Elements: An Infrastructure for Software Quality and Security Issues Detection and Correction

对更有效的软件开发的研究有可能使科学界、工业界和政府机构中如此多的社会方面所依赖的基础设施成本更低、更安全。特别是，科学界正在提出数以百万计的科学软件原型，以便在几乎每个领域实现研究结果的可重复性。由于科学家在软件质量和安全方面的经验有限，并且缺乏可以在编程环境中轻松使用和集成的质量和安全评估工具，他们可能经常通过代码更改将安全和质量问题引入现有的科学软件中。因此，一些现有的科学软件项目很难1)由科学家扩展，因为它们的质量很差；2)由行业部署，因为可能存在安全漏洞和使用的不良开发实践。如果没有一个统一的、易于集成的框架来检测、修复和记录科学项目中的漏洞和质量问题，科学项目的可重用性、可扩展性、安全部署和技术转移将仍然受到限制。这个项目构建了一个可持续的、社区驱动的软件安全和质量分析框架。这些工具使更多的科学家能够构建更好的软件，并通过遵循最佳软件开发实践将他们的原型转移到工业中。它的综合教育计划将使计算机科学专业的本科生和研究生对软件系统的发展有更多的认识和专业知识，包括安全和质量问题。这个项目开发了一个用于检测、修复和记录安全和质量问题的框架。它将持续监控软件存储库，以识别基于静态和动态分析的安全漏洞和质量问题，然后找到代码更改的最佳顺序，以确定优先级并修复它们。开发人员可以在详细的报告中查看建议及其影响，并选择他们想要应用的代码更改。该框架包括对项目发展过程中质量和安全性变化的可视化支持。此外，来自科学界的非专业程序员可以使用框架自动生成的文档来理解检测到的问题的严重性和必要的代码更改来修复它们。该项目有可能通过统一安全和质量问题检测和纠正，以及启用自动化文档，彻底改变开发人员在持续集成环境中监控系统演变的方式。所有工具和方法将与来自不同领域的科学家合作进行经验评估。这些工具将使更多的科学家能够构建更好的软件，并通过遵循最佳开发实践将他们的原型转移到工业中。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Research into more effective software development has the potential to make the infrastructure on which so many aspects of society depend less costly and more secure in the scientific community, industry and government agencies. In particular, the scientific community is proposing millions of scientific software prototypes to enable reproducibility of research results in almost every domain. Scientists may frequently introduce security and quality issues into existing scientific software via their code changes due to their limited experience in software quality and security and the lack of tools for quality and security assessments that can be easily used and integrated in programming environments. Thus, several existing scientific software projects are difficult to 1) extend by scientists due to their poor quality and 2) deploy by industry due to the likelihood of security vulnerabilities and the bad development practices used. Without a unified and easy-to-integrate framework for detecting, fixing, and documenting vulnerability and quality issues in scientific projects, the reusability, extendibility, safe deployment, and technology transfer of scientific projects will remain limited. This project builds a sustainable, community-driven software security and quality analysis framework. These tools enable more scientists to build better software and to transfer their prototypes to industry by following the best software development practices. Its integrated education plan will bring undergraduate and graduate computer science students more awareness and expertise in the evolution of software systems, including security and quality issues.This project develops a framework for detecting, fixing, and documenting security and quality issues. It will continuously monitor the software repository to identify security vulnerabilities and quality issues based on static and dynamic analyses, and then find the best sequence of code changes to prioritize and fix them. The developers can review the recommendations and their impacts in a detailed report and select the code changes that they want to apply. The framework includes a visualization support of the quality and security changes over the evolution of the project. Furthermore, non-expert programmers from the scientific community can use the automatically generated documentation by the framework to understand the severity of the detected issues and necessary code changes to fix them. The project has the potential to revolutionize how developers monitor the evolution of their systems in continuous integration environments by unifying security and quality issues detection and correction and enabling their automated documentation. All tools and methodologies will be empirically evaluated in collaboration with scientists from various domains. These tools will enable more scientists to build better software and transfer their prototypes to industry by following best development practices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.