Vulnerability Analysis: An Extended Abstract

> Davis. His research areas include computer and network security, > especially analysis of vulnerabilities, building tools to detect > vulnerabilities, and ameliorating or eliminating them. >Subject Category: Vulnerabilities and Attacks > > >Extended Abstract: > >The goal of our work is to develop a methodology for detecting pre viously >unknown vulnerabilities in systems. > >We begin by arguing that existing classification schemes are inade quate >because they either lump vulnerabilities together at a high level, or >fail to capture shared characteristics of vulnerabilities. For exa mple, >race conditions caused by file accesses and race conditions caused by >simultaneous signals can be classified identically using PA and RI SOS. >But the two are fundamentally different. Similarly, race conditio ns Page 1