Elements: An Infrastructure for Software Quality and Security Issues Detection and Correction

对更有效的软件开发的研究有可能使社会许多方面所依赖的基础设施在科学界、工业界和政府机构中成本更低、更安全。特别是，科学界正在提出数以百万计的科学软件原型，以使几乎每个领域的研究结果都能重现。由于科学家在软件质量和安全方面的经验有限，而且缺乏易于在编程环境中使用和集成的质量和安全评估工具，他们可能经常通过代码更改将安全和质量问题引入现有的科学软件。因此，一些现有的科学软件项目难以1）由于其质量差而被科学家扩展，2）由于安全漏洞的可能性和所使用的不良开发实践而被行业部署。如果没有一个统一且易于集成的框架来检测、修复和记录科学项目中的漏洞和质量问题，科学项目的可重用性、可扩展性、安全部署和技术转让将仍然受到限制。该项目建立了一个可持续的、社区驱动的软件安全和质量分析框架。这些工具使更多的科学家能够构建更好的软件，并通过遵循最佳软件开发实践将其原型转移到行业中。它的综合教育计划将使本科生和研究生计算机科学的学生在软件系统的发展，包括安全和质量问题的认识和专业知识。这个项目开发了一个框架，用于检测，修复和记录安全和质量问题。它将持续监控软件存储库，以基于静态和动态分析来识别安全漏洞和质量问题，然后找到代码更改的最佳序列来优先考虑并修复它们。开发人员可以在详细的报告中查看建议及其影响，并选择他们想要应用的代码更改。该框架包括对项目发展过程中质量和安全变化的可视化支持。此外，来自科学界的非专业程序员可以使用框架自动生成的文档来了解检测到的问题的严重性以及修复这些问题所需的代码更改。该项目有可能通过统一安全和质量问题检测和纠正以及实现自动化文档记录，彻底改变开发人员在持续集成环境中监控系统演变的方式。所有工具和方法将与来自各个领域的科学家合作进行经验评估。这些工具将使更多的科学家能够构建更好的软件，并通过遵循最佳开发实践将其原型转移到工业中。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Research into more effective software development has the potential to make the infrastructure on which so many aspects of society depend less costly and more secure in the scientific community, industry and government agencies. In particular, the scientific community is proposing millions of scientific software prototypes to enable reproducibility of research results in almost every domain. Scientists may frequently introduce security and quality issues into existing scientific software via their code changes due to their limited experience in software quality and security and the lack of tools for quality and security assessments that can be easily used and integrated in programming environments. Thus, several existing scientific software projects are difficult to 1) extend by scientists due to their poor quality and 2) deploy by industry due to the likelihood of security vulnerabilities and the bad development practices used. Without a unified and easy-to-integrate framework for detecting, fixing, and documenting vulnerability and quality issues in scientific projects, the reusability, extendibility, safe deployment, and technology transfer of scientific projects will remain limited. This project builds a sustainable, community-driven software security and quality analysis framework. These tools enable more scientists to build better software and to transfer their prototypes to industry by following the best software development practices. Its integrated education plan will bring undergraduate and graduate computer science students more awareness and expertise in the evolution of software systems, including security and quality issues.This project develops a framework for detecting, fixing, and documenting security and quality issues. It will continuously monitor the software repository to identify security vulnerabilities and quality issues based on static and dynamic analyses, and then find the best sequence of code changes to prioritize and fix them. The developers can review the recommendations and their impacts in a detailed report and select the code changes that they want to apply. The framework includes a visualization support of the quality and security changes over the evolution of the project. Furthermore, non-expert programmers from the scientific community can use the automatically generated documentation by the framework to understand the severity of the detected issues and necessary code changes to fix them. The project has the potential to revolutionize how developers monitor the evolution of their systems in continuous integration environments by unifying security and quality issues detection and correction and enabling their automated documentation. All tools and methodologies will be empirically evaluated in collaboration with scientists from various domains. These tools will enable more scientists to build better software and transfer their prototypes to industry by following best development practices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.