The EVerest Dataset for Secure Software Engineering

Abstract

Context and Problem. End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. Method and Aim. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. Results and Conclusion. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available under the Apache License 2.0. Video. We provide a screencast of the EVerest dataset here.

The Dataset

The EVerest dataset spans all artifacts needed for end-to-end security verification, derived from EVerest, an industry-driven open-source software stack for electric vehicle charging stations hosted by LF Energy:

• Security Requirements — 84 requirements, elicited from the EVerest community via questionnaire and refined to the architectural level in developer interviews. They are annotated with security objectives (confidentiality, integrity, availability, and authentication) and 1,445 fine-grained security elements — components, entities, data, states, nodes, connections, data flows, activities, and control flows — including acceptance windows, references, and coreferences.
• Software Architecture Model — a Palladio component model of the EVerest core with 29 components, 34 interfaces, and 144 service effect specifications, plus an assembly model, a deployment scenario, and a usage model covering 14 scenarios. Requirement-to-architecture trace links connect the annotated security elements to model element IDs.
• Source Code — the EVerest source code snapshot the model was derived from (commit 177a8e6, 3rd June 2024): roughly 50 kloc across more than 500 files in C++, C, JavaScript, Python, and Rust.
• Natural Language Documentation — the user-facing EVerest project documentation, including the architecture excerpts used to broaden the dataset's applicability, together with the labeling guidelines, element definitions, and examples.
• A Real Security Weakness — during dataset creation, a concrete security weakness was identified in EVerest using xDECAF. Requirement 5 stipulates that "[…] tokens used for authentication should not be stored in plain text in log files or persistent storage […]", which the source code of the dataset snapshot violates (line 13 of auth_token_providerImpl.cpp in the PN532TokenProvider module). The weakness (CWE-1295) was disclosed to PIONIX GmbH and remedied shortly thereafter, confirming the dataset's real-world relevance.

Together, these artifacts support research on security requirements classification, named entity recognition, architectural trace linking, and design-time as well as code-level security verification within a single resource.

Screencast

@inproceedings{corallo_everest_2026,
  title        = {The EVerest Dataset for Secure Software Engineering},
  author       = {Corallo, Sophie and Grupp, Debora and Fuch{\ss}, Dominik and Keim, Jan and Reiche, Frederik and Hey, Tobias and Koziolek, Anne},
  booktitle    = {2026 41st IEEE/ACM International Conference on Automated Software Engineering (ASE)},
  eventdate    = {2026-10-12/2026-10-16},
  eventtitle   = {41st IEEE/ACM International Conference on Automated Software Engineering},
  eventtitleaddon = {ASE 2026},
  language     = {english},
  address      = {New York, NY, USA},
  publisher    = {Association for Computing Machinery},
  month        = {10},
  venue        = {Munich, Germany},
  year         = {2026},
  doi          = {10.1145/3832783.3834614}
}