The security of deployed and actively used systems is a moving target, influenced by factors that are not captured in the existing security models and metrics. For example, estimating the number of vulnerabilities in source code does not account for the fact that cyber attackers never exploit some of the discovered vulnerabilities, in the presence of reduced attack surfaces and technologies that render exploits less likely to succeed. Conversely, old vulnerabilities continue to impact security in the wild because some users do not deploy the corresponding software patches. As such, we currently do not know how to assess the security of systems in active use. In this project, we will conduct empirical studies of security in the real world, seeking to understand the deployment-specific factors and the user behaviors that influence the security of systems in active use. We will employ a variety of data sources, including public vulnerability databases, malware analysis platforms and Symantec's Worldwide Intelligence Network Environment (WINE), which includes field data collected on 10+ million real hosts targeted by cyber attacks (rather than honeypots or small-scale lab settings).
Tudor Dumitras is an Assistant Professor in the Electrical & Computer Engineering Department at the University of Maryland, College Park. His research focuses on Big Data approaches to problems in system security and dependability. In his previous role at Symantec Research Labs he built the Worldwide Intelligence Network Environment (WINE) - a platform for experimenting with Big Data techniques. He received an Honorable Mention in the NSA competition for the Best Scientific Cybersecurity Paper of 2012. He also received the 2011 A. G. Jordan Award from the ECE Department at Carnegie Mellon University, the 2009 John Vlissides Award from ACM SIGPLAN, and the Best Paper Award at ASP-DAC'03. Tudor holds a Ph.D. degree from Carnegie Mellon University.
Empirical Models for Vulnerabilities and Attacks