 |
Professor at the Department of Computer Science and Information Engineering (DISI) Dean of the ICT International PhD School of Trento University University of Trento via Sommarive 14, I-38123 Povo (TN), Italy
|
unitn.itSome of my recent papers (check also the full list)
- Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda, William Robertson, Cached and Confused: Web Cache Deception in the Wild. accepted at Usenix Security 2020. The paper raised already the attention of many experts (e.g. James Kettle, Omer Gil ) and it was cover by specialized media (e.g., The Daily Swig, ZDNet).
- Mahmoud Ammar, Giovanni Russello, Bruno Crispo, Internet of Things: A survey on the security of IoT frameworks. Journal of Information Security and Applications 38: 8-27 (2018).
- Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda, William K. Robertson, Large-Scale Analysis of Style Injection by Relative Path Overwrite. Accepted and presented at The Web Conference 2018 (formerly known as WWW). The paper has been shortlisted for the best paper award competition!
Research Interests
- Large-scale analysis of web-based attacks: Recently, I started working on large-scale analysis of new web-based attacks. The first target here is the discovery of new vulnerabilities and attacks to exploit them. The second is the analysis of the potential impact of each of these vulnerabilities by analyzing large portions of website and how many of these are subject to the discovered vulnerabilities. So far one of the most important results of this research has been the discovery and exploitation of the Relative Path Overwrite (RPO) attack. The most important exploit we study about it was the Web Cache Deception work that will be presented at Usenix Security 2020.
- Security of Internet of Things: This research thread investigates the problem of protecting Internet of Things and cyber-physical systems. In particular, I study the emergence of new attack vectors caused by the interconnection of subsystems that have never been connected to Internet before. I don't limit my research to attacks, but I also investigate defense mechanisms. My main interest is on the protection of the simplest classes of devices, that are also the most widely deployed, that could not be equipped with special hardware to protect cryptographic keys and in some cases not even with primary memory protection. In this domain, my interest is on software-based solutions.
- Behavioural Biometrics: Several field studies show that users are very reluctant on using traditional authentication methods like PIN and password to authenticate to the new generation of devices like smartphone, smart watches, fitness bands, etc. In this activity I am interested in designing and evaluating new user authentication methods for IoT. These methods are based on behavioral biometrics, thus biometrics based on how users perform particular activities. MEMS technology embedded in almost all these new devices allows the implementation of new biometrics without the need for additional or specialized hardware. Here the challenge is to design methods that users accept and find easy to use and that achieve the necessary accuracy to provide the desired level of security. This topic of research is typically multidisciplinary since involves competences in the area of security and privacy, machine learning and computer-human interactions.
- Adversarial Learning: How not to jump into the bandwagon of AI nowadays?! Recently, I started working on this topic too. However, just a small part of the activity is devoted to applications of adversarial learning, that account for 95% of the research you can find around, while most of the research I do here tries to be more fundamental and study how to design learning algorithms that make adversarial attacks more difficult. This research thread is in collaboration with Prof. Bergadano from University of Torino.
- Mobile Platforms Security and Privacy: Smartphones became a pervasive computing and communication platform used by people to perform many activities besides placing and receiving phone calls. However, the protection and security models supported by such platforms have been shown not to adequately address security and privacy concerns of their users. This research activity is structured in two different threads. The first, aims at extending and strengthening the security models and mechanisms of existing smart-phone platforms and OSes. Particularly challenging in this domain is to find solutions that can increase the security and privacy of users without affecting usability. The second thread, acts directly on the mobile applications. Here the focus is the development of innovative techniques that combine static and dynamic approaches to analyse the security of applications. Particularly challenging is the analysis of the code uploaded only at runtime and the analysis of programming constructs that hide their semantics (i.e. reflections).
Research projects I am currently involved in
-
CyberSec4Europe (EU)
CyberSec4Europe is a pilot for a future European Cybersecurity Competence Network – a new digital ecosystem built of a network of centres of cybersecurity expertise, with a central hub. The project designs, tests and demonstrates potential governance structures for a future European Cybersecurity Competence Network using best practice examples derived from concepts like CERN as well the expertise and experience of partners. -
TENSE+ : Security and Privacy for Cyber-Physical Systems and the Internet of Things with KULeuven
The “Internet of Things” (IoT) is expected to continue to grow exponentially in the foreseeable future. An important recent trend is that the connection between the Internet and elements of the physical world (such as machines, robots, cars, production facilities, and so forth) is getting stronger and stronger. Moreover, these systems are integrating more and more with and within our human bodies; currently we observe this trend for wellness and medical applications and one can expect that this will result in growing processing of information in and around the human body. The hardware and software infrastructure that supports this global network of systems is one of the most impressive technological achievements of mankind. But unfortunately, as many incidents over the past years have shown, it is not without security flaws. The main objective of this research project is to develop technology that supports the construction of secure cyber-physical systems and a secure Internet of Things. -
NeCS: European Network fro Cyber Security (EU)
The European Network for Cybersecurity (NECS) was formed in response to the increased need of highly qualified experts able to cope with all the aspects of the European cyber security strategy that is currently under implementation.There is indeed an evident need and opportunity to grow a new generation of young researchers able to answer this demand for expertize. This 4-year project for a cybersecurity research and training network aims at contributing to answer this increased demand of human expertise in the field.
Research projects that just finished
Scientific events I am currently involved in
- 4th International NeCS Winter PhD School on Critical Infrastructure Protection, Fai della Paganella, on 20-24 January, 2020. (Chair)
- Track Chair of the Security, Privacy and Trust tack of The Web Conference 2020 (WWW2020).