Machine Learning and Security

Research Statement

Automatically detecting and extracting patterns in various signals, such as network traffic, users' actions in social networks, can provide great insight and important solutions to problems in security. How can we automatically detect and extract meaningful patterns in the sea of irregular signals for detecting various attacks? How can we do so in the presence of intelligent attackers performing evasion attacks to fool any automatic learner? What are the fundamental limits in this domain? This project aims to explore answers to these questions.

Overview

Machine Learning for IP Address Reputation.
- Tracking Dynamic Sources of Malicious Activity at Internet-Scale
  Shobha Venkataraman, Avrim Blum, Dawn Song, Subhabrata Sen and Oliver Spatscheck. In Proceedings of Neural Information Processing Systems (NIPS) 2009, December 2009.
  
  Exploiting Network Structure for Proactive Spam Mitigation.
  Shobha Venkataraman, Subhabrata Sen, Oliver Spatscheck, Patrick Haffner, and Dawn Song. In Proceedings of USENIX Security Symposium, Aug 2007.
Machine Learning for Worm Signature Generation.
- Limits of Learning-based Signature Generation with Adversaries.
  Shobha Venkataraman, Avrim Blum, Dawn Song. In Proceedings of NDSS, Feb 2008.
  
  Thwarting Signature Learning by Training Maliciously.
  James Newsome, Brad Karp, and Dawn Song. In Proceedings of the 9th International Symposium On Recent Advances In Intrusion Detection (RAID 2006), September 2006.
  
  Polygraph: Automatic Signature Generation for Polymorphic Worms
  James Newsome, Brad Karp, Dawn Song. In IEEE Security and Privacy Symposium, May 2005.
Machine Learning for Fingerprint Generation.
- FiG: Automatic Fingerprint Generation.
  Juan Caballero,Shobha Venkataraman, Pongsin Poosankam, Min Gyung Kang, Dawn Song and Avrim Blum. In Proceedings of NDSS, Feb 2007.
Machine Learning for Network Anomaly Detection.
- Black-box Anomaly Detection---Is it Utopian?
  Shobha Venkataraman, Juan Caballero, Dawn Song, Avrim Blum, Jennifer Yates. In Proceedings of HotNets, Nov 2006.
Machine Learning for Stepping Stone Detection.
- Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds
  Avrim Blum, Dawn Song, and Shobha Venkataraman. In Conference of Recent Advance in Intrusion Detection (RAID) 2004.
Machine Learning for Timing Attacks.
- Timing Analysis of Keystrokes and SSH Timing Attacks
  D. Song, D. Wagner, and X. Tian. In 10th USENIX Security Symposium, 2001.