Vulnerability Analysis and Threat Assessment/Avoidance

现有的漏洞对计算机系统和组织构成严重威胁。需要进行安全研究来识别系统中的漏洞、评估威胁并设计避免这些漏洞的机制。需要形式化脆弱性、建立威胁定量模型以及实验研究来发现和评估应对生命和经济威胁的解决方案。这将导致算法、基于实验的观察以及基础设施能够以适应性和优雅的方式处理预期和意外的攻击。它将引导制定构建安全系统和数据库的指南。该研究将建立在故障识别、容错和可靠性/安全性方面的成果的基础上。通过让攻击者不确定和不了解正在运行的最新版本的数据库/软件和路由信息，可以减少漏洞。这项研究将为核废料运输、电子商务和灾害管理等信息系统和应用程序中提供国土安全的基本原则和政策做出贡献。将探索更好地了解学校、政府机构、空域和机场以及工厂等各种机构的脆弱性。我们将通过准备教育材料和组织研讨会，为普渡大学 CERIAS 安全中心的外展计划做出贡献。

Existing vulnerabilities are a serious threat to computer systems and organizations. Research in security is needed to identify vulnerabilities in systems, evaluate the threat, and devise mechanisms that avoid them. Formalizing vulnerability, building quantitative models of threat, and experimental studies are needed to discover and evaluate solutions for dealing with threats to life and economy. This will result in algorithms, observations based on experiments, and infrastructure that can deal with expected and unexpected attacks in an adaptable and graceful manner. It will lead towards guidelines for building secure systems and databases. The research will build upon results in failure identification, fault-tolerance and reliability/safety. Vulnerabilities will be reduced by keeping an attacker uncertain and unaware about the latest version of databases/software and routing information that are in operation.This research will contribute to fundamental principles and policies for providing homeland security in information systems and applications in nuclear waste shipping, e-commerce, and disaster management. A better understanding of vulnerabilities in a variety of institutions such as schools, government agencies, air space and airports, and industrial plants will be explored. We will contribute to the outreach program of CERIAS security center at Purdue through preparation of education material and organizing workshops.