Model hacker behavior

CIO - Forget about patches. Researchers at the Florida Institute of Technology are looking for ways to fight hackers by modeling their methods, or "exploits." The research could eventually lead to new types of security tools capable of stopping attacks that hackers haven't even invented yet.
The effort is being led by James Whittaker, an associate professor and director of the school's Center for Software Engineering Research. Whittaker, a security author and member of Microsoft Corp.'s Trustworthy Computing Academic Advisory Board, says hackers have always had the upper hand--and always will--because they can dedicate all of their time to the task of breaking through security systems. "Microsoft, Sun, Cisco--they all have products to ship. They have a day job," Whittaker says. "Security is only one of the things that they're thinking of. These hackers, the only thing they do is sit around trying to break stuff."
To counteract the hackers' apparent advantage, Whittaker and his team are attempting to create detailed models of both the intent and the semantics of every possible hacker attack. The group has also created a computer language to describe these models. Ideally, Whittaker proposes, this information could be made public, giving software developers in both government and private industry a test bed for creating highly secure software. Security product makers--firewall manufacturers and the like--meanwhile, could build the models into their products as a means of identifying and defending against as-yet unknown assaults.
The group is currently modeling standard types of attacks, but Whittaker says the team will branch out and begin to include behavioral scientists who could help model the psychology of hackers to further refine the models.
The U.S. government seems to believe the work will pay off. Florida Tech recently received a $70,000 grant from the Air Force Research Laboratory to continue the research, and Whittaker says the group has already received more than $1 million in aid for the project.