Vulnerabilities Analysis

CCR-0311723漏洞分析Matt Bishop该项目将开发和测试现有计算机系统和软件中安全漏洞的新分类方案。当系统满足某些条件时，漏洞就存在了，这些条件决定了漏洞的性质。分类方案将以这些条件为基础。本研究的目标是：（1）确定是否每个漏洞都有一个独特的，最小规模的一组这样的条件;（2）确定是否漏洞共享这些条件;（3）确定是否，对于一个足够大的漏洞集，条件的数量小于漏洞的数量。该方法将检查开放源代码系统和程序中的漏洞，并确定可以利用漏洞的确切条件。随着对利用漏洞所需条件的了解越来越多，这些条件的表达也将越来越精细。这项工作的意义在于，它将导致对系统中为什么会出现漏洞、如何检测漏洞以及如何预防漏洞的更深入的理解。其更广泛的影响是，如果假设是真的，否定系统上的条件可以界定当时未知的漏洞。供应商和安全分析师将能够使用我们将开发的方法来测试系统的漏洞，比目前的命中和失误的方法更容易。最后，这项工作将为开发和教授编写比现在更少漏洞的程序的方法提供更严格的基础。

CCR-0311723Vulnerabilities AnalysisMatt BishopThis project will develop and test a new classification schemefor security vulnerabilities in existing computer systems andsoftware. A vulnerability exists when a system meets certainconditions, the precise conditions dictating the nature of thevulnerability. The classification scheme will be based upon theseconditions. The goal of this research is to: (1) determinewhether every vulnerability has a unique, minimally-sized setof such conditions; (2) determine whether vulnerabilities sharethese conditions; and (3) determine whether, for a large enoughset of vulnerabilities, the number of conditions is less thanthe number of vulnerabilities. The methodology will be toexamine vulnerabilities in open source systems and programs, anddetermine the exact conditions under which a vulnerabilitycan be exploited. The expression of the conditions will be refinediteratively, as more is learned about the conditions needed toexploit vulnerabilities.The significance of this work is that it will lead to a deeperunderstanding of why vulnerabilities occur in systems, how todetect them, and how to prevent them. Its broader impact is that,if the hypotheses are true, negating conditions on a system couldeliminate vulnerabilities not known at the time. Vendors andsecurity analysts would be able to use the approach we will developto test systems for vulnerabilities more readily than the current,hit-and-miss methods. Finally, this work would provide amore rigorous basis for developing and teaching methods ofwriting programs with fewer vulnerabilities than occur now.