CAREER

Data-driven technology is having an impressive impact on society but privacy concerns restrict the way data can be used and released. Differential privacy has emerged as a leading notion supporting efficient and accurate data analyses that respect privacy. But designing and implementing efficient differentially private data analyses with high utility can be challenging and error prone. Even privacy experts have released code with bugs or designed incorrect algorithms.

Code injection vulnerabilities are a class of security vulnerabilities that have been exploited increasingly often, including in the high-profile 2017 Equifax breach as well as in many recent attacks on our country's election and financial systems. These vulnerabilities are very tricky to detect, and there are no existing automated techniques to protect critical software from being released with these dangerous flaws. This project is developing new and transformative approaches for detecting code injection vulnerabilities in complex, large-scale systems.

Hardware security, specifically the protection of integrated circuit intellectual property (IP), has gained importance as adversaries have the financial and experiential means to reverse engineer and replicate competitors' IP. Significant research effort has been devoted to protecting digital circuits, but the protection of analog circuits from an adversary has largely been ignored. The focus of this work is to explore techniques to enhance the security of analog circuits from attacks such as reverse engineering and cloning, both of which can lead to IP theft.

Prior research notes that many cyberattacks are preventable if end users take precautionary measures, such as keeping systems updated, but they often fail to do so. This proposal builds upon theories of risk communication, emotional intelligence, and self-determination to design new approaches to cybersecurity risk communication and training. The goals are to enable users to assess risks, costs, and benefits consistently and correctly, to promote task-focused coping responses, and to facilitate their internalization of values, promoting spontaneous diffusion of cybersecurity knowledge.

Traditionally, the main goal of cryptography has been to secure data in transit over an insecure channel, by providing the digital analogue of a "lock box" that can only be unlocked by the intended recipient but whose contents cannot be observed or manipulated by anyone else. In recent years, new technologies and applications such as the rise of cloud computing are forcing us to fundamentally change our perspective.