This full research paper describes the analysis of common software vulnerabilities that are introduced by students enrolled in four-year computing and cybersecurity majors from two different higher education institutions in Georgia. As the demand for secure coding education continues to grow, pedagogical improvements need to be made in identifying key software vulnerabilities students commit during code development (from the first programming course to the exit senior design capstone) which in turn can be analyzed to inform the pedagogical interventions focused at preparing students with skill sets for writing secure code and entering the professional workforce. While code security is emphasized throughout the computing curriculum, this research is focused on training individuals to be aware of common vulnerabilities and tailoring programming concept knowledge that has been shown to have a positive effect on code security. Existing research has mainly focused on developing vulnerability analysis tools rather than collecting data (and subsequently analyzing) regarding the types of vulnerabilities produced by students at their institutions. In this paper, we analyzed student code across different courses and reported the types of vulnerabilities produced by students in their assignment submission code from two different higher education institutions across different levels of the four-year curriculum. The reported vulnerabilities are grouped by CWE-ID, which is a standard and common way to categorize and identify software vulnerabilities. The resulting CWE-IDs are then grouped per student submission and per semester (across curriculum levels) to discover the common types of software vulnerabilities committed across cross sections of students. Our results from the analysis of vulnerabilities (ranging from CS1 courses to capstone courses) are organized around the following research questions: 1) What are the most common software vulnerabilities produced by computing majors at different levels through the computing curriculum?; and 2) Do these vulnerabilities persist throughout their curriculum as they advance into higher-level courses? We report that students commonly make mistakes related to variable usage, null pointer checks, hard-coding sensitive information, and improperly validating input. Vulnerabilities such as CWE-489 (“ Active Debug Code”) and CWE-215 (“Insertion of Sensitive Information Into Debugging Code”) tend to persist across multiple course levels and may need to be focused in the computing curriculum. The number of vulnerabilities introduced in assignment code increases as course complexity increases. We also find that vulnerabilities produced by students have little overlap with what software vulnerability researchers commonly study, potentially leading to a mismatch in priority for secure coding topics. Our findings have implications for computer science and cybersecurity curriculum design and delivery.

This Research to Practice Full Paper presents the use of data collected by our Non-Intrusive Classroom Attention Tracking System (NiCATS) to evaluate student comprehension. Quantifying students' cognitive processes in classrooms in a non-intrusive way is challenging. By analyzing various aspects of the eye metrics against defined regions of interest (ROI), instructors can better understand students’ cognitive processes as they acquire new knowledge. Eye-tracking studies primarily define ROIs based on commonly used metrics (source code complexity, significant fixation durations, etc.). While helpful, these metrics, when used independently, do not accurately represent their comprehension patterns. This paper contributes an alternative, multilayered approach for calculating gaze metrics against automatically defined ROIs. The work utilizes the AI-based Non-Intrusive Classroom Attention Tracking System (NiCATS - developed by the researchers), collecting raw-gaze data in real-time as information is presented on a computer screen. This paper reports the results of a study in which undergraduate students in a CS programming course were asked to identify defects seeded in Java programs. Each JAVA program included its own unique sets of ROIS defined using two different granularities: lexer-based and line-based. The ROI sets were then used to calculate relevant eye metrics in the context of each ROI layout. The results of the eye metric analysis at specific ROIs w.r.t their code review task provide insights into the cognitive processes students undergo when trying to comprehend new material. Subdividing this region into lexer-based regions, we determined “content topics” students struggled with (e.g., using complex data types) in a specific area. This feedback is valuable to the instructor as it enables the ability to identify hard-to-comprehend content topics post-hoc and gives the ability to validate student learning in the classroom. While this experiment focused on students in introductory programming courses, we intend to conduct experiments in other learning settings where students are expected to read material on a computer screen or solve actual problems. To summarize, the analysis of these eye metrics using more fine-grained ROIs (lexer-based, line-based) as an extension of complexity-based ROIs provides instructors with deeper insights into the cognitive processes used by students when compared to the current state-of-the-art techniques.

This Research to Practice Full Paper presents our Non-intrusive Classroom Attention Tracking System (NiCATS) and discusses the data collected through it. Academic instructors and institutions desire the ability to accurately and autonomously measure students' attentiveness in the classroom. Generally, college departments use unreliable direct communication from students, observational sit-ins, and end-of-semester surveys to collect feedback regarding their courses. Each of these methods of collecting feedback is useful but does not provide automatic feedback regarding the pace and direction of lectures. It has been widely reported that attention levels during passive classroom lectures generally drop after about ten to thirty minutes and can be restored to normal levels with regular breaks, novel activities, mini-lectures, case studies, or videos. Tracking these “drops” in attention can be crucial for the accurate timing of these change-ups in activities. This allows for maximal attention and a greater amount of deeply learned material. Autonomously collected data can also be used either in real-time or post-hoc to alter the design and presentation of lectures. Keeping track of student attention is vital to having confidence in delivering material. Even if lectures do not break up presentation slides with attention-raising activities, they can still show more important information during periods of high attention and less important information during periods of low attention. This area of research has applications both in in-person classrooms and online learning environments. The long-term goals of this research can prove invaluable for large in-person classrooms or classrooms where students’ faces are obscured, such as behind computer monitors.

Teacher self-efficacy (SE) has been observed to be an 'important construct for Computer Science (CS) teachers' professional development because it can predict both teaching behaviors as well as student outcomes" [1]. The purpose of the present study was to investigate teacher CS SE during a two-year federally funded professional development (PD) and curriculum development project for middle school teachers incorporating game-design and the Unity development platform. The research question investigated is: How does teacher self-efficacy for teaching computer science via game design with the Unity game development platform change during a year-long PD program? Investigations of teacher SE for teaching CS have resulted in some surprising results. For example, it has been reported that - There were no differences in self-efficacy based on teachers' overall level of experience, despite previous findings that teacher self-efficacy is related to amount of experience" and "no differences in self-efficacy related to the teachers' own level of experience with CS" [2], thus further study of CS teacher SE is warranted. Participants in this study were six middle school teachers from four middle schools in the southeastern United States. They participated in a year-long PD program learning the Unity game development platform, elements of game design, and foundations of learner motivation. Guided reflective journaling was used to track the teachers' SE during the first year of the project. Teachers completed journal prompts at four intervals. Prompts consisted of questions like "How do you currently feel about your ability to facilitate student learning with Unity?" and "Are you confident that you can implement the materials the way the project team has planned for them to be implemented?" Prior to beginning the project participants expressed confidence in being able to facilitate student learning after participating in the planned professional development, but there was some uneasiness about learning and using Unity. From a SE perspective their responses make sense, as all of the participants are experienced teachers and should have confidence in their general ability to teach. However, since Unity is a new programming environment for all of the teachers, they did not have the prior experience necessary to have a high degree of confidence that they could successfully use it with their students.

This Innovative Practice Full-Paper presents a system for real-time accurate detection of classroom attentiveness using monitor-mounted webcams and eye trackers. Academic institutions and instructors cannot accurately assess the moment-to-moment attentiveness of students in classrooms where students' faces are obscured by computer monitors. This can cause the lectures of Computer Science, Information Technology, or other lab-based courses to be incorrectly paced, which leads to students having overall poorer grasps of the subject material. We present a system for accurate detection of classroom attentiveness using monitor-mounted webcams and eye trackers. To determine correlations for the attentiveness judging system, we compare an initial attentiveness score produced by trained labelers using an image of the student's face with a series of calculated eye metrics to determine a final attentiveness score. Because the student webcam images and eye coordinates are synchronously collected with the lecture, this final attentiveness score is used to provide post-hoc feedback to instructors on the status of their students via time-series graphs displayed on the instructor's computer monitor. The proposed system is invaluable for institutions seeking to improve student education, instructors striving to improve the flow of lectures, and students seeking a more accommodating learning environment. The primary source of innovation from this system comes from the correlation of extracted eye metrics with the face images labeled for attentiveness. Research exists about determining attentiveness using a convolutional neural network trained on face images and even determining attentiveness by correlating face-image-trained outputs, each of which we plan to incorporate to make our system real-time in the future. This novel research could prove helpful for the field of education.

Programming is a skill, often acquired through repeated practice and feedback. During traditional lectures, students not actively engaged in their own learning. It is imperative to pique students motivation and direct their focus on gaining the requisite knowledge. As the class size grows, instructors feedback is delayed that impacts student engagement and learning. Educational researchers have supported using web-based tools to help evaluate student work, provide timely feedback and increase the amount of time they spend improving their skills. Motivated by the previous work, our team has developed the SEP-CyLE (Software Engineering and Programming Cyber Learning Environment) - a cyber learning environment that contains digital learning content of software programming and testing concepts. SEP-CyLE incorporates collaborative learning, social networking and gamification-based learning engagement strategies (LESs) that has led to an improved motivation and understanding of programming concepts. This paper aims to assess the impact of different combinations of these LESs on student learning in the context of CS1 classrooms. We coordinated studies at two universities wherein different combination of LESs were utilized using SEP-CyLE in CS1 classrooms. We analyzed the impact of LESs on students' acquisition of programming concepts, their engagement and usage of SEP-CyLE. The pre and post test results indicated that the assorted LEs have shown a positive impact on student learning across all the institutions. The correlation results demonstrated that there is meaningful relationship between the LEs and the student performance.

SUMMARY Advances in communication devices and technologies are dramatically expanding our communication capabilities and enabling a wide range of multimedia communication applications. The current approach to develop communication‐intensive applications results in products that are fragmented, inflexible, and incapable of responding to changing end‐users' communication needs. These limitations have resulted in the need for a new development approach of building communication applications that are driven by end‐users and that support the dynamic nature of communication‐based collaboration. To address this need, the Communication Virtual Machine (CVM) technology has been developed to support rapid specification and automatic realization of user‐centric communication applications based on a domain‐specific modeling approach. The CVM technology consists of a domain‐specific modeling language (DSML), the Communication Modeling Language (CML), that is used to create communication models, and a semantic rich platform, the CVM, that realized the created communication models. In this paper, we report on our experiences of applying a systematic approach to engineering CML and the synthesis of CML models in CVM. Based on a feature model describing the taxonomy of the user‐centric communication domain in a network independent manner, we develop the meta‐model of CML and its different concrete syntaxes. We also present a behavioral specification (dynamic semantics) of CML that enables the dynamic synthesis of user‐centric communication models into an executable form called communication control script. We validated the CML semantics using Kermeta, a meta‐programming environment for engineering DSMLs, and evaluated the practicality of our approach using a CVM prototype and a set of experiments. Copyright © 2011 John Wiley & Sons, Ltd.