Intrusion detection

Engineering a secure IT system, in addition to technical skills, requires a particular mindset focused on using cybersecurity solutions effectively against sophisticated and stealthy cyber attacks. The traditional lecture-centric style of teaching has failed to deliver that mindset, which is the direct result of an over-emphasis on specific technical skills (with limited lifespan and insufficient technical depth), abstract rather than deeply technical examination of fundamental concepts, and an impatience in developing broader analytical skills.

Safeguarding sensitive user information stored in computer systems is a fast growing concern, especially as computers are universally used everywhere from national defense to mobile phones. Malicious hackers have found unscrupulous ways to steal sensitive information largely by exploiting the vulnerabilities in existing hardware and software. Among the many forms of information leakage, covert timing channels exfiltrate secrets from a trojan process with higher security credentials to a spy process with lesser credentials by exploiting the access timing of system resources.

This project develops a novel methodology for designing secure cyber and cyber-physical systems that can detect attackers and protect against malicious behavior after the system has been compromised.

Attacks on computer networks are an all too familiar event, leaving operators with little choice but to deploy a myriad of monitoring devices to ensure dependable and stable service on the networks they operate. However, as networks grow bigger and faster, staying ahead of the constant deluge of attack traffic is becoming increasingly difficult. A case in point is the attacks on enterprise name servers that interact with the Domain Name System (DNS). These name servers are critical infrastructure, busily translating human readable domain names to IP addresses.

The modernized electric grid, the Smart Grid, integrates two-way communication technologies across power generation, transmission and distribution, in order to deliver electricity efficiently, securely and cost-effectively. On the monitoring and control side, it employs real-time monitoring offered by a messaging-based advanced metering infrastructure (AMI), which ensures the grid's stability and reliability, as well as the efficient implementation of demand response schemes to mitigate bursts demand.