Activity Stream

Recent Posts

group_project

Visible to the public Reasoning about Protocols with Human Participants

Submitted by jkatz on Thu, 04/10/2014 - 2:20pm

Existing protocol analysis are typically confined to the electronic messages exchanged among computer systems running at the endpoints. In this project we take a broader view in which a protocol additionally encompasses both physical technologies as well as human participants. Our goal is to develop techniques for analyzing and proving security of protocols involving all these entities, with open-audit, remote voting systems such as Remotegrity as our starting point.

group_project

Visible to the public Trust, Recommendation Systems, and Collaboration

Submitted by jkatz on Thu, 04/10/2014 - 2:17pm

Our goal is to develop a transormational framework for a science of trust, and its impact on local policies for collaboration, in networked multi-agent systems. The framework will take human bahavior into account from the start by treating humans as integrated components of these networks, interacting dynamically with other elements.

group_project

Visible to the public Trustworthy and Composable Software Systems with Contracts

Submitted by jkatz on Thu, 04/10/2014 - 2:05pm

Over the past decade, language-based security mechanisms--such as type systems, model checkers, symbolic executors, and other program analyses--have been successfully used to uncover or prevent many important (exploitable) software vulnerabilities, such as buffer overruns, side channels, unchecked inputs (leading to code injection), and race conditions, among others.

group_project

Visible to the public Understanding Developers' Reasoning about Privacy and Security

Submitted by jkatz on Thu, 04/10/2014 - 2:16pm

Cloud and mobile computing creates new platforms where applications developed by third-party vendors can access users' devices and computer users' private data. Examples include iPhone and Android apps, and cloud-based application marketplaces. This project is a synergistic effort combining social behavioral science and secure software systems design. The first thrust of the project seeks to understand users' privacy expectations for their private data, and how the privacy policies vary in different social contexts.

group_project

Visible to the public User-Centered Design for Security

Submitted by jkatz on Thu, 04/10/2014 - 2:14pm

Human choice and behavior are critical to the effectiveness of many security systems; unfortunately, security designers often take little consideration of user preferences, perceptions, abilities, and usability workflow. To address these challenges, we propose research on the user-centric design of security applications, and the development of new usable-security measurement techniques and metrics to inform the design and development of new cybersecurity applications.

group_project

Visible to the public Verification of Hyperproperties

Submitted by jkatz on Thu, 04/10/2014 - 1:59pm

Hyperproperties [Clarkson and Schneider 2010] can express security policies, such as secure information flow and service level agreements, which the standard kinds of trace properties used in program verification cannot.
Our objective is to develop verification methodologies for hyperproperties.
We intend to apply those methodologies to the construction of secure systems from components with known security properties, thereby addressing the problem of compositional security.

group_project

Visible to the public Does the Presence of Honest Users Affect Intruder Behavior?

Submitted by jkatz on Thu, 04/10/2014 - 2:12pm

More appropriate and efficient security solutions against system trespassing incidents can be developed once the attack threat is better understood. However, few empirical studies exist to assess the attack threat. Our proposed research applies "soft science" models (i.e. sociological psychological and criminological) in effort to better understand the threat of system trespassing.

group_project

Visible to the public Empirical Models for Vulnerabilities and Attacks

Submitted by jkatz on Thu, 04/10/2014 - 2:08pm

The security of deployed and actively used systems is a moving target, influenced by factors that are not captured in the existing security models and metrics. For example, estimating the number of vulnerabilities in source code does not account for the fact that cyber attackers never exploit some of the discovered vulnerabilities, in the presence of reduced attack surfaces and technologies that render exploits less likely to succeed. Conversely, old vulnerabilities continue to impact security in the wild because some users do not deploy the corresponding software patches.

group_project

Visible to the public Human Behavior and Cyber Vulnerabilities

Submitted by jkatz on Thu, 04/10/2014 - 2:10pm

Past studies have shown that vulnerabilities in software are often exploited for years after the existence of the vulnerability is disclosed. Our project will leverage Symantec's WINE data set to understand the rate at which vulnerabilities are patched and how the number of affected machines changes over time.

page

Visible to the public UMD SoS Lablet Homepage

Submitted by Anonymous on Thu, 02/20/2014 - 1:46pm

UMD'S SCIENCE OF SECURITY LABLET INITIATIVE

The UMD lablet leverages the resources of the Maryland Cybersecurity Center to bring together 15 University of Maryland faculty from five different departments across campus, in collaboration with 6 external faculty members from other universities, to focus on developing the scientific foundations for cybersecurity.