Understanding security vulnerabilities in student code: A case study in a non-security course

Simple item page
buir.contributor.authorYilmaz, Tolga
buir.contributor.authorUlusoy, Özgür
buir.contributor.orcidYilmaz, Tolga|0000-0001-8617-9301
buir.contributor.orcidUlusoy, Özgür|0000-0002-6887-3778
dc.citation.epage111150- 11en_US
dc.citation.spage111150- 1en_US
dc.citation.volumeNumber185en_US
dc.contributor.authorYilmaz, Tolga
dc.contributor.authorUlusoy, Özgür
dc.date.accessioned2023-02-14T11:41:55Z
dc.date.available2023-02-14T11:41:55Z
dc.date.issued2021-12-14
dc.departmentDepartment of Computer Engineeringen_US
dc.description.abstractSecure coding education is quite important for students to acquire the skills to quickly adapt to the evolving threats towards the software they are expected to create once they graduate. Educators are also more aware of this situation and incorporate teaching security in their respective fields. An effective application of this is only possible by cultivating the teaching and learning perspectives. Understanding the security awareness and practice of students is useful as an initial step to create a baseline for teaching methods and content. In this paper, we first survey to investigate how students approach security and what could motivate them to learn and apply security practices. Then, we analyze the source code for 6 semesters of coding assignments for 2 tasks using a source code vulnerability analysis tool. In our analysis, we report the types of vulnerabilities and various aspects between them while incorporating the effect of student grades. We then explore the lexical and structural features of security in student code using data analysis and machine learning. For the lexical analysis, we build a classifier to extract informative features and for the structural analysis, we utilize Syntax Trees to represent code and perform clustering in terms of structural features where clusters themselves yield different vulnerability levels.en_US
dc.description.provenanceSubmitted by Ezgi Uğurlu (ezgi.ugurlu@bilkent.edu.tr) on 2023-02-14T11:41:55Z No. of bitstreams: 1 Understanding_security_vulnerabilities_in_student_code_A_case_study_in_a_non-security_course.pdf: 3955969 bytes, checksum: 4542fd64ada0ad49cf091f36ab622372 (MD5)en
dc.description.provenanceMade available in DSpace on 2023-02-14T11:41:55Z (GMT). No. of bitstreams: 1 Understanding_security_vulnerabilities_in_student_code_A_case_study_in_a_non-security_course.pdf: 3955969 bytes, checksum: 4542fd64ada0ad49cf091f36ab622372 (MD5) Previous issue date: 2021-12-14en
dc.embargo.release2023-12-14
dc.identifier.doi10.1016/j.jss.2021.111150en_US
dc.identifier.eissn1873-1228
dc.identifier.issn0164-1212
dc.identifier.urihttp://hdl.handle.net/11693/111260
dc.language.isoEnglishen_US
dc.publisherElsevier Inc.en_US
dc.relation.isversionofhttps://doi.org/10.1016/j.jss.2021.111150en_US
dc.source.titleThe Journal of Systems and Softwareen_US
dc.subjectSecure coding educationen_US
dc.subjectSource code analysisen_US
dc.subjectData miningen_US
dc.subjectVulnerability analysisen_US
dc.titleUnderstanding security vulnerabilities in student code: A case study in a non-security courseen_US
dc.typeArticleen_US

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Understanding_security_vulnerabilities_in_student_code_A_case_study_in_a_non-security_course.pdf
Size:
3.77 MB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.69 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

Department of Computer Engineering