure Programming (SecTutor)

软件开发领域需要开发人员编写安全的代码，不断响应不断变化的威胁，并调整系统设计以满足新的安全需求。这就要求开发人员深入理解安全编程的基本概念，并不断学习和实践防御性、安全性和健壮性的编码。鉴于目前大多数计算程序中缺乏一致和全面的安全编程培训，以及任何培训都需要发展以满足新的要求，因此必须具有使安全编程培训具有自适应性和智能性的机制。本项目的目标是开发一个这样的机制，命名为SecTutor，这是一个双重用途的自适应测试和智能辅导系统。使用SecTutor，学习者将能够识别他们当前缺少的知识和安全编程中的误解领域，并访问内容以按照自己的节奏改进学习。SecTutor将提供即时反馈和学习分析，以激励和指导学习者。该项目将采用评估驱动的方法进行个性化的自我导向学习：严格的评估测试学习者的知识和技能水平，以便智能辅导系统可以直接针对学习者校准教学。具体来说，该项目的第一步将是构建一个自适应测试，以诊断学习者对安全编程的基础理解水平。这种自适应测试将基于严格构建的安全编程概念清单。这个测试还将诊断学习者发现困难或根本不理解的主题。该项目的下一步将是建立一个智能教程系统，为学习者掌握安全编程概念和技能提供内容和指导。第三步是将学习分析纳入系统，不仅为单个学习者提供反馈，还为教师提供机制，以收集有关学习者的信息，将其与其他人口统计数据进行比较，分析安全编程问题，并调整其课程以应对特定挑战或定制要求。SecTutor最终将被整合到其他现有的安全编程资源中，并将被广泛用于安全编程培训。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The field of software development needs developers to write secure code, as well as to continuously respond to evolving threats and adapt system designs to meet new security needs. This requires developers to gain a deep understanding of foundational concepts in secure programming, and continuously learn and practice defensive, secure, and robust coding. Given the current lack of consistent and comprehensive secure programming training in most computing programs, and the need for any training to evolve to meet new requirements, it is essential to have mechanisms that make secure programming training adaptive and intelligent. The goal for this project is to develop one such mechanism, named SecTutor, which is a dual-purpose adaptive testing and intelligent tutoring system. Using SecTutor, learners will be able to identify their current missing knowledge and areas of misunderstanding in secure programming, and access content to improve learning at their own pace. SecTutor will provide immediate feedback and learning analytics to motivate and guide learners.The project will take an assessment-driven approach for personalized, self-directed learning: a rigorous assessment tests the learner's level of knowledge and skill so that the intelligent tutoring system can calibrate the instruction directly to the learner. Specifically, the first step of the project will be to construct an adaptive test to diagnose learners' current level of foundational understanding in secure programming. This adaptive test will be based on a rigorously constructed secure programming concept inventory. This test will also diagnose what topics the learner is finding difficult or is fundamentally not understanding. The next step of the project will be to build an intelligent tutorial system that will provide both content and guidance for the learner to master secure programming concepts and skills. The third step will be to incorporate learning analytics into the system that will not only provide feedback to individual learners, but also provide mechanisms for instructors to gather information about their learners, compare them to other demographics, analyze secure programming questions, and adapt their curriculum to address specific challenges or customized requirements. SecTutor will eventually be integrated into other existing secure programming resources and will be adopted broadly for secure programming training.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.