Course Schedule

• Required reading:
  The Myth of Double-Blind Review Revisited: ACL vs. EMNLP.
  Cornelia Caragea, Ana Sabina Uban, and Liviu P. Dinu.
  EMNLP 2019.
• Optional reading(s):
  Double Blind Review at SSBSE.
  Prof. Claire Le Goues.

Discussion: end-to-end systems abstraction

Notes (Thanks Giorgio!)

Recording (whiteboard may be unclear, consult notes above...)

• Recommended pwn.college challenge: Talking Web

• Required reading:
  Hiding in the Particles: When Return-Oriented Programming Meets Program Obfuscation.
  Pietro Borrello, Emilio Coppa, and Daniele Cono D'Elia.
  DSN 2021.
• Optional reading(s):
  Smashing the Stack For Fun and Profit.
  Aleph One.
• Survivalism: Systematic Analysis of Windows Malware Living-Off-The-Land.
  Frederick Barr-Smith, Xabier Ugarte-Pedrero, Mariano Graziano, Riccardo Spolaor, and Ivan Martinovic.
  Oakland 2021.
• Recommended pwn.college challenges
  • Memory Errors
  • Return-Oriented Programming

• Required reading:
  SoK: Automated Software Diversity.
  Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz.
  Oakland 2014.
• Optional reading(s):
  Survey of Cyber Moving Targets, Second Edition.
  BC Ward, SR Gomez, RW Skowyra, D Bigelow, JN Martin, JW Landry, and H Okhravi.
  (MIT Lincoln Laboratory Technical Report)

• Required reading:
  Spotless Sandboxes: Evading Malware Analysis Systems using Wear-and-Tear Artifacts.
  Najmeh Miramirkhani, Mahathi Priya Appini, Nick Nikiforakis, and Michalis Polychronakis.
  (Oakland 2017)

Please submit URLs to your video recordings of your 5-minute pitches along with your writeup.

No required readings.

Since Kevin is away, no in-person class this day. Instead, you must review all other project pitch presentations and provide feedback for each group.

• Required reading:
  Using Hardware Features for Increased Debugging Transparency.
  Fengwei Zhang, Kevin Leach, Angelos Stavrou, Haining Wang, and Kun Sun.
  Oakland 2015.

• Required reading:
  Reducing Malware Analysis Overhead with Coverings.
  Michael Sandborn, Zach Stoebner, Westley Weimer, Stephanie Forrest, Ryan Dougherty, Jules White, and Kevin Leach.
  TDSC 2023.
• Optional reading(s):
  Revising ARM Debugging Features: Nailgun and its Defense.
  Zhenyu Ning, Chenxu Wang, Yinhua Chen, Fengwei Zhang, and Jiannong Cao.
  TDSC 2022.
  
  Understanding the Security of ARM Debugging Features.
  Zhenyu Ning and Fengwei Zhang.
  Oakland 2019.

• Required readings
  Spectre: Exploiting Speculative Execution.
  Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom.
  Oakland 2019.
  
  Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors.
  Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu.
  International Symposium on Computer Architecture (ISCA) 2014.


• Optional reading(s):
  Meltdown: Reading Kernel Memory from User Space.
  Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg.
  Usenix Security 2018.
  
  Rowhammer slides (visual explanations may help understanding if you are unfamiliar with hardware).
  
  RowHammer: A Retrospective.
  Onur Mutlu and Jeremie S. Kim.
  IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2020.

• the HW2 specification
• Optional reading(s):
  LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation.
  Chris Lattner and Vikram Adve.
  Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04).

• Required reading:
  KShot: Live Kernel Patching with SMM and SGX.
  Lei Zhou, Fengwei Zhang, Jinghui Liao, Zhengyu Ning, Jidong Xiao, Kevin Leach, Westley Weimer, and Guojun Wang.
  In DSN 2021 (best paper runner up).

• Required reading:
  CAGE: Complementing Arm CCA with GPU Extensions.
  Chenxu Wang, Fengwei Zhang, Yunjie Deng, Kevin Leach, Jiannong Cao, Zhenyu Ning, Shoumeng Yan, and Zhengyu He.
  NDSS 2024.

• Required reading:
  Stealing Machine Learning Models via Prediction APIs.
  Florian Tramer, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart.
  USENIX Security 2016.
• Optional readings:
  Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images (CVPR2015)
  Intriguing Properties of Neural Networks (ICLR 204)
  Google's Cloud Vision API Is Not Robust To Noise (ICMLA 2017)
  Natural Adversarial Examples (CVPR 2021)
  Iterative Feature Mining for Constraint-Based Data Collection to Increase Data Diversity and Model Robustness (EMNLP 2020)

• Required reading:
  PBP: Post-Training Backdoor Purification for Malware Classifiers.
  Dung Thuy Nguyen, Ngoc N. Tran, Taylor T. Johnson, and Kevin Leach.
  NDSS 2025 (to appear).

• Required Reading:
  On the Feasibility of Stealthily Introducing Vulnerabilities in Open-source Software via Hypocrite Commits. By Qiushi Wu and Kangjie Lu. Formerly in Oakland 2021.
• Optional reading:
  Letter from authors withdrawing paper from conference proceedings.

• Required reading:
  Breaking the Flow: A Study of Interruptions During Software Engineering Activities.
  Yimeng Ma, Yu Huang, Kevin Leach. ICSE 2024 (Distinguished Paper Award).
• Optional readings:
  Neurological Divide: an fMRI Study of Prose and Code Writing. By Ryan Kruger, Yu Huang, Xinyu Liu, Tyler Santander, Westley Weimer, and Kevin Leach. In ICSE 2020.
  Distilling Neural Representations of Data Structure Manipulation using fMRI and fNIRS. By Yu Huang, Xinyu Liu, Ryan Krueger, Tyler Santander, Xiaosu Hun, Kevin Leach, and Westley Weimer. In ICSE 2019 (ACM Distinguished Paper Award).

• Required reading:
  START: A Framework for Trusted and Resilient Autonomous Vehicles.
  Kevin Leach, Christopher Timperley, Kevin Angdtadt, Anh Nguyen-Tuong, Jason Hiser, Aaron Paulos, Partha Pal, Patrick Hurley, Carl Thomas, Jack W. Davidson, Stephanie Forrest, Claire Le Goues, Westley Weimer.
  In ISSRE 2022.
• Optional reading(s):
  Selective Symbolic Type-Guided Checkpointing and Restoration for Autonomous Vehicle Repair. By Yu Huang, Kevin Angstadt, Kevin Leach, and Westley Weimer. In APR 2020.
  
  A Comprehensive Study of Autonomous Vehicle Bugs. By Joshua Garcia, Yang Feng, Junjie Shen, Sumaya Almanee, Yuan Xia, and Qi Alfred Chen. In ICSE 2020.

• Required reading:
  A Longitudinal, End-to-End View of the DNSSEC Ecosystem. By Taejoon Chung, Roland van Rijswijk-Deij, Balakrishnan Chandrasekaran, David Choffnes, Dave Levin, Bruce M. Magggs, Alan Mislove, and Christo Wilson. In USENIX 2017.
• Optional reading:
  Global Measurement of DNS Manipulation. By Paul Pearce, Ben Jones, Frank Li, Roya Ensafi, Nick Feamster, Nick Weaver, and Vern Paxson. In USENIX 2017.

• Required reading:
  Tor: The Second-Generation Onion Router. By Roger Dingledine, Nick Nathewson, and Paul Syverson. In USENIX 2004.
• Optional reading:
  Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries. By Aaron Johnson, Chris Wacek, Rob Jansen, Micah Sherr, and Paul Syverson. In CCS 2013.

• Required reading:
  Understanding the Mirai Botnet. By Manos Antonakakis, Tim April, Michael Bailey, Matthew Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. In USENIX 2017.

• Required reading:
  Bitcoin: A Peer-to-Peer Electronic Cash System. By "Satoshi Nakamoto" (pseudonym). This is the original Bitcoin whitepaper.