Publications on Security

• 2007:
  • OmniUnpack: Fast, Generic, and Safe Unpacking of Malware, Lorenzo Martignoni, Mihai Christodorescu, and Somesh Jha, Twenty-Third Annual Computer Security Applications Conference (ACSAC), Miami Beach, FL, December 2007.
  • Mining Specifications of Malicious Behavior, Mihai Christodorescu, Somesh Jha, and Christopher Kruegel, Sixth joint meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE 2007), September 3-7, 2007, Dubrovnik, Croatia.
       ACM SIGSOFT Distinguished Paper
    
  • Creating Vulnerability Signatures Using Weakest Pre-conditions, David Brumley, Hao Wang, Somesh Jha and Dawn Song, 20th IEEE Computer Security Foundations Symposium (CSF), July 2007.
  • Microdrivers: A New Architecture for Device Drivers Vinod Ganapathy, Arini Balakrishnan, Michael M. Swift, and Somesh Jha, 11th Workshop on Hot Topics in Operating Systems, San Diego, California, May 2007.
  • Mining Security-sensitive Operations in Legacy Code using Concept Analysis Vinod Ganapathy, David King, Trent Jaeger, and Somesh Jha, 29th International Conference on Software Engineering , Minneapolis, Minnesota, May 2007.
  • Enforcing Semantic Integrity on Untrusted Clients in Networked Virtual Environments (Extended abstract), Somesh Jha, Stefan Katzenbeisser, Christian Schallhart, Helmut Veith and Stephen Chenney, IEEE Symposium on Security and Privacy, Oakland, California, May 2007.
  • A Semantics-Based Approach to Malware Detection, Mila Dalla Preda, Mihai Christodorescu, Saumya Debray, and Somesh Jha, Symposium on Principles of Programming Languages (POPL), Nice, France, January 2007.
• 2006:
  • Backtracking Algorithmic Complexity Attacks Against a NIDS, Randy Smith, Cristian Estan, and Somesh Jha, Twenty-Second Annual Computer Security Applications Conference (ACSAC), Miami Beach, FL, December 2006.
  • NetSpy: Automatic Generation of Spyware Signatures for NIDS, Hao Wang, Somesh Jha, and Vinod Ganapathy, Twenty-Second Annual Computer Security Applications Conference (ACSAC), Miami Beach, FL, December 2006.
  • Protomatching Network Traffic for High Throughput Network Intrusion Detection, S. Rubin, S. Jha, and B. Miller, 13th ACM Conference on Computer and Communications Security, Alexandria, Virginia, November 2006.
  • Secure Function Evaluation with Ordered Binary Decision Diagrams, Eu-Jin Goh, Louis Kruger, Dan Boneh, and Somesh Jha, 13th ACM Conference on Computer and Communications Security, Alexandria, Virginia, November 2006.
  • Automated Discovery of Mimicry Attacks, J.T. Giffin. S. Jha, and B. Miller, In 9th International Symposium on Recent Advances in Intrusion Detection (RAID), Hamburg, Germany, September 2006.
    To download the paper please click here.
  • Reducing the Dependence of SPKI/SDSI on PKI, Hao Wang, Somesh Jha, Thomas Reps, Stefan Schwoon and Stuart Stubblebine, 11th European Symposium On Research In Computer Security (ESORICS), Hamburg, Germany, September 2006.
    To download the paper please click here.
  • On the Completeness of Attack Mutation Algorithms, Shai Rubin, Somesh Jha, and Bart Miller 19th IEEE Computer Security Foundations Workshop (CSFW), July 2006.
    To download the paper please click here.
  • Distributed Model-Checking Algorithms for WPDS with Applications to Trust-Management Systems, Somesh Jha, Stefan Schwoon, Hao Wang and Somesh Jha Tools and Algorithms for the Construction and Analysis of Systems, March 2006.
    Note: This was an invited paper.
    To download the paper please click here.
  • Towards Automated Authorization Policy Enforcement, Vinod Ganapathy, Trent Jaeger, and Somesh Jha. Second Annual Security Enhanced Linux Symposium, March 2006.
    To download the paper please click here.
  • Towards Automatic Generation of Vulnerability-Based Signatures, David Brumley, James Newsome, Dawn Song, Hao Wang, and Somesh Jha IEEE Symposium on Security and Privacy, Oakland, California, May 2006.
    To download the paper please click here.
  • Retrofitting Legacy Code for Authorization Policy Enforcement, Vinod Ganapathy, Trent Jaeger and Somesh Jha IEEE Symposium on Security and Privacy, Oakland, California, May 2006.
    To download the paper please click here.
• 2005:
  • Vinod Ganapathy, Sanjit A. Seshia, Somesh Jha, Thomas W. Reps, and Randal E. Bryant, Automatic Discovery of API-Level Exploits, 27th International Conference on Software Engineering (ICSE), St. Louis, Missouri, May 2005.
    To download the paper please click here.
  • Shai Rubin, Somesh Jha, Bart Miller, Language-Based Generation and Evaluation of NIDS Signatures IEEE Symposium on Security and Privacy, Oakland, California, May 2005.
    To download the paper please click here.
  • Mihai Christodorescu, Sanjit Seshia, Somesh Jha, Dawn Song, Randal E. Bryant, Semantics-Aware Malware Detection, IEEE Symposium on Security and Privacy, Oakland, California, May 2005.
    To download the paper please click here.
  • Vinod Yegneswaran, Jonathon T. Giffin, Paul Barford, and Somesh Jha, An architecture for generating semantics-aware signatures, In 14th USENIX Security Symposium, Baltimore, Maryland, August 2005.
    To download the paper please click here.
  • Jonathon T. Giffin, David Dagon, Somesh Jha, Wenke Lee, and Barton P. Miller, Environment-sensitive intrusion detection, In 8th International Symposium on Recent Advances in Intrusion Detection (RAID), Seattle, Washington, September 2005.
    To download the paper please click here.
  • S. Jha, L. Kruger and P. McDaniel, Privacy Preserving Clustering 10th European Symposium On Research In Computer Security (ESORICS), Milan, Italy - September 12 - 14, 2005.
    To download the paper please click here.
  • Vinod Ganapathy, Trent Jaeger, and Somesh Jha, Automatic Placement of Authorization Hooks in the Linux Security Modules Framework, 12th ACM Conference on Computer and Communications Security, Alexandria, Virginia, November 2005.
    To download the paper please click here.
  • Muthian Sivathanu, Andrea C. Arpaci-Dusseau, Remzi H. Arpaci-Dusseau, and Somesh Jha. A Logic of File Systems 4th Usenix Conference on File and Storage Technologies (FAST 05), Dec 14, 2005.
    To download the paper please click here.
• 2004:
  • Jon Giffin, Somesh Jha and Bart Miller, Efficient Context-Sensitive Intrusion Detection, The 11th Annual Network and Distributed System Security Symposium (NDSS) , February, 2004.
    To download the paper please click here.
  • Vinod Yegneswaran, Paul Barford, and Somesh Jha, Global Intrusion Detection in the DOMINO Overlay System, The 11th Annual Network and Distributed System Security Symposium (NDSS) , February, 2004.
    To download the paper please click here.
  • Henry Hanping Feng, Jonathon T. Giffin, Yong Huang, Somesh Jha, Wenke Lee, and Barton P. Miller. Formalizing Sensitivity in Static Analysis for Intrusion Detection. IEEE Symposium on Security and Privacy, Oakland, California, May 2004.
    To download the paper please click here.
  • H.B. Wang, S. Jha, P.D. McDaniel, M. Livny, Security Policy Reconciliation in Distributed Computing Environments, IEEE 5th International Workshop on Policies for Distributed Systems and Networks (POLICY), June 7-9, 2004.
    To download the paper please click here.
  • M. Christodorescu and S. Jha, Testing Malware Detectors, International Symposium on Software Testing and Analysis (ISSTA 2004), July 11-14, 2004.
    To download the paper please click here.
       ACM SIGSOFT Distinguished Paper
    
  • S. Rubin, S. Jha, and B. Miller, Automatic generation and analysis of NIDS attacks, Annual Computer Security Applications Conference (ACSAC), December 6-10, 2004.
    To download the paper please click here.
       This paper won the best student paper and best paper award.
    
• 2003:
  • J. Giffin, S. Jha, and B. Miller, Detecting Manipulated Remote Call Streams, Usenix Security Symposium, August 2002.
    To download the paper please click here.
  • Edmund Clarke, Somesh Jha, Will Marrero, Efficient verification of security protocols using partial-order reductions, International Journal on Software Tools for Technology Transfer (STTT), Volume 4, Number 2, February 2003.
  • S. Schwoon, S. Jha, T. Reps, and S. Stubblebine, On generalized authorization problems, 16th IEEE Computer Security Foundations Workshop, (June 30 - July 2, 2003, Asilomar, Pacific Grove, CA).
    To download the paper please click here.
  • M. Christodorescu and S. Jha, Static Analysis of Executables to Detect Malicious Patterns, Usenix Security Symposium, August 2003.
    To download the paper please click here.
  • Vinod Ganapathy, Somesh Jha, David Chandler, David Melski and David Vitek, Buffer Overrun Detection using Linear Programming and Static Analysis, 10th ACM Conference on Computer and Communications Security (CCS), October 2003,
    To download the paper please click here.
• 2002:
  • O. Sheyner, J. Haines, S. Jha, R. Lippman, and J.M. Wing, Automated Generation and Analysis of Attack Graphs, IEEE Symposium on Security and Privacy, April 2002.
    To download the paper please click here.
  • S. Jha, O. Sheyner, and J.M. Wing, Two formal Analyses of Attack Graphs, Computer Security Foundations Workshop (CSFW), June 2002.
    To download the paper please click here.
  • S. Jha and T. Reps, Analysis of SPKI/SDSI Certificates Using Model Checking, Computer Security Foundations Workshop (CSFW), June 2002.
    To download the paper please click here.
• 2001 and earlier
  • E.M. Clarke, S. Jha, and W. Marrero, Using state space exploration and a natural deduction style message derivation engine to verify security protocols, IFIP Working Conference on Programming Concepts and Methods (PROCOMET), June 1998.
  • E.M. Clarke, S. Jha, and W. Marrero, Partial Order Reductions for Security Protocol Verification, Tools and Algorithms for Construction and Analysis of Systems (TACAS), April 2000.
  • E.M. Clarke, S. Jha, and W. Marrero, Verifying Security Protocols with Brutus, ACM Transactions in Software Engineering Methodology (TOSEM), Volume 9, Number 4, 2000.
  • S. Jha, R. Linger, T. Longstaff, and J. Wing, Survivability Analysis of Network Specifications,Workshop on Depenedability Despite Malicious Faults, International Conference on Dependable Systems and Networks (DSN), June 2000.
  • S. Jha and J. Wing, Survivability Analysis of Networked Systems, International Conference on Software Engineering (ICSE), May 2001.
    To download the paper please click here.
  • S. Jha, K. Tan, and R. Maxion, Markov chains, Classifiers, and Intrusion Detection, Computer Security Foundations Workshop (CSFW), June 2001.
    To download the paper please click here.