The EVerest Dataset for Secure Software Engineering
The paper introduces the EVerest dataset, a unique multi-artifact resource comprising security requirements, architectural models, and source code from an electric vehicle charging stack, which enables end-to-end security verification research and facilitated the discovery and remediation of a real-world security vulnerability.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are building a high-tech electric vehicle charging station. To make sure it's safe from hackers, you need to check three different layers of your project:
- The Wish List: What the developers say they want (e.g., "It must be secure").
- The Blueprint: The architectural drawings showing how the parts connect.
- The Bricks: The actual computer code that makes the machine run.
The problem is, most research tools only look at one of these layers. They might have a list of wishes, or a pile of code, but they never have all three connected together. It's like trying to fix a leaky roof by only looking at the blueprints, without ever checking the actual shingles or the homeowner's complaint list.
The EVerest Dataset is a new, giant "all-in-one" toolkit created by researchers at the Karlsruhe Institute of Technology to fix this. It connects the Wish List, the Blueprint, and the Bricks for a real-world, open-source software project called EVerest (which controls EV chargers).
Here is how they built it, using a simple analogy:
1. Gathering the "Wish List" (Requirements)
First, the researchers needed to know what security rules the project actually needed.
- The Survey: They sent a questionnaire to the community of developers, asking, "What are the security goals?" (Like asking, "Do you want the door to be locked?"). This gave them a rough list of 67 ideas.
- The Interview: The rough list was too vague. So, they sat down with four expert developers for deep conversations. They took those rough ideas and refined them into specific instructions, like changing "Lock the door" to "The OCPP module must reject malformed input from the CSMS."
- The Result: They ended up with 84 precise security requirements.
2. Drawing the "Blueprint" (Architecture)
The EVerest project didn't have a formal architectural map; it just had code.
- The Translation: Three students, supervised by experts, looked at the source code and manually built a formal Palladio component model. Think of this as taking a pile of Lego bricks and drawing a detailed diagram showing exactly how every piece connects, what data flows between them, and how they talk to each other.
- The Result: A digital blueprint with 29 components and 144 detailed service descriptions.
3. Labeling the "Bricks" (Code & Elements)
Now, they needed to connect the dots between the Wish List and the Blueprint.
- The Tagging Game: Three people went through the 84 requirements and highlighted specific words. They tagged things like "components," "data," "states," and "data flows."
- The Trace: They drew digital lines (trace links) connecting a specific sentence in the requirement (e.g., "The payment provider must be secure") directly to the specific part of the blueprint and the code that handles the payment.
- The Result: They labeled 1,445 tiny security elements, creating a massive web of connections.
The Real-World Test
The best part of this dataset isn't just that it exists; it's that it actually found a real bug.
While building the dataset, the researchers noticed a mismatch. One of the requirements said, "Authentication tokens must not be stored in plain text." However, when they looked at the actual code (the "bricks"), they found a line where the code was storing tokens in plain text.
- The Fix: They reported this to the project maintainers. The developers confirmed it was a real weakness (known as CWE-1295) and fixed it immediately.
Why This Matters
Before this, researchers trying to build tools to automatically check software security had to guess how the requirements, design, and code related to each other because no dataset provided all three.
The EVerest dataset is like a complete, labeled training manual for AI and researchers. It allows them to practice:
- Teaching computers to understand security requirements.
- Automatically finding where a requirement is implemented in the code.
- Checking if the final software actually matches the original safety promises.
In short, the paper presents a unique, multi-layered resource that bridges the gap between what software should do, how it is designed, and how it is built, proving its value by catching a real security hole in the process.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.