Modeling and design of secure software systems

软件系统安全性差（易受入侵）可能会使这些系统的关键功能被未经授权的接管，从而导致从银行欺诈到恐怖活动等各种事件。由于后期修复安全漏洞往往更加耗时和昂贵，因此拥有更快的建模技术非常重要，这将有助于设计人员在设计周期的早期快速轻松地分析设计。所有设计都涉及权衡，如果我们只是针对安全属性进行优化，我们就有可能忽略其他重要属性，例如受安全解决方案影响的性能和可靠性。我提出的研究涉及开发建模技术和工具，这将有助于以统一的方式分析多个属性-性能，可靠性和安全性，并有助于更好地理解设计权衡。该提案的主要特点包括：（一）开发新的建模技术，用于软件系统安全性的概率验证，（二）集成模型，以分析性能，可靠性和安全性，（三）培训研究生在可靠和安全的软件工程。研究将采用随机模型来表示系统行为。

Poor security of software systems (in form of high vulnerability to intrusions) may allow unauthorized takeover of the critical functionalities of those systems, leading to events ranging from bank fraud to terrorist activities. Since late fixing of security flaws tends to be more time consuming and expensive, it is important to have faster modeling techniques that would assist designers to analyze designs quickly and easily, early in the design cycle. All designs involve tradeoffs and if we simply optimize for the security attribute, we stand the chance of ignoring other attributes of importance, for example performance and dependability, which are affected by security solutions. My proposed research is concerned with developing modeling techniques and tools that would help in analyzing multiple attributes - performance, dependability and security - in a unified way, and would aid in better understanding of design tradeoffs. Key features of this proposal include: (i) development of novel modeling techniques for probabilistic validation of security of software systems, (ii) integrated models to analyze performance, dependability and security, (iii) training of research students in the engineering of dependable and secure software. The research will employ stochastic models for representing system behavior.