CAP6135: Malware and Software Vulnerability Analysis
(Spring 2012)

Home                      Schedule notes                        Assignment

Class 1 (01/09):  Course introduction,   Software security introduction
Class 2 (01/11):  Software security intro (continue); Basic network security introduction
Class 3 (01/18):  basic network security (continue)
                        after class reading materials: "Smashing The Stack For Fun And Profit", Alpha One
                                                  "Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade," Crispin Cowan, et al.
Class 4 (01/23):  Term project description (written notes)
Class 5 (01/25): Stack Overflow I: Attack Introduction
Class 6 (01/30):  Stack Overflow example using GDB, Project 1 is assigned and due Feb. 14th via Webcourse; Possible Term Project Topics (PDF)
Class 7 (02/01):  Stack overflow(continue); Stack Overflow II: Defense   (written notes)
Class 8 (02/06):  Stack overflow defense (continue); Find Software Bugs
Class 9 (02/08):  Find software bugs (continue); Introduce instructor's ACSAC'07 best student award paper on fuzzing
Class 10 (02/13):  ACSAC'07 paper continue; Example of term project topics
Class 11 (02/15):  Program Verification & Other Types of Vulnerabilities
Class 12 (02/20): Explanation of Programming project 1; Email spam; (homework 1 is assigned and due Feb. 27th late night; term project proposal presentation slides should submitted at late night Feb. 28th
Class 13 (02/22): Email spam (continue)
Class 14 (02/27): Email spam (continue, written notes)
Class 15 (02/29): Term project proposal presentation
Class 16 (03/12): example and introduction on programming project 2; project 2 is assigned and due by 3AM 04/03 (i.e., late night on 04/02)
Class 17 (03/14): Virus; Paper presentation and summary
Class 18 (03/19): Virus (continue); worms
Class 19 (03/21): Yazan Jadaa "Detecting Spammers on Social Networks"
                             Roberto Alberdeston "Privacy-preserving p2p data sharing with oneswarm" 
Class 20 (03/26):  Melvin Rodriguez presents "HomeAlone: Co-Residency Detection in the Cloud via Side-Channel Analysis"
                              Yuyan Bao: "Automated Whitebox Fuzz Testing"
Class 21 (03/28):   Jungyao Zhang: "An Analysis of Social Network-Based Sybil Defenses"
                              Libert Pichardo: "Vanish: Increasing Data Privacy with Self-Destructing Data"
Class 22 (04/02):  Mike Sekletar: "Countering Kernel Rootkits with Lightweight Hook Protection"
                             Christopher Hodges: "TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphone"
Class 23 (04/04):  Kecong Tang: "CryptDB: Protecting Confidentiality with Encrypted Query Processing"
                              Xinruo Zhang: "Click Trajectories: End-to-End Analysis of the Spam Value Chain"
Class 24 (04/09):  Ramya Pradhan: "Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds"
                             Worms (continue); Botnets
Class 25 (04/11):  Gavin Grant: "The Socialbot Network: When Bots Socialize for Fame and Money"
                             Richard Landry: "TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection"
Class 26 (04/16): Kyle Martin: "Spamming Botnet: Signatures and Characteristics"
                            Cheng Wei: "All Your iFRAMEs Point to Us."
Class 27 (04/18): Ahmad Alzahrani: "Dude, where’s that IP? Circumventing measurement-based IP geolocation"
                             Charles Tymms: "Protecting Browsers from Extension Vulnerabilities"
Class 28 (04/23):  face-to-face session students final project presentation
Final exam time (04/25 10:00am-12:50pm): face-to-face session students final project presentation (continue)
Research papers for in-class presentation:

1.   (Yuyan Bao) "Automated Whitebox Fuzz Testing", P. Godefroid, M.Y. Levin, D. Molnar, Annual Network & Distributed System Security Symposium (NDSS) 2008.
2.  (Christopher Hodges) "TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphone", William Enck, Peter Gilbert, Byung-gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth, USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2010.
3.  (Junyao Zhang) "An Analysis of Social Network-Based Sybil Defenses", Bimal Viswanath, Ansley Post, Krishna P. Gummadi, Alan Mislove, SIGCOMM 2010.
4.  (Kyle Martin) "Spamming Botnet: Signatures and Characteristics". Yinglian Xie, Fang Yu, Kannan Achan, Rina Panigrahy, Geoff Hulten, and Ivan Osipkov. SIGCOMM, 2008.
5. (Cheng Wei) "All Your iFRAMEs Point to Us." Niels Provos and Panayiotis Mavrommatis, Moheeb Abu Rajab, Fabian Monrose. 17th USENIX Security Symposium, San Jose, CA, 2008.
6. (Charles Tymms) "Protecting Browsers from Extension Vulnerabilities", Adam Barth, Adrienne Porter Felt, Prateek Saxena, and Aaron Boodman. 17th Network and Distributed System Security Symposium (NDSS), 2010.
7.  "Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers", IEEE Symposium on Security and Privacy (Oakland'09), Oakland, CA, May 2009.
8. (Ramya Pradhan) "Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds", Thomas Ristenpart, Eran Tromer, Hovav Shacham, and Stefan Savage, Proceedings of the ACM Conference on Computer and Communications Security, Chicago, IL, November 2009.
9.  (Gavin Grant)  "The Socialbot Network: When Bots Socialize for Fame and Money", Yazan Boshmaf, Ildar Muslukhov, Konstantin Beznosov, Matei Ripeanu, ACSAC 2011 (Best paper award).
10.  "HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity," Zhi Wang, Xuxian Jiang, Proceedings of the 31st IEEE Symposium on Security and Privacy (Oakland 2010), Oakland, CA, May 2010.
11.  (Mike Sekletar) "Countering Kernel Rootkits with Lightweight Hook Protection," Zhi Wang, Xuxian Jiang, Weidong Cui, Peng Ning, Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS 2009), Chicago, IL, November 2009.
12.  "VEX: Vetting Browser Extensions for Security Vulnerabilities", Sruthi Bandhakavi, Samuel T. King, P. Madhusudan, and Marianne Winslett, USENIX Security Symposium (Usenix), 2010 (best paper award).
13.  (Libert Tapia) "Vanish: Increasing Data Privacy with Self-Destructing Data", Roxana Geambasu, Tadayoshi Kohno, Amit A. Levy, and Henry M. Levy, USENIX Security Symposium (Usenix), 2009 (best student paper award).
14.  (Ricky Landry) "TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection", Tielei Wang, Tao Wei, Guofei Gu, Wei Zou, 31st IEEE Symposium on Security & Privacy (Oakland), Oakland, CA, May 2010. (Best Student Paper Award).
15.  (Yazan Jadaa) "Detecting Spammers on Social Networks", Gianluca Stringhini, Christopher Kruegel, Giovanni Vigna, Annual Computer Security Applications Conference (ACSAC), 2010. (Best student paper award).
16.  (Roberto Alberdeston) "Privacy-preserving p2p data sharing with oneswarm", Tomas Isdal ,  Michael Piatek ,  Arvind Krishnamurthy ,  Thomas Anderson, ACM Sigcomm, 2010.
17.  (Ahmad Alzahrani) "Dude, where’s that IP? Circumventing measurement-based IP geolocation", Phillipa Gill, Yashar Ganjali, David Lie, Bernard Wong. Proceedings of the 19th USENIX Symposium on Security, 2010.
18.  (Kecong Tang) "CryptDB: Protecting Confidentiality with Encrypted Query Processing", Raluca Ada Popa, Catherine M. S. Redfield, Nickolai Zeldovich, Hari Balakrishnan, 23rd ACM Symposium on Operating Systems Principles (SOSP), 2011.
19.  (Melvin Rodriguez) "HomeAlone: Co-Residency Detection in the Cloud via Side-Channel Analysis", Yinqian Zhang, Ari Juels, Alina Oprea, Michael K. Reite, IEEE Symposium on Security and Privacy 2011.
20. (Xinruo Zhang) "Click Trajectories: End-to-End Analysis of the Spam Value Chain", Kirill Levchenko, Andreas Pitsillidis, Neha Chachra, Brandon Enright, Mark Felegyhazi, Chris Grier, Tristan Halvorson, Chris Kanich, Christian Kreibich, He Liu, Damon McCoy, Nicholas Weaver, Vern Paxson, Geoffrey M. Voelker, Stefan Savage IEEE Symposium on Security and Privacy 2011,