Preventing Hacking Through Predictive Technology

Forget about patches. Researchers at the Florida Institute of Technology are looking for ways to fight hackers by modeling their methods, or "exploits." The research could eventually lead to new types of security tools capable of stopping attacks that hackers haven’t even invented yet.

The effort is being led by James Whittaker, an associate professor and director of the school’s Center for Software Engineering Research. Whittaker, a security author and member of Microsoft’s Trustworthy Computing Academic Advisory Board, says hackers have always had the upper hand?and always will?because they can dedicate all of their time to the task of breaking through security systems. "Microsoft, Sun, Cisco?they all have products to ship. They have a day job," Whittaker says. "Security is only one of the things that they’re thinking of. These hackers, the only thing they do is sit around trying to break stuff."

To counteract the hackers’ apparent advantage, Whittaker and his team are attempting to create detailed models of both the intent and the semantics of every possible hacker attack. The group has also created a computer language to describe these models. Ideally, Whittaker proposes, this information could be made public, giving software developers in both government and private industry a test bed for creating highly secure software. Security product makers?firewall manufacturers and the like?meanwhile, could build the models into their products as a means of identifying and defending against as-yet unknown assaults.

The group is currently modeling standard types of attacks, but Whittaker says the team will branch out and begin to include behavioral scientists who could help model the psychology of hackers to further refine the models. The U.S. government seems to believe the work will pay off. Florida Tech recently received a $70,000 grant from the Air Force Research Laboratory to continue the research, and Whittaker says the group has already received more than a million dollars in aid for the project.

To comment on this article and other CIO content, visit us on Facebook, LinkedIn or Twitter.
Related:
Download the CIO October 2016 Digital Magazine
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.