Abstract:Software security remains a critical concern, particularly as junior developers, often lacking comprehensive knowledge of security practices, contribute to codebases. While there are tools to help developers proactively write secure code, their actual effectiveness in helping developers fix their vulnerable code remains largely unmeasured. Moreover, these approaches typically focus on classifying and localizing vulnerabilities without highlighting the specific code segments that are the root cause of the issues, a crucial aspect for developers seeking to fix their vulnerable code. To address these challenges, we conducted a comprehensive study evaluating the efficacy of existing methods in helping junior developers secure their code. Our findings across five types of security vulnerabilities revealed that current tools enabled developers to secure only 36.2\% of vulnerable code. Questionnaire results from these participants further indicated that not knowing the code that was the root cause of the vulnerability was one of their primary challenges in repairing the vulnerable code. Informed by these insights, we developed an automated vulnerability root cause (RC) toolkit called T5-RCGCN, that combines T5 language model embeddings with a graph convolutional network (GCN) for vulnerability classification and localization. Additionally, we integrated DeepLiftSHAP to identify the code segments that were the root cause of the vulnerability. We tested T5-RCGCN with 56 junior developers across three datasets, showing a 28.9\% improvement in code security compared to previous methods. Developers using the tool also gained a deeper understanding of vulnerability root causes, resulting in a 17.0\% improvement in their ability to secure code independently. These results demonstrate the tool's potential for both immediate security enhancement and long-term developer skill growth.

Embedding Secure Coding Instruction into the IDE: A Field Study in an Advanced CS Course.

Interactive support for secure programming education.

Supporting secure programming in web applications through interactive static analysis.

XSS for the Masses: Integrating Security in a Web Programming Course using a Security Scanner

Effective Learning of Cybersecurity Concepts with Model-Eliciting Activities

Is Secure Coding Education in the Industry Needed? An Investigation Through a Large Scale Survey

Design of Secure Coding Challenges for Cybersecurity Education in the Industry

Embedded EthiCS: Integrating Ethics Broadly Across Computer Science Education

"I Don't Know Too Much About It": On the Security Mindsets of Computer Science Students

Gamifying Software Security Education and Training Via Secure Coding Duels in Code Hunt

Integration and Evaluation of Spiral Theory based Cybersecurity Modules into core Computer Science and Engineering Courses

Raising Secure Coding Awareness for Software Developers in the Industry

Secure Coding Practices in Java: Challenges and Vulnerabilities

"This Applies to the RealWorld": Student Perspectives on Integrating Ethics into a Computer Science Assignment

Developing Hands-on Labs for Source Code Vulnerability Detection with AI

Insights from the Field: Exploring Students' Perspectives on Bad Unit Testing Practices

Towards an Insightful Computer Security Seminar

Visual Studio Code in Introductory Computer Science Course: An Experience Report

Causative Insights into Open Source Software Security using Large Language Code Embeddings and Semantic Vulnerability Graph

Unintentional Security Flaws in Code: Automated Defense via Root Cause Analysis

Understanding Coding Behaviors in Intermediate CS Students