Proteus
January 2016 – September 2018
Collaborators: Andrew Gearhart
The ability of attackers to reuse exploits across instances of an application represents a significant offensive advantage. With this capability, attackers can develop exploits in their own labs that have a high probability of success upon remote targets. This advantage exists in situations where code is duplicated across systems, including enterprise IT systems, mobile devices, and the Internet at large. Software diversity represents a paradigm shift in information system design: it breaks the assumption of a homogenous software population in an attempt to eliminate attacker reuse of exploits. Diversity may also protect against zero-day exploits, unlike traditional patching, which provides remediation only after their discovery.
Despite its potential, very little existing research attempts to validate and measure the security benefits of software diversity. Proteus combines theoretical and empirical investigation and is performing novel research into a game-changing technology with the potential to eliminate an attacker’s ability to reuse exploits and capitalize upon zero-day vulnerabilities. This research aims to fundamentally disrupt the back and forth “arms race” of cyber security and lay the groundwork for a rigorous and provable understanding of a system’s resistance to many classes of cyber attacks.
Relational Keyword Search
June 2009–May 2012
Advisor: Alfred C. Weaver
The amount of information in the world is increasing exponentially. Keyword search has proven to be an effective method to discover and retrieval information online as evidenced by the success of Internet search engines. Unfortunately, many common information management systems do not support the familiar keyword search interface that people now expect. Web sites, corporations, and government agencies all use relational databases to manage information, but keyword search in relational databases is difficult due to data transformations that eliminate redundancy and ensure consistency. Relational keyword search enables users to retrieve information and to explore the relationships among that information all via a familiar interface.
Although a decade has passed since keyword search in databases became a hot topic for academic researchers, little progress has been made in the interim. In particular, no systems have appeared outside the academic community despite a long-standing promise to revolutionize the way people interact with information. Our research addresses the challenges inherent in transitioning relational keyword search techniques from the computer science community to practical systems that can be deployed against existing data repositories.
Secure e-Commerce
January 2009–August 2011
Advisor: Alfred C. Weaver
Successful e-commerce depends upon many elements, not the least of which is well-trained computer scientists to design, maintain, repair, and innovate e-commerce technology. Experience points in the direction of a significant need for expanded education focused on the security of e-commerce systems. This need is consistent with a broader trend in computing: security has been identified as a grand challenge in the field and the weakest link of many of the nation’s most critical applications and services. This project focuses on developing teaching materials and techniques specifically related to security in e-commrce.
SPARTA
May 2005–February 2007
Advisor: Professor Christopher Healy
Embedded systems, especially those in safety-critical or hard real-time environments, typically require that timing constraints be met. To guarantee these systems will meet deadlines, the worst-case execution time (WCET) of each program must be known. The process of determining the WCET of a program is known as timing analysis. Knowledge of the WCET can be used to dynamically scale voltage when a scheduler detects future slack time. This facilitates power savings, an especially important aspect in embedded systems. Image processing provides another useful application for parametric timing analysis, since image dimensions may not be known a priori.
Static timing analysis has traditionally required loops to contain a constant number of iterations so analyzers may produce constant worst case execution bounds. Such constraints on input programs make this form of timing analysis numerical: the number of loop iterations is constant as is the final result from the timing analyzer. Static parametric timing analysis (SPARTA) allows the number of loop iterations to be unknown at compilation as long as this value may be written as an expression. Such flexibility expands the class of programs which may be analyzed. Instead of providing a constant upper bound for a loop, a symbolic formula is created using the expression representing the number of loop iterations. The formula may be evaluated later to obtain the execution time for any given input.