Phone: +1 (405) URL: Research Interests

Transcription

1 Adam MacNeil Bates Ph.D. Candidate Office: 206 MAE Building Department of Computer & Information Science & Engineering Gainesville, FL University of Florida Phone: +1 (405) URL: Research Interests Education Systems Security, Data Provenance, Communications & Network Security, Infrastructure Security, Operating Systems, Cloud Computing, Network Measurement, Distributed Systems. University of Florida, Gainesville, Florida Ph.D., Computer Science September 2014 May 2016 Advisor: Professor Kevin Butler Area of Study: Systems & Network Security Dissertation Title: Designing and Leveraging a Trustworthy Provenance Stack University of Oregon, Eugene, Oregon M.S., Computer Science September 2010 August 2014 Advisor: Professor Kevin Butler Area of Study: Systems & Network Security Thesis Title: Detecting Cloud Co-residency with Network Flow Watermarking Techniques University of Maryland, College Park, Maryland B.Sc., Computer Science, August 2002 December 2006 B.A., English Literature Professional Activities MIT Lincoln Laboratory, Lexington, MA June 2015 August 2015 Research Intern, Secure Resilient Systems and Technology Group Mentors: Thomas Moyer, Nabil Schear, Rob Cunningham Worked on group-wide effort to deploy provenance capabilities for a military logistics reporting system. Supply shipments leak information about military operations, and are therefore a target for cyber espionage and attack. Contributed as specialist in secure provenance collection and management. Developed provenance-aware operating system and instrumented applications. Advised other team members on methods for provenance aggregation and query. University of Florida, Gainesville, FL Research Assistant, Florida Institute for Cyber Security September 2014 Present Led the Database-Aware Provenance (DAP) project, which aims to create transparent and secure web services by providing low cost, minimally invasive provenance capture agents. DAP interposes on communications between web applications and database engines to parse queries and extract high fidelity data provenance without requiring any modifications to the web service. When provided with an external specification of application behavior by the developer, DAP can be used to stop SQL injection attacks in real time, or track attackers that gain server access through binary exploitation. Technical paper in submission. Led the Linux Provenance Modules (LPM) project, an operating system for the capture of trustworthy whole-system provenance. LPM collects provenance on the manipulations of kernel objects while providing reference monitor security guarantees. Identified and solved key challenges in the design of provenance-aware systems for distributed and heterogeneous computing environments, including a gateway for upgrading untrusted provenance to high integrity state. Developed mechanism for provenance-based data loss prevention that controls the spread

2 of sensitive enterprise data (e.g., PCI, PII) through tracking complex file ancestries. This work was accepted and presented at USENIX Security MIT Lincoln Laboratory, Lexington, MA June 2013 September 2013 Research Intern, Cyber Systems and Technology Group Mentors: Thomas Moyer, Rob Cunningham Lead preliminary group efforts in the area of provenance-aware systems. Evaluated existing provenance mechanisms for their applicability in federal and military computing systems. Instrumented the kernel with dedicated provenance collection hooks. Ported existing security modules to a provenance framework in order to facilitate interoperability with SELinux. These efforts laid the foundation for the LPM project. Graduate Intern, EMC, Cambridge, MA Jun 2011 September 2011 Graduate Intern, Information Rights Management (IRM) Team Performed security audit of IRM software suite. Designed and implemented protocol fuzzer for IRM interprocess communication. Conducted manual inspection of all cryptographic routines. Identified multiple implementation flaws that permitted the exfiltration of controlled data. University of Oregon, Eugene, OR September 2010 August 2014 Research Assistant, Department of Computer & Information Science Led the CertShim project, an investigation of SSL/TLS Trust Enhancements. The goal of CertShim is to place experimental certificate validation prototypes in the hands of end users for both their benefit and for evaluation purposes. CertShim is a lightweight operating system retrofit that forcibly overrides insecure certificate handling defaults in SSL/TLS clients, and introduces a policy mechanism that can be used to express domain-specific multi-factor verification procedures. Leveraged CertShim in follow-up work to synthesize university-scale workloads for multi-path probing systems and evaluate their impact on the network. This work was published at CCS 2014 and IMC Led the USB Fingerprinting project, which demonstrates that USB interface timing characteristics can be used as a means for establishing trust in an unknown host machine. Performed machine learning analysis of USB enumeration samples extracted using a custom Android app, and demonstrated that enumeration leaks data about the host operating system, manufacturer, and even uniquely identifying details about individual machines. Leveraged system to detect virtualized environments with high accuracy. This work was published at NDSS Subsequent work using USB power readings is currently in preparation. Senior Graduate Student, Oregon Systems Infrastructure Research & Information Security (OSIRIS) Laboratory Administrative and logistical lead student in the OSIRIS lab. Ran weekly lab meetings, met with students individually for mentoring and development of leadership and research skills. Human Resources Incorporated, Crofton, MD Programmer Designed ASP.NET applications for customized client web content using company databases. Created and managed systems in SQL Server, Access, Excel and Goldmine mail. AAI Corporation, Hunt Valley, MD Summer 2006, 2007 Summer Intern Designed software to interface Excel Spreadsheet with existing company databases. Assisted in creation of debugging software for a vehicle calibration product.

3 Peer-Reviewed Publications Acceptance rates given when made available; citations from Google Scholar as of May Journals 1. Adam Bates, Kevin Butler, Micah Sherr, Clay Shields, Patrick Traynor, and Dan Wallach. Accountable Wiretapping -or- I Know That You Can Hear Me Now. Journal of Computer Security, accepted for publication, January (Cited by 2.) 2. Adam Bates, Benjamin Mood, Joe Pletcher, Hannah Pruse, Masoud Valafar, and Kevin Butler. On Detecting Co-Resident Cloud Instances Using Network Flow Watermarking Techniques. Intl. Journal of Information Security, 13(2), pg , April (Cited by 2.) Conferences 3. Dave Tian, Adam Bates, and Kevin R.B. Butler. GoodUSB -or- How I Learned to Stop Worrying and Love the Rubber Ducky. 31st Annual Computer Security Applications Conference (ACSAC 15), Los Angeles, CA, USA, December (Acceptance rate=22.5%.) 4. Adam Bates, Dave Tian, Kevin R.B. Butler, and Thomas Moyer. Trustworthy Whole- System Provenance for the Linux Kernel. 24th USENIX Security Symposium (Security 15), Washington D.C., USA, August (Acceptance rate=15.7%. Cited by 1.) 5. Brad Reaves, Nolen Scaife, Adam Bates, Kevin R.B. Butler, and Patrick Traynor. Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World. 24th USENIX Security Symposium (Security 15), Washington D.C., USA, August (Acceptance rate=15.7%.) 6. Brad Reaves, Ethan Shernan, Adam Bates, Henry Carter, and Patrick Traynor. Boxed Out: Blocking Cellular Interconnect Bypass Fraud at the Network Edge. 24th USENIX Security Symposium (Security 15), Washington D.C., USA, August (Acceptance rate=15.7%.) 7. Adam Bates, Joe Pletcher, Tyler Nichols, Braden Hollembaek, Dave Tian, Abdulrahman Alkhelaifi, and Kevin Butler. CertShim: Securing SSL Certificate Verification through Dynamic Linking. 21st ACM Conference on Computer and Communications Security (CCS 14), Scottsdale, AZ, USA, November (Acceptance rate=19%. Cited by 5.) 8. Adam Bates, Joe Pletcher, Tyler Nichols, Braen Hollembaek, and Kevin Butler. Forced Perspectives: Evaluating an SSL Trust Enhancement at Scale ACM Internet Measurement Conference (IMC 14), Vancouver, BC, Canada, November (Acceptance rate=22.9%. Cited by 3.) 9. Adam Bates, Ryan Leonard, Hannah Pruse, Daniel Lowd, and Kevin Butler. Leveraging USB to Establish Host Identity Using Commodity Devices. 21st ISOC Network and Distributed System Security Symposium (NDSS 14), San Diego, CA, USA, February (Acceptance rate=18.6%. Cited by 2.) 10. Adam Bates, Benjamin Mood, Masoud Valafar, and Kevin Butler. Towards Secure Provenance-Based Access Control in Cloud Environments (short paper). 3rd ACM Conference on Data and Application Security and Privacy (CODASPY 2013), San Antonio, TX, USA, February (Acceptance rate=31.8%. Cited by 19.) 11. Adam Bates, Kevin Butler, Micah Sherr, Clay Shields, Patrick Traynor, and Dan Wallach. Accountable Wiretapping -or- I Know That You Can Hear Me Now. 19th ISOC Network and Distributed System Security Symposium (NDSS 12), San Diego, CA, USA. February (Acceptance rate=17.6%. Cited by 1.)

4 Workshops 12. Adam Bates, Kevin R.B. Butler, and Thomas Moyer. Take Only What You Need: Leveraging Mandatory Access Control Policy to Reduce Provenance Storage Costs. 7th International Workshop on Theory and Practice of Provenance (TaPP), Edinburgh, Scotland, July (Cited by 1.) 13. Adam Bates, Kevin Butler, Andreas Haeberlen, Micah Sherr, and Wenchao Zhou. Let SDN Be Your Eyes: Secure Forensics in Data Center Networks. NDSS Security of Emerging Network Technologies Workshop (SENT), San Diego, CA, USA, February (Cited by 7.) 14. Adam Bates, Benjamin Mood, Joe Pletcher, Hannah Pruse, Masoud Valafar, and Kevin Butler. Detecting Co-Residency with Active Traffic Analysis Techniques. 4th ACM Cloud Computing Security Workshop (CCSW 2012), Raleigh, NC, USA, October (Acceptance rate=12.0% for full papers. Cited by 25.) Presentations & Invited Talks 1. Designing and Leveraging Trustworthy Provenance-Aware Architectures. Pennsylvania State University, State College, PA, October 21, Trustworthy Whole-System Provenance for the Linux Kernel. USENIX Security 2015, Washington D.C., USA, August Take Only What You Need: Leveraging Mandatory Access Control Policy to Reduce Provenance Storage Costs. TAPP 2015, Edinburgh, Scotland, July Designing and Leveraging a Trustworthy Provenance Stack. Dissertation Proposal Defense, University of Florida, Gainesville, FL, April Practical Trust Advancements in the SSL/TLS Ecosystem. Carleton University, Ottawa, ON, Canada, January 9, Securing SSL Certificate Validation through Dynamic Linking. CCS 2014, Scottsdale, AZ, November Leveraging USB to Establish Host Identity Using Commodity Devices. NDSS 2014, San Diego, CA, February Let SDN Be Your Eyes: Secure Forensics in Data Center Networks. SENT 2014, San Diego, CA, February Linux Provenance Modules: Secure Provenance Collection for the Linux Kernel. Directed Research Project Defense, University of Oregon, Eugene, OR, December Towards a Usable Provenance Reference Monitor. MIT Lincoln Laboratory, Lexington, MA, September Towards Secure Provenance-based Access Control in Cloud Environments. CODASPY 2013, San Antonio, TX, February Detecting Co-Residency with Active Traffic Analysis Techniques. CCSW 2012, Raleigh, NC, USA, October Detecting Compute Cloud Co-residency with Network Flow Watermarking Techniques. Masters Thesis Defense, University of Oregon, Eugene, OR, June Accountable Wiretapping -or- I Know They Can Hear You Now. NDSS 2012, San Diego, CA, USA, August 2011.

5 Teaching Activities University of Florida, Gainesville, FL September 2014 Present Co-Instructor, CNT5410 (Computer and Network Security) Shared teaching and administrative duties with Professor Kevin Butler. Guest Lecturer, CNT5370 (Computer and Information Security) Presented lecture on security retrofits in operating systems. University of Oregon, Eugene, OR September 2010 August 2013 Guest Lecturer, Department of Computer & Information Science CIS415 (Operating Systems): presented lecture on virtualization. Instructor, Lundquist College of Business, University of Oregon Designed comprehensive web utility to aide coursework submission, grading and administration of BA240 course. 1 of 2 instructors of record, taught approximately 1200 students per year. Planned course curriculum and designed assignments. Kappa Kappa Psi, Stillwater, OK Field Representative, National Honorary Band Service Fraternity Hosted educational seminars on 140 college campus spanning topics that included risk management, hazing and discrimination policy, values, chapter operations, and finances. University of Maryland, College Park, MD 2005 Teaching Assistant, College Park Scholars Program Assisted with grading and instruction of a web design course for non-majors. External Services Honors & Awards Skills Core Graduate Coursework Program Committees: ACSAC 2015, MCS Organizing Committees, etc.: Web Chair, IEEE Symposium on Security & Privacy, Session Chair, ACM CCS External Reviewer: ISOC NDSS 2015, IEEE Euro S&P 2015, ACM CCS 2015, ASIACCS 2015, PETS 2015, USENIX Security 2015, ACM CCS 2014, ASIACCS 2014, ESORICS 2014, USENIX Security 2014, ACM CCS 2013, ACSAC 2013, PST 2013, ESORICS 2012, IEEE S&P 2012, EAI SecureComm Student Travel Grants: USENIX Security 2015, ACSAC 2014, ACM CCS 2014, IEEE S&P 2014, ACM CCS 2012, USENIX Security Best Poster Award Honorable Mention, Graduate Student Research Day, University of Florida, Graduate School Fellowship, University of Florida, Best Poster Award: Information & Physical Sciences, Graduate Research Forum, University of Oregon, J. Donald Hubbard Family Scholarship, Computer & Information Science Department, University of Oregon, J. Lee Burke National Student Achievement Award, Kappa Kappa Psi, Systems: Linux Kernel, Trusted Platform Module, Android, Virtual Hypervisors (Xen, VMWare), Network Protocol Manipulation, Distributed Architectures (Futuregrid, EC2), UNIX. Programming: C, C++, Java, Python, Perl, Linux Shell. Tools: GDB, KDB, Wireshark, tcpdump, Git, Subversion, L A TEX. Systems Security, Network Security, Computer Networks, Software Defined Networking, Secure Multiparty Computation, Program Analysis & Transformation, Distributed Systems, Machine Learning, Visualization, Algorithms & Complexity, Artificial Intelligence