Vulnerability Analysis and Threat Assessment/Avoidance

现有的漏洞是对计算机系统和组织的严重威胁。需要对安全性进行研究，以识别系统中的漏洞，评估威胁，并设计避免它们的机制。需要将脆弱性形式化，建立威胁的定量模型，并进行实验研究，以发现和评估应对生命和经济威胁的解决方案。这将导致算法、基于实验的观察和基础设施能够以适应性和优雅的方式处理预期和意外的攻击。它将导致建立安全系统和数据库的指导方针。这项研究将建立在故障识别、容错和可靠性/安全性的基础上。通过使攻击者不确定和不知道正在运行的数据库/软件的最新版本和路由信息，可以减少漏洞。本研究将有助于在核废料运输、电子商务和灾害管理的信息系统和应用中提供国土安全的基本原则和政策。将探索更好地了解学校、政府机构、空域和机场以及工业工厂等各种机构的脆弱性。我们将通过准备教育材料和组织研讨会，为普渡大学CERIAS安全中心的外展计划做出贡献。

Existing vulnerabilities are a serious threat to computer systems and organizations. Research in security is needed to identify vulnerabilities in systems, evaluate the threat, and devise mechanisms that avoid them. Formalizing vulnerability, building quantitative models of threat, and experimental studies are needed to discover and evaluate solutions for dealing with threats to life and economy. This will result in algorithms, observations based on experiments, and infrastructure that can deal with expected and unexpected attacks in an adaptable and graceful manner. It will lead towards guidelines for building secure systems and databases. The research will build upon results in failure identification, fault-tolerance and reliability/safety. Vulnerabilities will be reduced by keeping an attacker uncertain and unaware about the latest version of databases/software and routing information that are in operation.This research will contribute to fundamental principles and policies for providing homeland security in information systems and applications in nuclear waste shipping, e-commerce, and disaster management. A better understanding of vulnerabilities in a variety of institutions such as schools, government agencies, air space and airports, and industrial plants will be explored. We will contribute to the outreach program of CERIAS security center at Purdue through preparation of education material and organizing workshops.