一句话：提出 EVerest 数据集，首次贯通需求、架构与代码并细粒度标注安全要素，支持端到端安全验证。
端到端安全验证需贯通需求、架构与代码，并要求细粒度安全标签，现有数据集缺乏这种组合。本文提出 EVerest 数据集，基于电动汽车充电桩开源软件栈 EVerest，包含 84 条人工提取的安全需求（带安全目标）、1,445 个细粒度安全要素（组件、实体、数据、数据流、状态等）、接受窗口、共指与架构追踪链接，以及架构模型、源代码和自然语言文档。它支持安全需求分类、命名实体识别、架构追踪链接及设计期/代码级安全验证。创建中发现了真实弱点 CWE-1295，已披露并修复，数据公开。
End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available https://zenodo.org/records/21157836. A short video is available at https://youtu.be/pnn1uqpomvQ.
@inproceedings{abs-2606-23197,
title = {The EVerest Dataset for Secure Software Engineering},
author = {Sophie Corallo and Debora Grupp and Dominik Fuchß and Jan Keim and Frederik Reiche and Tobias Hey and Anne Koziolek},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834614}
}