CIS 890, Spring 2007

Research Topics in Security

Course Goals

Computer and information security is having an ever-increasing impact on people's day-to-day life. However, the current cyber warfare is highly tilted towards the attackers' advantage. It is extremely difficult to secure a large complex system. And an attacker only needs to get lucky once. Significant improvement is needed in today's state of the art for cyber defense technologies. In this course we will study several of the most pressing security problems nowadays, and try to find solutions to those open problems. The course is research-oriented and students are expected to work on challenging problems in the area of computer and information security. A great deal of the course is devoted to understanding security issues in real-life computer applications, with the expectation that good solutions be identified and developed. The goal of the course is to equip students with knowledge and techniques useful for addressing complex security problems they will find in the real world.

Course Schedule

Week 0: Introduction Slides.
Week 1: John Homer's presentation on MulVAL Slides.
Week 2: Research topics Slides1. Slides2.
Risks of the Passport Single Signon Protocol.
The PwdHash project.
Week 3: Foundational Proof-Carrying Code.
Matt Miller's presentation on OS X's KeyChain. Slides.
Week 4: Hardware malfunction and security. Slides.
Supplemental reading: Using Memory Errors to Attack a Virtual Machine.
Week 5:
A Systematic Approach to Uncover GUI Logic Flaws for Web Security.
A Black-Box Tracing Technique to Identify Causes of Least-Privilege Incompatibilities Slides.
Week 6: Recent works on web scripting vulnerability checking. Slides.
The Pixy tool.
Static Detection of Security Vulnerabilities in Scripting Languages.
Week 7: no classes.
Week 8: Secure Sensor Network Routing: A Clean-Slate Approach Slides.
Week 9: Discussion on attack graphs.
A scalable approach to attack graph generation.
Practical Attack Graph Generation for Network Defense.
Week 10: spring break.
Week 11: IDS alerts correlation. Slides.
Building Evidence Graphs for Network Forensics Analysis.
Week 12: IDS alerts correlation. Slides.
Alert Correlation in a Cooperative Intrusion Detection Framework.
Week 13: no class
Week 14: Research discussion on attack graphs.

Instructor and course meeting times

Instructor: Xinming (Simon) Ou.
Meeting time and place: Monday 3:30-5:10 and Friday 3:30-4:20 in Nichols 127
Office hours: by appointment

Prerequisites

CIS798: Computer and Information Security, or instructor permission.

Contact

Questions can be emailed to xou (put some stuff here) ksu (a little dot) edu.