Intrusion detection

Industrial control systems differ significantly from standard, general-purpose computing environments, and they face quite different security challenges. With physical "air gaps" now the exception, our critical infrastructure has become vulnerable to a broad range of potential attackers. In this project we develop novel network monitoring approaches that can detect sophisticated semantic attacks: malicious actions that drive a process into an unsafe state without however exhibiting any obvious protocol-level red flags.

Modern critical infrastructure relies on successful interdependent function among many different types of networks. For example, the Internet depends on access to the power grid, which in turn depends on the power-grid communication network and the energy production network. For this reason, network science researchers have begun examining the robustness of critical infrastructure as a network of networks, or a multilayer network. Research in network anomaly detection systems has focused on single network structures (specifically, the Internet as a single network).

In phishing, an attacker tries to steal sensitive information, e.g., bank/credit card account numbers, login information, etc., from Internet users. The US society and economy are increasingly dependent on the Internet and the web, which is plagued by phishing. One popular phishing method is to create a site that mimics a good site and then attract users to it via email, which is by far the most popular medium to entice unsuspecting users to the phishing site.

Cybersecurity is one of the most strategically important areas in computer science, and also one of the most difficult disciplines to teach effectively. Historically, hands-on cyber security exercises helped students reinforce basic concepts, but most of them focused on user level attacks and defenses. Since OS kernels provide the foundations to the applications, any compromise to OS kernels will lead to an entirely untrusted computing. Therefore, it is imperative to teach students the practice of kernel level attacks and defenses.

Modern critical infrastructure relies on successful interdependent function among many different types of networks. For example, the Internet depends on access to the power grid, which in turn depends on the power-grid communication network and the energy production network. For this reason, network science researchers have begun examining the robustness of critical infrastructure as a network of networks, or a multilayer network. Research in network anomaly detection systems has focused on single network structures (specifically, the Internet as a single network).