Human interaction is an integral part of any system. Users have daily interactions with a system and make many decisions that affect the overall state of security. The fallibility of users has been shown but there is little research focused on the fundamental principles to optimize the usability of security mechanisms. We plan to develop a framework to design, develop and evaluate user interaction in a security context. We will (a) examine current security mechanisms and develop basic principles which can influence security interface design; (b) introduce new paradigms for security interfaces that utilize those principles; (c) design new human-centric security mechanisms for several problem areas to illustrate the paradigms; and (d) conduct repeatable human subject experiments to evaluate and refine the principles and paradigms developed in this research.

TEAM

PIs: Ting Yu, Ninghui Li (Purdue), Robert Proctor (Purdue)
Student: Zach Jorgensen

In this project, we aim to systematize the knowledge base about existing mobile malware (especially on Android) and quantify their threats so that we can develop principled solutions to provably determine their presence or absence in existing marketplaces. The hypothesis is that there exist certain fundamental commonalities among existing mobile malware. Accordingly, we propose a mobile malware genome project called MalGenome with a large collection of mobile malware samples.  Based on the collection, we can then precisely systematize their fundamental commonalities (in terms of violated security properties and behaviors) and quantify their possible threats on mobile devices.  After that, we can develop principled solutions to scalably and accurately determine their presence in existing marketplaces. Moreover, to predict or uncover unknown (or zero-day) malware, we can also leverage the systematized knowledge base to generate an empirical prediction model. This model can also be rigorously and thoroughly evaluated for its repeatability and accuracy.

TEAM

PI: Xuxian Jiang
Student: Yajin Zhou

Fault elimination part of software security engineering hinges on pro-active detection of potential vulnerabilities during software development stages. This project is currently working on a) an attack operational profile definition based on known software vulnerability classifications, and b) assessment of software testing strategies based on two assumptions a) funding and time constraint are a practical limit on the quality of security engineering (how to assess and leverage that), and b) how to automatically generate test cases that would be as efficient as human non-operational testing of software.

TEAM

PIs: Mladen Vouk, Laurie Williams, Jeffrey Carver
Student: Patrick Morrison

This project involves the application of argumentation techniques for reasoning about policies, and security decisions in particular. Specifically, we are producing a security-enhanced argumentation framework that (a) provides not only inferences to draw but also actions to take; (b) considers multiparty argumentation; (c) measures the mass of evidence on both attacking and supporting arguments in order to derive a defensible conclusion with confidence; and (d) develops suitable critical questions as the basis for argumentation. The end result would be a tool that helps system administrators and other stakeholders capture and reason about their rationales as a way of ensuring that they make sound decisions regarding policies.

TEAM

PIs: Munindar P. Singh, Simon D. Parsons (CUNU)
Student: Nirav Ajmeri

We are studying how to harness human visual perception in information display, with a specific focus on ways to combine layers of data in a common, well-understood display framework. Our visualization techniques are designed to present data in ways that are efficient and effective, allowing an analyst to explore large amounts of data rapidly and accurately.

TEAM

PI: Christopher G. Healey
Student: Terry Rogers

TEAM

PI: Ting Yu
Students: Xi Gong, Entong Shen

This project aims to discover general theory to explain what cues security experts use to decide when to apply security requirements and how to present those cues in the form of security patterns to novice designers in a way that yields improved security designs.

TEAM

PIs: Travis Breaux (CMU), Laurie Williams, & Jianwei Niu (CMU)
Student: Maria Riaz

Software security metrics are commonly considered as one critical component of science of security. We propose to investigate existing metrics and new security metrics to predict which code locations are likely to contain vulnerabilities. In particular, we will investigate security metrics to take into account of comprehensive factors such as software internal attributes, developers who develop the software, attackers who attack the software, and users who use the software. The project also investigates metrics to evaluate firewall security objectively.  The developed metrics including risk, usability and cost are used to automate the creation of security architecture and configurations.

TEAM

PIs: Tao Xie, Laurie Williams, & Ehab S. Al-Shaer (UNC-Charlotte)
Students: Jason King, Rahul Pandita, & Mahamed Alsaleh

Phishing has become a serious threat in the past several years, and combating it is increasingly important. Why do certain people get phished and others do not? In this project, we aim to identify the factors that cause people to be susceptible and resistant to phishing attacks. In doing so, we aim to deploy adaptive anti-phishing measures.

The objective of this project is to design empirical privacy metrics that are independent of existing privacy models to naturally reflect the privacy offered by anonymization. We propose to model privacy attacks as an inference process and develop an inference framework over anonymized data (independent of specific privacy objects and techniques for data anonymization) where machine-learning techniques can be integrated to implement various attacks. The privacy metrics is then defined as the accuracy of the inference of individuals’ sensitive attributes. Data utility is modeled as a data aggregation process and thus can be measured in terms of accuracy of aggregate query answering. Our hypothesis is that, given the above empirical privacy and utility metrics, differential privacy based anonymization techniques offers a better privacy/utility tradeoff, when appropriate parameters are set. In particular, it is possible to improve utility greatly while imposing limited impact on privacy.

TEAM

PIs: Chris Mayhorn & Emerson Murphy-Hill
Students: Kyung Wha Hong & Chris Kelly

This project investigates the hard problem of resilient architectures from the standpoint of enabling new potential for incorporating privilege separation into computing systems. However, privilege separation alone is insufficient to achieve strong security guarantees. It must also include a security policy for separated components without impacting the functional requirements of the system. The general hypothesis of this project is that, legacy computing systems contain emergent properties that allow automatic software partitioning for privilege separation capable of supporting practical least privilege security policies.

Team

PIs: William Enck & Xiaohui (Helen) Gu
Students: Adwait Nadkami, Tsun-Hsuan (Anson) Ho, Ashwin Shashidharan