CORE

group_project

Visible to the public SaTC: CORE: Large: Collaborative: Accountable Information Use: Privacy and Fairness in Decision-Making Systems

Increasingly, decisions and actions affecting people's lives are determined by automated systems processing personal data. Excitement about these systems has been accompanied by serious concerns about their opacity and the threats that they pose to privacy, fairness, and other values. Recognizing these concerns, the investigators seek to make real-world automated decision-making systems accountable for privacy and fairness by enabling them to detect and explain violations of these values. The technical work is informed by, and applied to, online advertising, healthcare, an

group_project

Visible to the public NSF SaTC-BSF: CORE: Small: The Utilitarian Implications of Privacy Protections

In recent years the extent of online tracking has come to light, leading to calls for stronger privacy-protecting regulation and technologies. Privacy advocates argue that the lack of privacy is harmful at individual and societal levels; others argue that privacy protections bring about less information sharing, which leads to a decrease in overall welfare (e.g., a decrease in the efficiency of markets).

group_project

Visible to the public SaTC: CORE: Medium: Collaborative: Scalable Dynamic Access Control for Untrusted Cloud Environments

When users store their data in the cloud, they take many privacy risks: Will the cloud storage provider allow others to see that data? If the user sets sharing rules for the data, will the cloud storage system follow those rules? Recent news stories of user data exfiltration from cloud storage systems show that users have reason for concern. Encrypting files before storing them in the cloud would provide strong protection, but this approach makes it very difficult for users to share data with others and to change their sharing policies.

group_project

Visible to the public SaTC: CORE: Medium: Collaborative: Taming Web Content Through Automated Reduction in Browser Functionality

Web-based applications executed via web browsers are ubiquitous in everyday life. They underlie our banking, communications, shopping, social networking, tax payments, insurance transactions, and health care interactions. Unfortunately, malicious actors can take advantage of vulnerabilities in web browsers to exploit the user's computer. The consequences of a web browser attack can be severe: web content can execute arbitrary code on the victim's machine.

group_project

Visible to the public SaTC: CORE: Small: Attack-Agnostic Defenses against Adversarial Inputs in Learning Systems

Deep learning technologies hold great promise to revolutionize the way people live and work. However, deep learning systems are inherently vulnerable to adversarial inputs, which are maliciously crafted samples to trigger deep neural networks to misbehave, leading to disastrous consequences in security-critical applications. The fundamental challenges of defending against such attacks stem from their adaptive and variable nature: adversarial inputs are tailored to target deep neural networks, while crafting strategies vary greatly with concrete attacks.

group_project

Visible to the public SaTC: CORE: Small: An Exploration of Schedule-Based Vulnerabilities In Real-Time Embedded Systems

Many safety-critical systems such as automobiles, aircraft, medical devices, and power plants are controlled by real-time, embedded systems. As such systems are interconnected via networks such as the Internet, they have become increasingly vulnerable to cyber attacks. This project is studying vulnerabilities of such systems, how attackers might avoid detection, and protection strategies.

group_project

Visible to the public SaTC: CORE: Medium: Large-Scale Characterization of DNS Abuse

The domain name system (DNS) is one of the most critical pieces of Internet infrastructure in use today. It underlies how we name nearly all Internet resources, such as "nsf.gov", and its correct operation is implicitly assumed both by end users and in the design of many important applications such as email and the World Wide Web. Unfortunately, DNS is also abused in a wide variety of ways to support criminal activities such as spam, phishing, fraud, and host compromise.

group_project

Visible to the public SaTC: CORE: Medium: Collaborative: Scalable Dynamic Access Control for Untrusted Cloud Environments

When users store their data in the cloud, they take many privacy risks: Will the cloud storage provider allow others to see that data? If the user sets sharing rules for the data, will the cloud storage system follow those rules? Recent news stories of user data exfiltration from cloud storage systems show that users have reason for concern. Encrypting files before storing them in the cloud would provide strong protection, but this approach makes it very difficult for users to share data with others and to change their sharing policies.

group_project

Visible to the public SaTC: CORE: Medium: Collaborative: Privacy Attacks and Defense Mechanisms in Online Social Networks

In online social networks, people and their connections often share personal information, such as demographics, interests, and opinions, and leave traces of their interaction with others and content in the network. Not everyone wants to share personal information; however, people's attributes are correlated with each other among themselves, with attributes of nearby people in the network, and between a person's accounts on different networks. These correlations create risks around inferring attributes people would rather keep private.

group_project

Visible to the public SaTC: CORE: Medium: Collaborative: Cryptographic Data Protection in Modern Systems

Continuing major breaches and security compromises of computer systems motivate a promising new approach to data protection: encrypt the data so that even if stolen, it will be useless to the attacker, yet reveal just enough information about the data so that commodity systems such as databases and Web servers can still operate on it. This is called property-revealing encryption (PRE), and has already found its way to academic and commercial products that protect sensitive data in cloud services.