Collaborative Research: Towards Engaged, Personalized and Transferable Learning of Secure Programming by Leveraging Real-World Security Vulnerabilities

该项目旨在通过建立以现实世界安全漏洞为动机的个性化安全编程项目来服务于国家利益。许多教育工作者在一系列计算机科学入门课程中引入了安全编程的概念。然而，学生在将知识应用于现实世界中的新编程任务方面仍然存在困难。学生的内在动机可能很低，或者几乎没有实际的例子，因此技能和能力在任务之间的迁移是有限的。拟议项目旨在为安全方案编制的持续学习和实际应用提供更多机会。该项目有可能培养一支具有强大安全编程技能的有能力的劳动力队伍。该项目可能有助于培养一支称职的劳动力队伍，以保护国家的信息技术基础设施。项目团队计划开展三项活动：1)在课程中的安全编程主题与现实世界漏洞类别之间建立映射；2)从选定的现实世界漏洞中构建易于使用的学习项目；3)根据不同的任务背景开发个性化的项目交付机制。拟议的工作旨在建立一个以学习者为中心的基于能力的安全编程模型，并建立一个由学习者、教育工作者和研究人员组成的支持社区。项目成果将在项目网站上传播，并通过与计算有关的会议、开放源码储存库和邮件列表进行传播。NSF IUSE：EDU计划支持研究和开发项目，以提高所有学生的STEM教育的有效性。通过其参与的学生学习跟踪，该计划支持有前途的实践和工具的创建、探索和实施。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project aims to serve the national interest by building personalized secure programming projects motivated by real world security vulnerabilities. A number of educators have introduced concepts in secure programming into a series of introductory computer science courses. Students, however, still have difficulty in applying knowledge to new programming tasks in real world scenarios. Students may either have low intrinsic motivations or have few practical examples so that there is limited transfer of skills and competencies across tasks. The proposed project intends to provide additional opportunities for continued learning and real-world applications of secure programming. The project has the potential to prepare a capable workforce with strong secure programming skills. The project would potentially contribute to a competent workforce to safeguard the nation's information technology infrastructure. The project team plans to conduct three activities: 1) mapping between secure programming topics in the curriculum and categories of real-world vulnerabilities, 2) building easy-to-use learning projects from selected real-world vulnerabilities, and 3) developing a personalized project delivery mechanism based on different task contexts. The proposed work intends to establish a learner-centered competency-based model for secure programming and to build a supporting community of learners, educators, and researchers. The project results will be disseminated on the project website, and through computing related conferences, open-source repositories, and mailing lists. The NSF IUSE: EDU Program supports research and development projects to improve the effectiveness of STEM education for all students. Through its Engaged Student Learning track, the program supports the creation, exploration, and implementation of promising practices and tools.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.