Vulnerability Analysis and Threat Assessment/Avoidance

漏洞分析和威胁评估/规避

• 批准号: 0242840
• 负责人: Bharat Bhargava
• 金额: --
• 依托单位: Purdue University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-06-01 至 2009-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0242840&HistoricalAwards=false
• 关键词: Vulnerability; Analysis; Threat; Assessment; Avoidance

Existing vulnerabilities are a serious threat to computer systems and organizations. Research in security is needed to identify vulnerabilities in systems, evaluate the threat, and devise mechanisms that avoid them. Formalizing vulnerability, building quantitative models of threat, and experimental studies are needed to discover and evaluate solutions for dealing with threats to life and economy. This will result in algorithms, observations based on experiments, and infrastructure that can deal with expected and unexpected attacks in an adaptable and graceful manner. It will lead towards guidelines for building secure systems and databases. The research will build upon results in failure identification, fault-tolerance and reliability/safety. Vulnerabilities will be reduced by keeping an attacker uncertain and unaware about the latest version of databases/software and routing information that are in operation.This research will contribute to fundamental principles and policies for providing homeland security in information systems and applications in nuclear waste shipping, e-commerce, and disaster management. A better understanding of vulnerabilities in a variety of institutions such as schools, government agencies, air space and airports, and industrial plants will be explored. We will contribute to the outreach program of CERIAS security center at Purdue through preparation of education material and organizing workshops.

现有漏洞对计算机系统和组织构成严重威胁。需要对安全性进行研究，以识别系统中的漏洞，评估威胁，并设计避免它们的机制。需要将脆弱性形式化，建立威胁的量化模型，并进行实验研究，以发现和评估应对生命和经济威胁的解决方案。这将导致算法，基于实验的观察，以及可以以适应性和优雅的方式处理预期和意外攻击的基础设施。它将导致制定建立安全系统和数据库的准则。该研究将建立在故障识别，容错和可靠性/安全性的结果。通过保持攻击者不确定和不知道最新版本的数据库/软件和路由信息，在operation.This研究将有助于基本原则和政策，为提供国土安全的信息系统和应用程序在核废料运输，电子商务和灾害管理。将探讨如何更好地了解学校、政府机构、空域和机场以及工厂等各种机构的脆弱性。我们将通过准备教育材料和组织研讨会为普渡大学CERIAS安全中心的外展计划做出贡献。