CAREER: Towards Identifying and Eliminating Exploitable Software Bugs

职业：识别和消除可利用的软件错误

• 批准号: 0953751
• 负责人: David Brumley
• 金额: $ 52.15万
• 依托单位: Carnegie-Mellon University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-03-01 至 2016-02-29
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0953751&HistoricalAwards=false
• 关键词: CAREER; Towards; Identifying; Eliminating; Exploitable

Attackers only need to find a single exploitable bug in order toinstall malware, bots, and viruses on a vulnerable user's computer.Unfortunately, bugs are plentiful. For example, the Ubuntu Linuxdistribution bug management database currently lists over 58,000 openbugs. Thus, the question is not whether an attacker can find a bug,but which bugs an attacker can exploit.This research investigates novel techniques, approaches, andalgorithms for finding exploitable bugs. The ability to deteriminewhether a bug is exploitable or not will allow developers toprioritize bug reports so that the most security-critical bugs arefixed first. The techniques investigated will also help developersdistribute patches safely.

攻击者只需要找到一个可利用的漏洞，就可以在易受攻击的用户计算机上安装恶意软件、僵尸程序和病毒。 例如，Ubuntu Linux发行版错误管理数据库目前列出了超过58，000个openbug。 因此，问题不在于攻击者是否能找到漏洞，而在于攻击者能利用哪些漏洞。 确认bug是否可被利用的能力将允许开发人员优先考虑bug报告，以便首先修复最安全的bug。 所研究的技术也将帮助开发人员安全地分发补丁。