CERIAS Weekly Security Seminar - Purdue University

Several newly emerged wireless technologies (e.g., Internet-of-Things)---extensively backed by the tech industry---are being widely adopted and have resulted in a proliferation of diverse smart appliances and gadgets (e.g., smart thermostat, wearables, smartphones), which has ensuingly shaped our modern digital life. These technologies utilize several communication protocols that usually have stri...

Using the Internet is a risky venture: cybercriminals could be lurking behind any email or in any web page, just waiting to compromise your machine. Practicing and researching cybersecurity is about minimizing that risk. Unfortunately, modern cybercriminals don't compromise machines just because they can - they do it to make money or steal data. Likewise, the risks that end users care about aren't...

Recent concerns about government surveillance have focused attention on secure communication tools for the masses. The security properties of these tools receive more attention than their usability properties. This talk will cover our recent effort to design a usable secure webmail system. We have conducted a number of studies to analyze existing tools and our own systems to determine whether thes...

Private information retrieval (PIR) is a way for clients to query a remote database without the database holder learning the clients' query terms or the responses they generate. Compelling applications for PIR abound in the cryptographic and privacy research literature, yet existing PIR techniques are notoriously inefficient. Consequently, no such PIR-based application to date has seen real-world...

Traditional approaches to securing systems tend to be fixed and mostly non adaptive. The Policy that defines the security posture is in some sense "hardcoded". In this talk, we focus on approaches to securing systems using approaches that have declarative policies that factor in dynamically evolving context. The approach is grounded in W3C standard representation formats for knowledge and formal l...

User authentication and identity management are the first-gate defense and access protection for cyber systems. Authentication failures, including post-authentication attacks, have caused constant system breaches and resulted in serious economic and social consequences to governments, enterprises, and individuals. Passwords or smartcards have issues related to true identity, loss/theft, interopera...

Which song will Smith listen to next? Which restaurant will Alice go to tomorrow? Which product will John click next? These applications have in common the prediction of user trajectories that are in a constant state of flux but subject to hidden constraints (e.g. geographical location, the links of a website). What users are doing now may be unrelated to what they will be doing in an hour from no...

The Indiana Information Sharing and Analysis Center (IN-ISAC) is an entity developed by the State of Indiana and key partners to mitigate cybersecurity risks for the State of Indiana. The IN-ISAC will accomplish this through sharing threat information and collaborating with the public, private industry, local government and other governmental agencies. About the speaker: Nick Sturgeon is the Manag...

Modern Cryptography provides algorithmic solutions to securely compute over the private data of mutually distrustful parties. These solutions require algorithmic or physical building blocks such as computational hardness assumptions, trusted hardware, correlated private randomness and noisy channels. A fundamental limitation of these solutions is that their security necessarily hinges on the assum...

Technological advances and novel applications, such as sensors, cyber-physical systems, smart mobile devices, cloud systems, data analytics, and social networks, are making possible to capture, and to quickly process and analyze huge amounts of data from which to extract information critical for security-related tasks. In the area of cyber security, such tasks include user authentication, access c...

The computer science community has had a growing research focus in Privacy over the last decade. Much of this has really focused on confidentiality: Anonymization, computing on encrypted data, access control policy, etc. This talk will look at a variety of research results in this area, including "weaker" approaches than the absolutes typically considered in the security community, and how they al...

Threat-driven security is a systematic system-level approach that is driven by a clear understanding of the security need – it is not arbitrary application of security technologies based on their perceived effectiveness or hype. Using this systematic approach, the strength of a protection is easily gauged through simple identification of the weakest link in the design. This presentation will revie...

Making conflicting statements to others, or equivocation, is a simple yet remarkably powerful tool of malicious participants in distributed systems of all kinds. In distributed computing protocols, equivocation leads to Byzantine faults and fairness issues. In this talk, I will cover my recent work towards preventing or penalizing equivocations in decentralized Systems. In the first half of the ta...

Females are significantly less likely to pursue tech-focused careers, and have significantly lower self-efficacy in technical domains. Despite initiatives to increase female participation in STEM majors, the percentage of females pursuing college degrees in computer and information science actually decreased between 2004 and 2012 in the United States. Towards the ultimate goal of increasing female...

In many envisioned drone-based applications, drones will communicate with many different smart objects, such as sensors and embedded devices. Securing such communications requires an effective and efficient encryption key establishment protocol. However, the design of such a protocol must take into account constrained resources of smart objects and the mobility of drones. In this paper, a secure c...

Is it possible for Alice to compute a result and for Bob to be convinced of its correctness without having to reexecute the computation? What if the computation is performed over sensitive data that Bob is not allowed to see due to privacy concerns? Recent work on proof-based verifiable computation has brought these goals much closer to practicality. In this talk, I will present two implemented sy...

Secure multiparty computation (MPC) and differential privacy are two notions of privacy that deal respectively with how and what functions can be privately computed. In this talk, I will first give an overview of MPC and differential privacy. Then, I will show how to build a two party differentially private secure protocol in the presence of semi-honest and malicious adversaries. Computing a diffe...

This presentation is a detailed case study of the Authur Pendragon cyberthreat that occurred at The University of Alabama on September 21, 2014.The Authur Pendragon threat instigated mass fear, social mediahyperactivity, and rumor mongering, all of which reached beyond TheUniversity of Alabama campus. A timeline of the event, which includessocial media posts, official University responses, and mas...

Privacy has been a hot issue since early 2000s, in particular with the rise of social network and data outsourcing. Data privacy is a big concern in data outsourcing because it involves sharing personal data with third parties. In this talk, I will give an introduction to data privacy on topics such as privacy standards, data anonymization techniques, and data anonymization usage in data outsourci...

Private record linkage protocols allow multiple parties to exchange matching records, which refer to the same entities or have similar values, while keeping the non-matching ones secret. Conventional protocols are based on computationally expensive cryptographic primitives and therefore do not scale. To address these scalability issues, hybrid protocols have been recently proposed that combine dif...

Mobile malware is a growing menace, even though many Cybersecurity practitioners don't fully grasp the situation. This presentation will address the Five W's of mobile malware, namely: Who is developing it? Who is being affected by it? What exactly is it? When does it get dropped on mobile devices and when does it execute on mobile devices? Where are botnet operations that harvest mobile devices m...

While designing computer systems and their underlying protocols, architects impose functionality, security, and privacy requirements or policies with which the designed systems and protocols should comply with. These requirements and policies are generally written in natural language and more often than not they are not complied with in the implementations due to ambiguity, misinterpretation of th...

Currently cyberinfrastructures are facing increasinglystealthy attacks that implant malicious payloads under thecover of benign programs. Existing attack detection approachesbased on statistical learning methods may generate misleadingdecision boundaries when processing noisy data with such amixture of benign and malicious behaviors. On the other hand,attack detection based on formal program analy...

Low signal-to-noise data processing algorithms forimproved detection, tracking, discrimination and situationalthreat assessment are a key research challenge. As sensortechnologies progress, the number of pixels will increase significantly. This will result in increased resolution, which couldimprove object discrimination, but unfortunately, will also resultin a significant increase in the number o...

In cyber-attack analysis, it is often highly desirable to understand the meaning of an unknown file or network message in the absence of their consumer (i.e. the program that parses and understands the file/message). For example, a malware may stealthily collect information from a victim machine, store them as a file and later send it to a remote server. P2C is a novel technique that can parse and...