MMM-ACNS-12 Conference

Invited Speakers

Ben Livshits (Microsoft Research and University of Washington, USA)
Fabio Martinelli (Institute of Informatics and Telematics, National Research Council, Italy)
Angelos Stavrou (George Mason University, USA)
Bhavani Thuraisingham (University of Texas at Dallas, USA)

Titles and abstracts of talks, and short CV of invited speakers

Dr. Ben Livshits
(Microsoft Research and University of Washington, USA)

Title: Finding Malware on a Web Scale

Abstract:
Over the last several years, JavaScript malware has emerged as one of the most popular ways to deliver drive-by attacks to unsuspecting users through the browser. This talk covers recent Microsoft Research experiences with finding malware on the web. It highlights two tools: Nozzle and Zozzle. Nozzle is a runtime malware detector that focuses on finding heap spraying attacks. Zozzle is a mostly static detector that finds heap sprays and other types of JavaScript malware. Both are extremely precise: Nozzle false positive rate is close to one in a billion; Zozzle’s is about one in a million. Both are deployed by Bing and are used daily to find thousands of malicious web sites. This talk will focus on interesting interplay between static and runtime analysis and cover what it takes to migrate research ideas into real-world products.

Curriculum vitae:
Ben Livshits is a researcher at Microsoft Research in Redmond, WA and an affiliate professor at the University of Washington. Originally from St. Petersburg, Russia, he received a bachelor’s degree in Computer Science and Math from Cornell University in 1999, and his M.S. and Ph.D. in Computer Science from Stanford University in 2002 and 2006, respectively. Dr. Livshits’ research interests include application of sophisticated static and dynamic analysis techniques to finding errors in programs. Ben has published papers at PLDI, POPL, Oakland Security, Usenix Security, CCS, SOSP, ICSE, FSE, and many other venues. He is known for his work in software reliability and especially tools to improve software security, with a primary focus on approaches to finding buffer overruns in C programs and a variety of security vulnerabilities (cross-site scripting, SQL injections, etc.) in Web-based applications. He is the author of several dozen academic papers and patents. Lately he has been focusing on how Web 2.0 application and browser reliability, performance, and security can be improved through a combination of static and runtime techniques.

Dr. Fabio Martinelli
(Institute of Informatics and Telematics, National Research Council, Italy)

Title: On the Enforcement of Security Policies

Abstract:
The talk addresses several issues on the formal specification of enforcement mechanisms for security policies, that specify acceptable executions of programs. We show several approaches to define such enforcement mechanisms, from the seminal work on security automata, to quantitative mechanisms, spanning over several process algebra models. The talk present also some practical aspects connected with the enforcement of security policies.

Curriculum vitae:
Fabio Martinelli is a senior researcher of Institute of Informatics and Telematics (IIT) of the Italian National Research Council (CNR), where he leads the interdepartmental security project of the CNR. He is co-author of more than one hundred of papers on international journals and conference/workshop proceedings. His main research interests involve security and privacy in distributed and mobile systems and foundations of security and trust. He founded and chaired the WG on security and trust management (STM) of the European Research Consortium in Informatics and Mathematics (ERCIM) and he is the coordinator of the Network of Excellence NESSoS on Engineering Secure Future Internet Services.

Dr. Angelos Stavrou
(Mason University, USA)

Title: Exposing Security Risks for Commercial Mobile Devices

Abstract:
Recent advances in the hardware capabilities of mobile hand-held devices have fostered the development of open source operating systems and a wealth of applications for mobile phones and table devices. This new generation of smart devices, including iPhone and Google Android, are powerful enough to accomplish most of the user tasks previously requiring a personal computer.
In this talk, we will discuss the cyber threats that stem from these new smart device capabilities and the online application markets for mobile devices. These threats include malware, data exfiltration, exploitation through USB, and user and data tracking. We will present the ongoing GMU and NIST efforts to defend against or mitigate the impact of attacks against mobile devices. Our approaches involve analyzing the source code and binaries of mobile applications, hardening the Android Kernel, using Kernel-level network and data encryption, and controlling the communication mechanisms for synchronizing the user contents with computers and other phones. We will also explain the enhanced difficulties in dealing with these security issues when the end-goal is to deploy security-enhanced smart phones into military combat settings. The talk will conclude with a discussion of our current and future research directions and outcomes in.

Curriculum vitae:
Angelos Stavrou is Assistant Professor in the Computer Science Department and a member of the Center for Secure Information Systems at George Mason University, Fairfax, Virginia. He received his M.Sc. in Electrical Engineering, M.Phil. and Ph.D. (with distinction) in Computer Science all from Columbia University. He also holds an M.Sc. in theoretical Computer Science from University of Athens, and a B.Sc. in Physics with distinction from University of Patras, Greece. Dr Stavrou has published over 40 papers on large systems security survivability in major international journals and conferences. Dr. Stavrou’s research interests are Large Systems Security Survivability, Intrusion Detection Systems, Privacy and Anonymity, and Security for MANETs and Mobile Devices. His research is funded by several organizations including NSF, DARPA, ARO, DHS, AFOSR, IARPA, and NIST. Dr. Stavrou received the Computer Science Department Young Faculty Research Award in 2010.

Prof. Bhavani Thuraisingham
((University of Texas at Dallas, USA)

Title: Cloud-Centric Assured Information Sharing

Abstract:
Daniel Wolfe (formerly of the National Security Agency) defined assured information sharing (AIS) as one that «provides the ability to dynamically and securely share information at multiple classification levels among U.S., allied and coalition forces.» The DoD’s vision for AIS is to «deliver the power of information to ensure mission success through an agile enterprise with freedom of maneuverability across the information environment». More recently National Security Agency CIO Lonny Anderson has stated that the agency is focusing on a «cloud-centric» approach to information sharing with other agencies. To address the needs of the DoD, our project is developing technologies and tools for cloud-centric assured information sharing funded by the Air Force Office of Scientific Research (AFOSR).
We initially examined developments in grid and cloud computing and explored security issues. In particular, we explored secure virtualization, secure storage, secure data management and secure cloud monitoring. We also developed a secure cloud data manager that will be utilized as the engine for assured information sharing. We developed two types of cloud data managers, one based on semantic web data and the other based on relational data. Current frameworks do not scale for large RDF graphs and as a result do not address these challenges. Here, we developed a framework using Hadoop to store and retrieve large numbers of RDF triples by exploiting the cloud computing paradigm. We developed a scheme to store RDF data in a Hadoop Distributed File System. More than one Hadoop job may be needed to answer a query because a triple pattern in a query cannot take part in more than one join in a Hadoop job. To determine the jobs, we developed algorithms to generate a near optimal query plan based on a greedy approach to answer a SPARQL Protocol and RDF Query Language (SPARQL) query. We use Hadoop’s MapReduce framework to answer the queries. We implemented XACML-based policy management and integrated it with our query processing strategies. For secure query processing for relational data we utilized the HIVE framework. In addition to secure query processing, we also developed encrypted query processing on the Amazon cloud that interfaced to the Intelligence Community’s BlackBook system.
More recently we have developed strategies for secure storage and query processing in a hybrid cloud, In particular, we have developed algorithms for query processing wherein user’s local computing capability is exploited alongside public cloud services to deliver an efficient and secure data management solution. Hybrid clouds offer numerous advantages including ability to restrict data and processing being outsourced based on sensitivity/confidentiality of the data as well as control on the monetary expenses of using cloud services by exploiting local resources. Nonetheless, query processing in hybrid cloud introduces new challenges, namely, 1) data design: How to partition relations between the public and private components of the cloud? The solution must account for the sensitivity of attributes in a relation as well as the workload that will be executed; 2) data security: How to represent encrypted (sensitive) data that enables non-trivial query processing on the public cloud? and 3) query processing: How to execute queries over the distributed data with mixed representation (i.e., encrypted and plaintext) while minimizing processing and communication costs? This paper addresses these challenges and incorporates the respective solutions into an add-on tool for a Hadoop- and Hive-based cloud computing infrastructure.
We have also developed demonstration systems with our European partners: Kings College, University of London and the University of Insubria Italy who are funded by EOARD (The European Office of Aerospace Research and Development). The first demonstration illustrates how information may be shared in our cloud, based on policies specified in XACML. In the second demonstration we are implementing a semantic web-based policy engine and will show how multiple social networks may share information on our cloud based on semantic web-based policies. For both demonstrations, we will use the secure cloud data managers we have implemented.
We have also made progress on a number of research areas related to the cloud. These include (i) SPARQL/JENA-based inference controller for provenance data. This inference controller is being implemented on our Hadoop Cloud; (ii) Cloud-based Malware Detection for Evolving Data Streams where we have developed a scalable feature selection and extraction solution that leverages a cloud computing framework; and (iii) CloudMask: Together with Purdue University we have developed CloudMask, an approach that supports fine-grained attribute-based access control based on encryption while at the same time assuring the privacy of the identity attributes of the users accessing the data. Our future plans include secure virtualization using the XEN hypervisor to host our cloud data managers and demonstrate assured information sharing on this platform.

Curriculum vitae:
Dr. Bhavani Thuraisingham (aka Dr. Bhavani) is the Louis A. Beecherl, Jr. I Distinguished Professor in the Erik Jonsson School of Engineering and Computer Science at The University of Texas at Dallas (UTD) since September 2010. She joined UTD in October 2004 as a Professor of Computer Science and Director of the Cyber Security Research Center. She is an elected Fellow of five organizations: the IEEE (Institute for Electrical and Electronics Engineers, 2002), the AAAS (American Association for the Advancement of Science, 2003), the BCS (British Computer Society, 2005), SPDS (Society for Design and Process Science — a society that promotes transdisciplinary research — 2011) and the Society of Information Reuse and Integration (subcommittee of IEEE Systems, Man and Cybernetics Society). She is the recipient of numerous awards including (i) the IEEE Computer Society’s 1997 Technical Achievement Award for «outstanding and innovative contributions to secure data management», (ii) the 2010 Research Leadership Award for «Outstanding and Sustained Leadership Contributions to the Field of Intelligence and Security Informatics» presented jointly by the IEEE Intelligent and Transportation Systems Society Technical Committee on Intelligence and Security Informatics in Transportation Systems and the IEEE Systems, Man and Cybernetics Society Technical Committee on Homeland Security, (iii) the 2010 ACM SIGSAC (Association for Computing Machinery, Special Interest Group on Security, Audit and Control) Outstanding Contributions Award for «seminal research contributions and leadership in data and applications security for over 25 years» and (iv) the 2011 AFCEA (Armed Forces Communications and Electronics Association) Medal of Merit for Sustained Professional Excellence in Communications, Electronics, Intelligence and Information Systems and Service to the Association. She is a Distinguished Scientist of ACM, was an IEEE Distinguished Lecturer between 2002 and 2005, and was also featured by Silicon India magazine as one of the seven leading technology innovators of South Asian origin in the USA in 2002. She received the prestigious earned higher doctorate degree of Doctor of Engineering from the University of Bristol England for her thesis consisting of her published works on secure dependable data management in July 2011.
Prior to joining UTD, Dr. Bhavani was an IPA (Intergovernmental Personnel Act) at the National Science Foundation (NSF) in Arlington, VA, from the MITRE Corporation for three years. At NSF, she established the Data and Applications Security Program and co-founded the Cyber Trust theme and was involved in interagency activities in data mining for counter-terrorism. She worked at MITRE in Bedford, MA between January 1989 and September 2001, conducting research, development, technology transfer and project management activities in secure data and information management, real-time middleware and data management, and data mining. She also led a department of several staff working in information management. Prior to that she worked in the commercial industry for six years first at Control Data Corporation developing the CDCNET product and later at Honeywell Inc. on research development, and technology transfer. Her work has resulted in over 100 journal articles, over 200 refereed conference papers and workshops, and five US patents (two pending). She is the author of eleven books in data management, data mining and data security including one on data mining for counter-terrorism and another on Database and Applications Security and has edited twelve more. She has given over 90 keynote presentations at various technical conferences and has also given invited talks at the White House Office of Science and Technology Policy and at the United Nations on Data Mining for counter-terrorism. She serves (or has served) on editorial boards of leading research and industry journals including several IEEE and ACM Transactions.
Dr. Bhavani is the founding president of «Bhavani Security Consulting, LLC», a company providing services in consulting and training in Cyber Security and Information Technology. She is also the founder of «Knowledge and Security Analytics, LLC», a spin-off company from UTD developing tools in assured information sharing and «Evolving Malware Security, LLC» a second spinoff company from UTD developing malware detection tools.