ISSISP 2016

Courses

• Arun Lakhotia: "Binary analysis in Polymorphic Malware Detection"

Binary analysis in Polymorphic Malware Detection

×

Analysis of malware introduces new challenges that are not present when analyzing programs in the normal context. Besides the fact that the programs are in a binary form, they are explicitly created to defeat analysis by hiding behind undecidability. Nonetheless, I will show that program analysis methods can indeed be used to answer a variety of questions related to malware. For instance, by relaxing the requirements of safety one can use program analysis to provide semantics based “features” to a machine learner. Similarity analysis is a key tool for understanding and querying big-data of code, in particular in the context of malware analysis and mitigation. We will provide an end-to-end experience in analyzing malware binaries, extracting semantics features, and using those in a machine learner to find similar malware in a repository. We will use these hands-on exercises to also highlight opportunities and challenges for further research, and introduce you to the state-of-the-art technologies to get started.

Arun Lakhotia, University of Louisiana



I am a full time Professor in the department of Computer Science, University at Louisiana, Lafayette, USA. I earned my Ph.D. degree in C omputer Science from the Case Western Reserve University in 199 0. My research interests are malware analysis and autonomous vehicles.

• Bharat Jayaraman: "Formal Security"

Formal Security

×

Formal methods involve the use of formal specification languages and formal verification techniques with the goal of providing increased assurance/rigorous guarantee of the correctness of software or hardware systems. Formal specification involves the use of mathematical and logical formulae to state the properties of interest, while formal verification make use of theorem proving or model checking techniques to prove that the system satisfies the properties or to provide a counter-example. In the area of computer security, formal methods were first applied to show the correctness, or the lack thereof, for authentication protocols. Over the years, formal methods have been applied to specify and reason about security properties at the various levels: applications, programming languages, operating systems, networking, internet/web, and databases. This course will provide an overview of formal methods and illustrate their use through a variety of examples.

Bharat Jayaraman, University at Buffalo, USA

• Christian Collberg: "Software Protection"

Software Protection

×

Software protection is the branch of computer security that studies techniques for protecting secrets contained in computer programs from being discovered, modified, or redistributed. In this introductory lecture we will show how an adversary can study a program under their control (using disassemblers, decompilers, etc.) in order to extract proprietary information or modify the program, for example in order to bypass a license check. We will discuss important basic software protection algorithms for obfuscation, tamper-proofing, and software watermarking, as well as basic reverse engineering techniques for attacking such protections.

Christian Collberg, University of Arizona, USA



Christian Collberg is a Professor at the Department of Computer Science at the University of Arizona. He got his PhD from Lund University, Sweden and taught at University of Auckland, New Zealand, before joining Arizona. His current research interests lie in the protection of software from reverse engineering and tampering, as well as in the reproducibility of computer science research (see FindResearch.org). He is the author of "Surreptitious Software, Obfuscation, Watermarking, and Tamperproofing for Software Protection".

• KP Soman: "Applying Machine Learning for Cybersecurity Analytics"

Applying Machine Learning for Cybersecurity Analytics

×

Advancements in computing systems ranging from tiny embedded devices to more powerful data centers hosted in the cloud leading to the Internet of Things have gained increasing significance due to their real-time communication and decision making capabilities. These systems have been widely deployed in a multitude of application domains such as Smart home, Industrial Automation, Smart Healthcare, Automotive and transportation. Security is a significant concern due to the ubiquitous nature of these systems. The field of Machine learning has seen a phenomenal impact over the last decade due to the ability of large-scale systems to learn from petabytes of data for prediction and classification purposes. However, application of machine learning for cybersecurity has received little attention due to the decreased availability of datasets pertaining to malicious activities. This course aims to bridge the gap between machine learning and cybersecurity enthusiasts by applying machine learning for cybersecurity analytics. In particular, supervised and unsupervised learning based techniques will be examined and its applications to problems in cybersecurity will be discussed. This course is catered towards undergraduate/graduate students and professionals working in government organizations, companies and research laboratories.

KP Soman, Amrita University, Ettimadai

• Prabhaker Mateti: "Android Security"

Android Security

×

Smart phones have become the computing platform to help us lead our modern daily lives. Android devices are physically small devices but otherwise far better equipped with multiple networks, cameras, and sensors than typical desktop computers. That they make phone calls is incidental. That they are on the body of their owners is significant. It is in this context that we should understand the security and privacy issues raised by these devices. Current research focus is mostly on UI, location/ context based applications, and conservation of battery power, but the layers deep within the mobile platform that handle security and privacy are not as good as they can be. We survey the exploits of the last couple of years ranging from arbitrary code execution, Heartbleed to StageFright. In order to understand the technical details behind these, we must also understand not only the internals of the Android mobile OS, Java, Linux, and ARM CPU but also cloud computing and storage, and crowd sourcing. In a lab environment, we let the users experience some of the exploits. We present the details of rooting a device, reverse engineering the source code from its APK, and what it takes to design and build a custom ROM that can include proactive forensics.

Prabhaker Mateti, Wright State University, USA



I am an Associate Professor in the Department of Computer Science and Engineering at the Wright State University, Dayton, Ohio. I earned my Ph.D. degree in Computer Science from the University of Illinois at Urbana Champaign in 1976.

My research interests are Internet Security, Distributed Computing, Software Engineering, and Language Design. I designed a specification and design language called OM. I have directed several MS Theses and three Ph.D dissertations.

• Roberto Giacobazzi: "Semantics, analysis and code transformation"

Semantics, analysis and code transformation

×

In this course we will study systematic and automatic methods for code attack and reverse engineering. We will introduce static and dynamic program analysis as basic tools for understanding what programs do and for making reverse engineering. Most known attack methods based on control/data-flow analysis, profiling, tracing, emulation, disassembly and decompilation will be presented as suitable abstractions of an interpreter. Obfuscation and watermarking will be then discussed as methods for making these abstract interpreters incomplete when acting on the modified (obfuscated or watermaked) code, i.e. failing to extract hidden information. Systematic methods for making abstract interpreters incomplete will be discussed together with concrete examples and challenging future research directions. The result is a unifying and comprehensive view of SW protection strategies which provides both a theoretical bases for most of the known attack and defense methods and a perspective for the design of new algorithm for surreptitious software. The class will consists of lectures and hands-on exercises. Slides will be distributed to the course attendees.

Roberto Giacobazzi, Università degli Studi di Verona, Italy



Roberto Giacobazzi was born in 1964 in Modena, Italy. He received the Laurea degree in Computer Science in 1988 from the University of Pisa, and in 1993 he received the Ph.D. in Computer Science from the same university. From 1993 to 1995 he had a Post Doctoral Research position at Laboratoire d'Informatique (LIX), Ecole Polytechnique (Paris) in the equipe Cousot. From 1995 to 1998 he was (tenured) Assistant Professor in Computer Science at the University of Pisa. From 1998 to 2000 he was Associate Professor at the University of Verona. From May 2000 until now he is Full Professor in Computer Science at the University of Verona. The research interests of Roberto Giacobazzi include abstract interpretation, static program analysis, semantics of programming languages, program verification, abstract model-checking, program transformation and optimization, digital asset protection, code obfuscation, software watermarking and lattice theory.