Collaborative Research: CIRC: Planning-C: An Infrastructure and Dataset for Research in Software Vulnerability Detection and Remediation

Software vulnerabilities, which are flaws or weaknesses in code that can be exploited by attackers, pose significant risks to computing infrastructures across industry, government, and academia. Current research on vulnerability detection and remediation faces several key challenges, including keeping pace with rapidly evolving software, enabling data-driven methods (e.g., artificial intelligence-based techniques), and integrating various types of vulnerability-related metadata. To address these gaps, this planning project will lead to the construction of a robust, community-supported infrastructure and shared dataset that advance software vulnerability research, ultimately enhancing the security of diverse computing systems critical to national defense and prosperity. The project will also develop accessible security training resources for students and professionals. This project will plan an infrastructure featuring a continuous collection framework that captures scalable and multimodal data to facilitate high-impact software vulnerability research through a series of planning activities. First, the project team will conduct surveys and interviews with the security, software engineering, and human-computer interaction communities to understand researchers’ practical needs and how an infrastructure and dataset can reduce barriers in their work. Second, the project team will host workshops to gather feedback and share best practices on the initial infrastructure design. Third, the project team will conduct summative surveys and form a working group to assess, refine, and improve the design. By identifying community needs and priorities, the project will inform the infrastructure design that benefits and accelerates research on software vulnerability detection and remediation. Long-term collaboration with participants will also be fostered to support the establishment of the new infrastructure. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.