Research Infrastructure

group_project

Visible to the public TWC: Medium: Collaborative: Data is Social: Exploiting Data Relationships to Detect Insider Attacks

Insider attacks present an extremely serious, pervasive and costly security problem under critical domains such as national defense and financial and banking sector. Accurate insider threat detection has proved to be a very challenging problem. This project explores detecting insider threats in a banking environment by analyzing database searches.

group_project

Visible to the public TWC: Medium: Collaborative: Black-Box Evaluation of Cryptographic Entropy at Scale

The ability to generate random numbers -- to flip coins -- is crucial for many computing tasks, from Monte Carlo simulation to secure communications. The theory of building such subsystems to generate random numbers is well understood, but the gap between theory and practice is surprisingly wide. As built today, these subsystems are opaque and fragile. Flaws in these subsystems can compromise the security of millions of Internet hosts.

group_project

Visible to the public TWC SBE: TTP Option: Medium: Collaborative: EPICA: Empowering People to Overcome Information Controls and Attacks

This project studies the security of representative personalized services, such as search engines, news aggregators, and on-line targeted advertising, and identifies vulnerabilities in service components that can be exploited by pollution attacks to deliver contents intended by attackers.

group_project

Visible to the public TWC: Small: Middleware for Certificate-Based Authentication

Every time someone uses a phone or computer to connect to an Internet site, software determines whether the connection is safe or being intercepted by attackers. Unfortunately, this software is error-prone, leaving users vulnerable to having their privacy violated or their personal information stolen due to phishing attacks, identity theft, and unauthorized inspection of their encrypted traffic. A number of solutions are being proposed, but the software is fragmented across many platforms and redundantly or incorrectly implemented.

group_project

Visible to the public SaTC: STARSS: Design of Secure and Anti-Counterfeit Integrated Circuits

Hardware security, whether for attack or defense, differs from software, network, and data security in that attackers may find ways to physically tamper with devices without leaving a trace, and mislead the user to believe that the hardware is authentic and trustworthy. Furthermore, the advent of new attack modes, illegal recycling, and hard-to-detect Trojans make hardware protection an increasingly challenging task. Design of secure hardware integrated circuits requires novel approaches for authentication that are ideally based on multiple layers of protection.

group_project

Visible to the public EAGER: Effective Detection of Vulnerabilities and Linguistic Stratification in Open Source Software

Software vulnerabilities are weaknesses in the code that may be exploited by cybercriminals to harm a system. They often do not hinder a program's functionality, and are thus difficult to detect. This project focuses on developing methods to identify such "weak spots" in a program, where vulnerabilities are more likely to occur.

group_project

Visible to the public GREPSEC II: Underrepresented Groups in Security Research

This proposal provides funding for the second GREPSEC: Underrepresented Groups in Security Research workshop, which will be affiliated with the annual IEEE Symposium on Research in Security & Privacy, in May 2015, in San Jose CA. The first event, held in May 2013, attracted 50 participants, two-thirds of them students, and almost all from underrepresented groups.

group_project

Visible to the public TWC: TTP Option: Small: Collaborative: Detecting and Characterizing Internet Traffic Interception Based on BGP Hijacking

Recent reports have highlighted incidents of massive Internet traffic interception executed by re-routing Border Gateway Protocol (BGP) paths across the globe (affecting banks, governments, entire network service providers, etc.). The potential impact of these attacks can range from massive eavesdropping to identity-spoofing or selective content modification. In addition, executing such attacks does not require access or proximity to the affected links and networks, posing increasing risks to national security.

group_project

Visible to the public CAREER: A Dual-VM Binary Code Reuse Based Framework for Automated Virtual Machine Introspection

Virtual Machine Monitors (VMMs) and hypervisors have become a foundational technology for system developers to achieve increased levels of security, reliability, and manageability for large-scale computing systems such as cloud computing. However, when developing software at the VMM layer, developers often need to interpret the very low level hardware layer state and reconstruct the semantic meanings of the guest operating system events due to the lack of operating system level abstractions.

group_project

Visible to the public TWC: Small: Collaborative: Toward Trusted Third-Party Microprocessor Cores: A Proof Carrying Code Approach

Third-party hardware Intellectual Property (IP), written as code in a Hardware Description Language (HDL), is extensively used in modern integrated circuits. Contemporary electronics typically include 75% of third party hardware IP and only 25% in-house design to provide customization or a profit-making edge. Such extensive use of third-party hardware IP in both commercial and military applications raises security and trustworthiness concerns, especially in today's globalized market.