Division of Computer and Network Systems (CNS)

The near ubiquity of Internet access has put a wealth of information and ever-increasing opportunities for social interaction at the fingertips of users. Driving this revolution is the modern web browser, which has evolved from a relatively simple client application designed to display static data into a complex networked operating system tasked with managing many facets of a users online experience. Support for dynamic content, multimedia data, and third-party plug-ins has greatly enriched users experiences at the cost of increasing the complexity of the browser itself.

Layer-8 attacks (e.g., spam and phishing) are launched from a malicious service platform, e.g., botnet, which consists of a large number of infected machines (or bots). Such an attack platform relies on lower-layer network services to achieve efficiency, robustness, and stealth in communication and attack activities. These services include look-up (e.g., DNS), hosting (e.g., Web servers), and transport (e.g., BGP).

The main research goals and approaches of the CLEANSE project are:

The integrity of commodity operating system kernels is threatened by rootkits that modify key kernel data structures to achieve a variety of malicious goals. While rootkits have historically been known to affect control data in the kernel, recent work demonstrates rootkits that affect system security by modifying non-control data, such as linked lists used to manage bookkeeping information and metadata used for memory management. Existing techniques fail to detect such rootkits effectively.

While modern research in cryptography has transformed a significant portion of computer security from an art into a science, ultimately the security guarantees for all current cryptographic protocols (encryption, digital signatures, etc.) rely on conjectures, such as the intractability of factoring large integers is intractable or of finding collisions in certain "hash functions". The possibility that these conjectures are false (as was recently discovered for some popular hash functions) is a genuine threat to cybersecurity.

Cyber threats have escalated rapidly over the past decade. "Zero-day attacks" have become significant, delivered increasingly through seemingly innocuous means such as web pages, images, and documents. Malware is rampant, being installed surreptitiously on millions of computers around the world using a combination of spam, phishing, malicious shareware and freeware. Today's defenses use techniques such as signature-based scanning and file integrity monitoring to detect the presence of malware, and then remove them.