Modern computers are largely opaque, capable of processing data but providing little visibility into the activities that lead to a particular result. This computing model has become increasingly untenable. It limits insight into the nature of cyber threats, making it harder to detect and defend against attack. This research has focused on addressing this challenge through the reliable capture and management of data provenance. Provenance-aware computing gathers and reports metadata that provides insight into the history of each object being processed on a system. The aim of this work has been to record high integrity provenance metadata that can be used to such ends as preventing insider threats, detecting system intrusions, and assuring the integrity and confidentiality of data.

Recent Papers:

The Internet of Things, alongside mobile devices, represent the most rapidly growing sectors of the computing landscape. While the proliferation of mobile phones, home automation devices, and Internet-connected critical infrastructure creates unprecedented opportunities for innovation, this also exposes novel attack surfaces that must be better understood in order to provide adequate protetions. The aim of our research in this space is two fold: first, to reason about the challenges of securing mobile and IoT devices; second, to identify ways in which smart devices can be leveraged to address the broader challenges of system security. Our recent achievements in this area include helping to protect the privacy of athletes that use fitness tracking devices, uncovering new vulnerabilities in voice-activated IoT devices, and introducing new methods of detecting misbehaving commercial drones.

Recent Papers:

An increasing proportion of the global economy is dependent on the security of network communications and infrastructures. Unfortunately, these security properties are violated with alarming frequency due to implementation errors or developer confusion, or because systems are made use of in unanticipated ways. This research seeks to better understanding this breakdown between theory and practice, and identify ways to restore correct functionality in vulnerable networked systems. To this end, our work has considered the security challenges surrounding Software Defined Networks (SDN), the ubiquitous TLS/HTTPS protocols, and legacy telecommunications infrastructure.

Recent Papers:

The Universal Serial Bus (USB), introduced in the 1990’s, has lived up to its name in becoming the world standard for connecting peripheral devices to computers. The newest iteration of USB, Type-C, is even the exclusive means of connecting to new Apple MacBooks and Google smartphones. Unfortunately, due to its popularity USB is also a popular target for attackers, who have incorporated USB devices into threats ranging from social engineering to signal injection. The goal of our research into space is to better understand the increasingly-complex threats posed by USB peripherals and to develop effective defenses against these attacks.

Recent Papers: