CS 6264: Information Security Lab—System and Network Defenses

Overview

This course will help students develop both in-depth knowledge and hands-on skills in a number of important cybersecurity areas, including software security, malware and threat analysis, end-point security, network security, web security, mobile security, and machine learning based security analytics. The lecture materials of each topic area are drawn from latest research papers and prototypes, and comprehensive projects are assigned to help students master each area. The main topics include:

1. Software security: we will study software vulnerabilities such as memory safety errors and protection mechanisms such as CFI, ASLR, and DEP. We will also study program analysis techniques such as symbolic execution and fuzzing for finding software vulnerabilities and generate exploits. A project can involve applying and extending program analysis tools to find exploitable bugs in programs and generate input that can trigger these bugs.
2. Malware analysis: we will study how to build a malware analysis environment that is both save and live. In particular, we will study how to analyze malware to find its triggering, or, dispatching behaviors, and configure a virtualized environment where that malware gets the input it needs so that it reveals its intended activities. We will also study threat analysis, in particular, how to obtain and share threat intelligence. A project can involve applying and extending a malware analysis system to examine the behaviors of a new malware family.
3. End-point security: we will study how to monitor computer activities through system call hooking and virtual machine introspection. We will also study forensic analysis using systemwide record-and-replay technologies. A project can involve using a record-and-replay system to identify the root cause, or, the entry point, of a long-running attack.
4. Network security, we will first review vulnerabilities of network protocols such as spoofing and standard prevention mechanisms such as TLS. We will then study network monitoring, including network intrusion detection and alert correlation. A project can involve extending an open-source intrusion detection system to detect stealthy network attacks.
5. Web security: we will first review browser security models such as same-origin policy and content-security policy. We will then study more advanced topics including how to provide fine-grained access control to third-party scripts, and the security vulnerabilities of WebView. A project can involve implementing a phishing attack using iframes/popups in WebView and then implementing a defense.
6. Mobile security: we will first review the iOS and Android security models. Then we will study Android malware and gray-ware, that is, those that leak user privacy. We will also discuss the attack ecosystem including rooting attacks and third-party app stores. A project can involve implementing an Android malware clustering algorithm that atomically classify Android malware and gray-ware.
7. Machine learning for security analytics: we will first study how machine learning algorithms, in particular, deep learning, can be used to automatically produce security models such as malware classifiers and intrusion detection rules. We will then study how the machine learning process can be subverted by attackers and how to improve the robustness of machine learning. A project can involve using and extending an evaluation system to generate evasion attacks against a machine learning based model and produce the more robust model.