Systems Security Research Lab
The Systems Security Research Lab (S2Lab) sits in the Information Security Research Group of the Department of Computer Science at University College London (UCL).
Our vision is to develop techniques that automatically protect systems from vulnerabilities and malicious activities. Certainly, this is a broad remit, so let’s narrow the scope a bit. We work at the intersection of program analysis and machine learning for systems security. Ah, the buzzwords. It may be tempting to believe we’re just following the machine learning/cybersecurity hype, but that would be untrue.
In fact our motivation can be traced back to two particular research efforts from the underground hacker and academic security communities which touched on these topics:
- Smashing the stack for fun and profit, one of the very first attempts to discuss the details of low-level systems security through the lens of the exploitation of memory corruption vulnerabilities; and
- Intrusion Detection via Static Analysis, one of the very first attempts to combine (static) program analysis with anomaly detection.
Since these works, we’ve always been intrigued by the role these disciplines play to secure our systems. The democratization of machine learning approaches has clearly increased our appetite further to reason about how program analysis and machine learning can intertwine in order to improve systems security in the presence of adversaries.
Ultimately, we aim to build practical tools and provide security services to the community at large, while supporting open science.
We are thankful to the several sponsors who have funded our research, including UKRI EPSRC, EU, GCHQ/NCSC, Intel Security, NVIDIA Corporation, and AVAST Software. Moreover, we are eternally grateful to the many collaborators whom we have been working with or have provided opportunities for cross-pollination to influence, inspire, and further refine our research vision.
We are committed to pursuing academic excellence while embracing disruptive thinking at its best.
Latest News
- March 2023: "ROPfuscator: Robust Obfuscation with ROP" accepted to appear at WOOT 2023, co-located with IEEE S&P 2023
- March 2023: "Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors" accepted to appear at DLSP 2023, co-located with IEEE S&P 2023
- March 2023: "Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers" accepted to appear at IEEE S&P 2023. See you in SF!
- August 2022: Truly humbled to receive one of the USENIX Security 2022 Distinguished Paper Awards for our work Dos and Don't of Machine Learning for Computer Security
- August 2022: Daniel, Feargus, Fabio, and Lorenzo are attending USENIX Sec 2022 in Boston to present our work Dos and Don't of Machine Learning for Computer Security
- June 2022: Lorenzo delivers the keynote "Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift" at the KASTEL Distinguished Lecture Series
- June 2022: Lorenzo delivers the keynote "Trustworthy Machine Learning... for Systems Security" at the first "post-pandemic" UCL ACE-CSR Open Day
- April 2022: Federico, Feargus, Fabio, and Lorenzo are attending IEEE S&P 2022 in San Francisco to present our work "Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift"
- December 2021: Our work "Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift" has been accepted to IEEE S&P 2022!
- November 2021: Feargus Pendlebury has passed his PhD viva with no corrections, with a thesis titled "Machine Learning for Security in Hostile Environments", congrats! A huge thanks to Suman Jana (Columbia University) for serving as external examiner to Feargus' PhD Viva.
Selected Publications
Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
IEEE S&P · 44th IEEE Symposium on Security and Privacy, 2023
IEEE S&P · 44th IEEE Symposium on Security and Privacy, 2023
@article{yang2022jigsaw,
author = {Limin Yang, Zhi Chen, Jacopo Cortellazzi, Feargus Pendlebury, Kevin Tu, Fabio Pierazzi, Lorenzo Cavallaro, Gang Wang},
title = {Jigsaw Puzzle: Selective Backdoor Attack
to Subvert Malware Classifiers},
booktitle = {{IEEE} Symposium on Security and Privacy},
volume = {abs/2202.05470},
year = {2023},
url = {https://arxiv.org/abs/2202.05470},
eprint = {2202.05470},
}
Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors
DLSP · 6th IEEE Workshop on Deep Learning Security and Privacy, 2023
DLSP · 6th IEEE Workshop on Deep Learning Security and Privacy, 2023
@inproceedings{chen23dlsp,
author = {Zhi Chen and Zhenning Zhang and Zeliang Kan and Limin Yang and and Jacopo Cortellazzi and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro and Gang Wang},
title = {Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors},
booktitle = {{IEEE} Workshop on Deep Learning Security and Privacy ({DLSP})},
year = {2023},
}
Dos and Don'ts of Machine Learning in Computer Security
USENIX Sec | Distinguished Paper Award · 31st USENIX Security Symposium, 2022
USENIX Sec | Distinguished Paper Award · 31st USENIX Security Symposium, 2022
@inproceedings{arp2022dodo,
author = {Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck},
title = {Dos and Don'ts of Machine Learning in Computer Security},
booktitle = {31st USENIX Security Symposium},
year = {2022},
}
Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift
IEEE S&P · 43rd IEEE Symposium on Security and Privacy, 2022
IEEE S&P · 43rd IEEE Symposium on Security and Privacy, 2022
@inproceedings{barbero2022transcendent,
author = {Federico Barbero and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro},
title = {Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift},
booktitle = {{IEEE} Symposium on Security and Privacy},
year = {2022},
}
@article{labacacastro2022uaps,
author = {Raphael Labaca-Castro and Luis Muñoz-González and Feargus Pendlebury and Gabi Dreo Rodosek and Fabio Pierazzi and Lorenzo Cavallaro},
title = {Realizable Universal Adversarial Perturbations for Malware},
journal = {CoRR},
volume = {abs/2102.06747},
year = {2022},
url = {https://arxiv.org/abs/2102.06747},
eprint = {2102.06747},
archivePrefix = {arXiv}
}
Investigating Labelless Drift Adaptation for Malware Detection
AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021
AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021
@inproceedings{kan2021adaptation,
author = {Zeliang Kan and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro},
title = {Investigating Labelless Drift Adaptation for Malware Detection},
booktitle = {{ACM} Workshop on Artificial Intelligence and Security ({AISec})},
year = {2021},
}
INSOMNIA: Towards Concept-Drift Robustness in Network Intrusion Detection
AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021
AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021
@inproceedings{andresini2021insomnia,
author = {Giuseppina Andresini and Feargus Pendlebury and Fabio Pierazzi and Corrado Loglisci and Annalisa Appice and Lorenzo Cavallaro},
title = {{INSOMNIA}: Towards Concept-Drift Robustness in Network Intrusion Detection},
journal = {{ACM} Workshop on Artificial Intelligence and Security ({AISec})},
year = {2021},
}
Probabilistic Naming of Functions in Stripped Binaries
ACSAC · Annual Computer Security Applications Conference, 2020
ACSAC · Annual Computer Security Applications Conference, 2020
@inproceedings{patrickevans2020punstrip,
author = {James Patrick-Evans and Lorenzo Cavallaro and Johannes Kinder},
title = {Probabilistic Naming of Functions in Stripped Binaries},
booktitle = {Annual Computer Security Applications Conference (ACSAC)},
year = {2020},
}
Intriguing Properties of Adversarial ML Attacks in the Problem Space
IEEE S&P · 41st IEEE Symposium on Security and Privacy, 2020
IEEE S&P · 41st IEEE Symposium on Security and Privacy, 2020
@inproceedings{pierazzi2020problemspace,
author = {Fabio Pierazzi and Feargus Pendlebury and Jacopo Cortellazzi and Lorenzo Cavallaro},
booktitle = {2020 IEEE Symposium on Security and Privacy (SP)},
title = {Intriguing Properties of Adversarial ML Attacks in the Problem Space},
year = {2020},
volume = {},
issn = {2375-1207},
pages = {1308-1325},
doi = {10.1109/SP40000.2020.00073},
url = {https://doi.ieeecomputersociety.org/10.1109/SP40000.2020.00073},
publisher = {IEEE Computer Society},
}
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time
USENIX Sec · 28th USENIX Security Symposium, 2019
USENIX Sec · 28th USENIX Security Symposium, 2019
@inproceedings{pendlebury2019tesseract,
author = {Feargus Pendlebury and Fabio Pierazzi and Roberto Jordaney and Johannes Kinder and Lorenzo Cavallaro},
title = {{TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time}},
booktitle = {28th USENIX Security Symposium},
year = {2019},
address = {Santa Clara, CA},
publisher = {USENIX Association},
note = {USENIX Sec}
}
Transcend: Detecting Concept Drift in Malware Classification Models
USENIX Sec · 26th USENIX Security Symposium, 2017
USENIX Sec · 26th USENIX Security Symposium, 2017
@inproceedings {jordaney2017,
author = {Roberto Jordaney and Kumar Sharad and Santanu K. Dash and Zhi Wang and Davide Papini and Ilia Nouretdinov and Lorenzo Cavallaro},
title = {{Transcend: Detecting Concept Drift in Malware Classification Models}},
booktitle = {26th USENIX Security Symposium},
year = {2017},
address = {Vancouver, BC},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/jordaney},
publisher = {USENIX Association},
note = {USENIX Sec}
}
Modular Synthesis of Heap Exploits
ACM CCS-PLAS · ACM SIGSAC Workshop on Programming Languages and Analysis for Security, 2017
ACM CCS-PLAS · ACM SIGSAC Workshop on Programming Languages and Analysis for Security, 2017
@inproceedings{plas2017,
author = {Dusan Repel and Johannes Kinder and Lorenzo Cavallaro},
title = {Modular Synthesis of Heap Exploits},
booktitle = {Proc. ACM SIGSAC Workshop on Programming Languages and Analysis for Security (PLAS 2017)},
year = 2017,
note = {ACM CCS-PLAS}
}
Prescience: Probabilistic Guidance on the Retraining Conundrum for Malware Detection
ACM CCS-AISec · 9th ACM CCS Workshop on Artificial Intelligence and Security, 2016
ACM CCS-AISec · 9th ACM CCS Workshop on Artificial Intelligence and Security, 2016
@inproceedings{aisec16,
author = {Amit Deo and Santanu Kumar Dash and Guillermo Suarez-Tangil and Volodya Vovk and Lorenzo Cavallaro},
title = {{Prescience: Probabilistic Guidance on the Retraining Conundrum for Malware Detection}},
booktitle = {9th ACM CCS Workshop on Artificial Intelligence and Security},
year = {2016},
note = {ACM CCS-AISec}
}
CopperDroid: Automatic Reconstruction of Android Malware Behaviors
NDSS · 22nd Annual Network and Distributed System Security Symposium, 2015
NDSS · 22nd Annual Network and Distributed System Security Symposium, 2015
@InProceedings{copperdroid-ndss2015,
author = {Kimberly Tam, Salahuddin J. Khan, Aristide Fattori, and Lorenzo Cavallaro},
title = {{CopperDroid: Automatic Reconstruction of Android Malware Behaviors}},
booktitle = {22nd Annual Network and Distributed System Security Symposium, San Diego, California, USA},
year = 2015,
month = {February},
note = {NDSS}
}