Schedule and Reading List [CS 294 Advanced Topics in Computer Security]

• Jan 21: Introduction

Part I: Foundations and Perspectives

• Jan 28: General perspectives and attack research
  • Database Metatheory: Asking the Big Queries (Section 4, 5, 6)
  • You and Your Research
  • Other selected reading and assignment :
    • Lessons from the Sony CD DRM Episode
    • Lest We Remember: Cold Boot Attacks on Encryption Keys
    • Analysis of an electronic voting system
    • A Spotlight on Security and Privacy Risks with Future Household Robots: Attacks and Lessons
    • Security and Privacy for Implantable Medical Devices
    • Devices That Tell On You: Privacy Trends in Consumer Ubiquitous Computing
    • Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds
    • Secure Content Sniffing for Web Browsers or How to Stop Papers from Reviewing Themselves
    • Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications

• Feb 4: Risk analysis and economics of security (Guest Lecturer: Adam Barth)

  Reading and assignment:

  • Is Finding Security Holes a Good Idea?
  • Security decision-making among interdependent organizations
  • A Learning-based Approach to Reactive Security

• Feb 11: Measurement and evaluation in security (Guest Lecturer: Elie)

  Reading and assignment:

  • State-of-the-Art Automated Black-box Web Application Vulnerability Testing
  • Security Benchmarking using Partial Verification
  • Quantifying the Strength of Security Systems

  Optional Reading:

  • Secure Open Source Collaboration: An Empirical Study of Linus' Law

• Feb 18: Security policy

  Reading and assignment:

  • FIREMAN: a toolkit for FIREwall Modeling and ANalysis

• Feb 25: Information-flow security demystified (Guest lecturer: Stephen McCamant)

  Reading and assignment:

  • 1) Pointless Tainting? Evaluating the Practicality of Pointer Tainting

  Choose one of the following two papers:

  • 2a) Quantitative information flow as network flow capacity
  • 2b) Measuring Channel Capacity to Distinguish Undue Influence

  Choose one of the following two papers:

  • 3a) Making information flow explicit in HiStar
  • 3b) Information Flow Control for Standard OS Abstractions

• Mar 4: The Theory of (Black-Box) Reverse Engineering (Guest Lecturer: Domagoj Babic)

  Reading:

  • Inductive Inference, DFAs, and Computational Complexity - Read this paper first. Skip the entire section 4 and sections 5.2 - 5.4 (inclusive)
  • Learning Regular Sets from Queries and Counterexamples - Read the entire paper, after Inductive Inference
  • Automated Assumption Generation for Compositional Verification - Optional paper, shows a nice application of DFA inference in verification, read last

• Mar 11: Privacy (Guest Lecturer: Arvind Narayanan)

  Reading and assignment:

  • Differential Privacy (Dwork)
  • Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays (Homer et al.)

Part II: Research Area Case Studies

• Mar 18: Web Security (Guest Lecturer: Adam Barth)

  Reading and assignment:

  Read any two of the following papers:

  • The Emperor's New Security Indicators (Schechter, Dhamija, Ozment, and Fischer)
  • Protecting Browser State from Web Privacy Attacks (Jackson, Bortz, Boneh, and Mitchell)
  • Robust Defenses for Cross-Site Request Forgery (Barth, Jackson, and Mitchell)

• Mar 25: No class, spring break

• Apr 1: Security in Cloud Computing (Guest Lecturer: Richard Chow)

  Reading and assignment:

  • TrustVisor: Efficient TCB Reduction and Attestation. Jonathan M. McCune et al.
  • Bootstrapping Trust in Commodity Computers. Bryan Parno, Jonathan M. McCune, and Adrian Perrig.
  • Airavat: Security and Privacy for MapReduce
  • Controlling Data in the Cloud: Outsourcing Computation without Outsourcing Control. Richard Chow et al.
  • Above the Clouds: A Berkeley View of Cloud Computing. Michael Armbrust et al. (Optional)

• Apr 8: Machine learning, reputation, anomaly detection (Guest Lecturer: Robin Sommer)

  Reading and assignment:

  • Outside the Closed World: On Using Machine Learning For Network Intrusion Detection. Robin Sommer and Vern Paxson.

  Read any one of the following papers:

  • Anomaly Detection of Webbased Attacks. Christopher Kruegel and Giovanni Vigna.
  • Anomalous Payload-Based Network Intrusion Detection. Ke Wang and Salvatore J. Stolfo.
  • Identifying Suspicious URLs: An Application of Large-Scale Online Learning. Justin Ma et al.

• Apr 15: Security by Closing the Semantic Gap (Guest Lecturer: Mike Samuel)

  Reading:

  • (no reading this week)

Part III: Emerging Technologies

• Apr 22: Language Approach for Security (Guest lecturer: William Robertson)

  Reading:

  • Secure Web Applications via Automatic Partitioning. Stephen Chong et al.
  • Ur: Statically-Typed Metaprogramming with Type-Level Record Computation. Adam Chlipala. (Optional)
• Apr 29: Guest lecturer: Sebastien Taveau (PayPal)

• May 6: Project presentation