publications
2023
-
EuroSPUnderstanding, Measuring, and Detecting Modern Technical Support Scams (to appear)In 8th IEEE European Symposium on Security and Privacy, EuroS&P 2023 2023
-
USENIXSecTRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks (to appear)In 32nd USENIX Security Symposium, USENIX Security 23, ANAHEIM, CA, USA, August 9-11, 2023 2023
-
USENIXSecCombating Robocalls with Phone Virtual Assistant Mediated Interaction (to appear)In 32nd USENIX Security Symposium, USENIX Security 23, ANAHEIM, CA, USA, August 9-11, 2023 2023
2022
-
Returning to Port: Efficient Detection of Home Router DevicesIn 2022 IEEE Conference on Communications and Network Security (CNS) 2022
-
IMCPhishInPatterns: Measuring Elicited User Interactions at Scale on Phishing Websites (to appear)In IMC ’22: ACM Internet Measurement Conference 2022
2021
-
NDSSC\^2SR: Cybercrime Scene Reconstruction for Post-mortem Forensic AnalysisIn 28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021 2021
-
DLSApplying Deep Learning to Combat Mass RobocallsIn IEEE Security and Privacy Workshops, SP Workshops 2021, San Francisco, CA, USA, May 27, 2021 2021
-
arXiv
2020
-
ACSACTowards a Practical Differentially Private Collaborative Phone Blacklisting SystemIn ACSAC ’20: Annual Computer Security Applications Conference, Virtual Event / Austin, TX, USA, 7-11 December, 2020 2020
-
CCSMnemosyne: An Effective and Efficient Postmortem Watering Hole Attack Investigation SystemIn CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020 2020
-
EuroSPIoTFinder: Efficient Large-Scale Identification of IoT Devices via Passive DNS Traffic AnalysisIn IEEE European Symposium on Security and Privacy, EuroS&P 2020, Genoa, Italy, September 7-11, 2020 2020
-
IMCWhen Push Comes to Ads: Measuring the Rise of (Malicious) Push AdvertisingIn IMC ’20: ACM Internet Measurement Conference, Virtual Event, USA, October 27-29, 2020 2020
-
arXiv
-
arXiv
-
arXiv
-
arXiv
2019
-
IMCWhat You See is NOT What You Get: Discovering and Tracking Social Engineering Attack CampaignsIn Proceedings of the Internet Measurement Conference, IMC 2019, Amsterdam, The Netherlands, October 21-23, 2019 2019
-
DIMVADetection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19-20, 2019, Proceedings2019
2018
-
AsiaCCSAugmenting Telephone Spam Blacklists by Mining Large CDR DatasetsIn Proceedings of the 2018 on Asia Conference on Computer and Communications Security, AsiaCCS 2018, Incheon, Republic of Korea, June 04-08, 2018 2018
-
AsiaCCSTowards Measuring the Role of Phone Numbers in Twitter-Advertised SpamIn Proceedings of the 2018 on Asia Conference on Computer and Communications Security, AsiaCCS 2018, Incheon, Republic of Korea, June 04-08, 2018 2018
-
NDSSJSgraph: Enabling Reconstruction of Web Attacks via Efficient Tracking of Live In-Browser JavaScript ExecutionsIn 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018 2018
-
NDSSTowards Measuring the Effectiveness of Telephony BlacklistsIn 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018 2018
2017
-
TDSCStill Beheading Hydras: Botnet Takedowns Then and NowIEEE Trans. Dependable Secur. Comput. 2017
-
Practical Attacks Against Graph-based ClusteringIn Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 2017
-
Exploring the Long Tail of (Malicious) Software DownloadsIn 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2017, Denver, CO, USA, June 26-29, 2017 2017
-
Enabling Reconstruction of Attacks on Users via Efficient Browsing SnapshotsIn 24th Annual Network and Distributed System Security Symposium, NDSS 2017, San Diego, California, USA, February 26 - March 1, 2017 2017
-
Practical Attacks Against Graph-based ClusteringCoRR 2017
2016
-
Efficient and Accurate Behavior-Based Tracking of Malware-Control Domains in Large ISP NetworksACM Trans. Priv. Secur. 2016
-
MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis TestingIn Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2016, Xi’an, China, May 30 - June 3, 2016 2016
-
Real-Time Detection of Malware Downloads via Large-Scale URL-\textgreaterFile-\textgreaterMachine Graph MiningIn Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2016, Xi’an, China, May 30 - June 3, 2016 2016
-
Towards Measuring and Mitigating Social Engineering Software Download AttacksIn 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016 2016
2015
-
WebCapsule: Towards a Lightweight Forensic Engine for Web BrowsersIn Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015 2015
-
Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP NetworksIn 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2015, Rio de Janeiro, Brazil, June 22-25, 2015 2015
-
ASwatch: An AS Reputation System to Expose Bulletproof Hosting ASesIn Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication, SIGCOMM 2015, London, United Kingdom, August 17-21, 2015 2015
-
WebWitness: Investigating, Categorizing, and Mitigating Malware Download PathsIn 24th USENIX Security Symposium, USENIX Security 15, Washington, D.C., USA, August 12-14, 2015 2015
-
Understanding Malvertising Through Ad-Injecting Browser ExtensionsIn Proceedings of the 24th International Conference on World Wide Web, WWW 2015, Florence, Italy, May 18-22, 2015 2015
2014
-
PeerRush: Mining for unwanted P2P trafficJ. Inf. Secur. Appl. 2014
-
Building a Scalable System for Stealthy P2P-Botnet DetectionIEEE Trans. Inf. Forensics Secur. 2014
-
ClickMiner: Towards Forensic Reconstruction of User-Browser Interactions from Network TracesIn Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, November 3-7, 2014 2014
-
DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS TrafficIn 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2014, Atlanta, GA, USA, June 23-26, 2014 2014
2013
-
Scalable fine-grained behavioral clustering of HTTP-based malwareComput. Networks 2013
-
Beheading hydras: performing effective botnet takedownsIn 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS’13, Berlin, Germany, November 4-8, 2013 2013
-
PeerRush: Mining for Unwanted P2P TrafficIn Detection of Intrusions and Malware, and Vulnerability Assessment - 10th International Conference, DIMVA 2013, Berlin, Germany, July 18-19, 2013. Proceedings 2013
-
Measuring and Detecting Malware Downloads in Live Network TrafficIn Computer Security - ESORICS 2013 - 18th European Symposium on Research in Computer Security, Egham, UK, September 9-13, 2013. Proceedings 2013
-
SinkMiner: Mining Botnet Sinkholes for Fun and ProfitIn 6th USENIX Workshop on Large-Scale Exploits and Emergent Threats, LEET ’13, Washington, D.C., USA, August 12, 2013 2013
-
Connected Colors: Unveiling the Structure of Criminal NetworksIn Research in Attacks, Intrusions, and Defenses - 16th International Symposium, RAID 2013, Rodney Bay, St. Lucia, October 23-25, 2013. Proceedings 2013
-
ExecScent: Mining for New C&C Domains in Live Networks with Adaptive Control Protocol TemplatesIn Proceedings of the 22th USENIX Security Symposium, Washington, DC, USA, August 14-16, 2013 2013
2012
-
Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic AnalysisIEEE Trans. Dependable Secur. Comput. 2012
-
Detecting and Tracking the Rise of DGA-Based Malwarelogin Usenix Mag. 2012
-
VAMO: towards a fully automated malware clustering validity analysisIn 28th Annual Computer Security Applications Conference, ACSAC 2012, Orlando, FL, USA, 3-7 December 2012 2012
-
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based MalwareIn Proceedings of the 21th USENIX Security Symposium, Bellevue, WA, USA, August 8-10, 2012 2012
2011
-
Understanding the prevalence and use of alternative plans in malware with network gamesIn Twenty-Seventh Annual Computer Security Applications Conference, ACSAC 2011, Orlando, FL, USA, 5-9 December 2011 2011
-
Exposing invisible timing-based traffic watermarks with BACKLITIn Twenty-Seventh Annual Computer Security Applications Conference, ACSAC 2011, Orlando, FL, USA, 5-9 December 2011 2011
-
Boosting the scalability of botnet detection using adaptive traffic samplingIn Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, ASIACCS 2011, Hong Kong, China, March 22-24, 2011 2011
-
SURF: detecting and measuring search poisoningIn Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011, Chicago, Illinois, USA, October 17-21, 2011 2011
-
Detecting stealthy P2P botnets using statistical traffic fingerprintsIn Proceedings of the 2011 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2011, Hong Kong, China, June 27-30 2011 2011
-
HTTPOS: Sealing Information Leaks with Browser-side Obfuscation of Encrypted FlowsIn Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011 2011
-
Detecting Malware Domains at the Upper DNS HierarchyIn 20th USENIX Security Symposium, San Francisco, CA, USA, August 8-12, 2011, Proceedings 2011
2010
-
On the Secrecy of Spread-Spectrum Flow WatermarksIn Computer Security - ESORICS 2010, 15th European Symposium on Research in Computer Security, Athens, Greece, September 20-22, 2010. Proceedings 2010
-
Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network TracesIn Proceedings of the 7th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2010, April 28-30, 2010, San Jose, CA, USA 2010
-
A Centralized Monitoring Infrastructure for Improving DNS SecurityIn Recent Advances in Intrusion Detection, 13th International Symposium, RAID 2010, Ottawa, Ontario, Canada, September 15-17, 2010. Proceedings 2010
-
Building a Dynamic Reputation System for DNSIn 19th USENIX Security Symposium, Washington, DC, USA, August 11-13, 2010, Proceedings 2010
2009
-
McPAD: A multiple classifier system for accurate payload-based anomaly detectionComput. Networks 2009
-
Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS TracesIn Twenty-Fifth Annual Computer Security Applications Conference, ACSAC 2009, Honolulu, Hawaii, USA, 7-11 December 2009 2009
-
WSEC DNS: Protecting recursive DNS resolvers from poisoning attacksIn Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009, Estoril, Lisbon, Portugal, June 29 - July 2, 2009 2009
2008
-
Intrusion detection in computer networks by a modular ensemble of one-class classifiersInf. Fusion 2008
-
Classification of packed executables for accurate computer virus detectionPattern Recognit. Lett. 2008
-
McBoost: Boosting Scalability in Malware Collection and Analysis Using Statistical Classification of ExecutablesIn Twenty-Fourth Annual Computer Security Applications Conference, ACSAC 2008, Anaheim, California, USA, 8-12 December 2008 2008
-
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet DetectionIn Proceedings of the 17th USENIX Security Symposium, July 28-August 1, 2008, San Jose, CA, USA 2008
2007
-
Sensing Attacks in Computers Networks with Hidden Markov ModelsIn Machine Learning and Data Mining in Pattern Recognition, 5th International Conference, MLDM 2007, Leipzig, Germany, July 18-20, 2007, Proceedings 2007
2006
-
Alarm clustering for intrusion detection systems in computer networksEng. Appl. Artif. Intell. 2006
-
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection SystemsIn Proceedings of the 6th IEEE International Conference on Data Mining (ICDM 2006), 18-22 December 2006, Hong Kong, China 2006
-
MisleadingWorm Signature Generators Using Deliberate Noise InjectionIn 2006 IEEE Symposium on Security and Privacy (S&P 2006), 21-24 May 2006, Berkeley, California, USA 2006
-
Polymorphic Blending AttacksIn Proceedings of the 15th USENIX Security Symposium, Vancouver, BC, Canada, July 31 - August 4, 2006 2006
2005
-
Network Intrusion Detection by Combining One-Class ClassifiersIn Image Analysis and Processing - ICIAP 2005, 13th International Conference, Cagliari, Italy, September 6-8, 2005, Proceedings 2005
-
Alarm Clustering for Intrusion Detection Systems in Computer NetworksIn Machine Learning and Data Mining in Pattern Recognition, 4th International Conference, MLDM 2005, Leipzig, Germany, July 9-11, 2005, Proceedings 2005