S2Lab · Systems Security Research Lab HOME RESEARCH TEAM CONTACT Toggle navigation "Towards the pursuit of academic excellence through disruptive thinking" —S2Lab's motto Systems Security Research Lab The Systems Security Research Lab (S2Lab) sits in the Information Security Research Group of the Department of Computer Science at University College London (UCL). Our vision is to develop techniques that automatically protect systems from vulnerabilities and malicious activities. Certainly, this is a broad remit, so let’s narrow the scope a bit. We work at the intersection of program analysis and machine learning for systems security. Ah, the buzzwords. It may be tempting to believe we’re just following the machine learning/cybersecurity hype, but that would be untrue. In fact our motivation can be traced back to two particular research efforts from the underground hacker and academic security communities which touched on these topics: Smashing the stack for fun and profit, one of the very first attempts to discuss the details of low-level systems security through the lens of the exploitation of memory corruption vulnerabilities; and Intrusion Detection via Static Analysis, one of the very first attempts to combine (static) program analysis with anomaly detection. Since these works, we’ve always been intrigued by the role these disciplines play to secure our systems. The democratization of machine learning approaches has clearly increased our appetite further to reason about how program analysis and machine learning can intertwine in order to improve systems security in the presence of adversaries. Ultimately, we aim to build practical tools and provide security services to the community at large, while supporting open science. We are thankful to the several sponsors who have funded our research, including UKRI EPSRC, EU, GCHQ/NCSC, Intel Security, NVIDIA Corporation, and AVAST Software. Moreover, we are eternally grateful to the many collaborators whom we have been working with or have provided opportunities for cross-pollination to influence, inspire, and further refine our research vision. We are committed to pursuing academic excellence while embracing disruptive thinking at its best. Latest News December 2021: Our work "Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift" has been accepted to IEEE S&P 2022! November 2021: Feargus Pendlebury has passed his PhD viva with no corrections, with a thesis titled "Machine Learning for Security in Hostile Environments", congrats! August 2021: Lorenzo and S2Lab join the Information Security Research Group at UCL Computer Science, yay! July 2021: Dos and Don't of Machine Learning for Computer Security is accepted at USENIX Security 2022. Kudos to our wonderful international collaborators. We love you, but you know that! June 2021: Federico Barbero will be joining King's College at the University of Cambridge to pursue an MPhil in Machine Learning and Machine Intelligence. Go Federico and make us even prouder than we're already are! Selected Publications Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro IEEE S&P · 43rd IEEE Symposium on Security and Privacy, 2022 @inproceedings{barbero2022transcendent, author = {Federico Barbero and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro}, title = {Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift}, booktitle = {{IEEE} Symposium on Security and Privacy}, year = {2022}, } Dos and Don'ts of Machine Learning in Computer Security Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, Konrad Rieck USENIX Sec · 31st USENIX Security Symposium, 2022 @inproceedings{arp2022dodo, author = {Daniel Arp and Erwin Quiring and Feargus Pendlebury and Alexander Warnecke and Fabio Pierazzi and Christian Wressnegger and Lorenzo Cavallaro and Konrad Rieck}, title = {Dos and Don'ts of Machine Learning in Computer Security}, booktitle = {31st USENIX Security Symposium}, year = {2022}, } Investigating Labelless Drift Adaptation for Malware Detection Zeliang Kan and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021 @inproceedings{kan2021adaptation, author = {Zeliang Kan and Feargus Pendlebury and Fabio Pierazzi and Lorenzo Cavallaro}, title = {Investigating Labelless Drift Adaptation for Malware Detection}, booktitle = {{ACM} Workshop on Artificial Intelligence and Security ({AISec})}, year = {2021}, } INSOMNIA: Towards Concept-Drift Robustness in Network Intrusion Detection Giuseppina Andresini and Feargus Pendlebury and Fabio Pierazzi and Corrado Loglisci and Annalisa Appice and Lorenzo Cavallaro AISec · 14th ACM Workshop on Artificial Intelligence and Security, 2021 @inproceedings{andresini2021insomnia, author = {Giuseppina Andresini and Feargus Pendlebury and Fabio Pierazzi and Corrado Loglisci and Annalisa Appice and Lorenzo Cavallaro}, title = {{INSOMNIA}: Towards Concept-Drift Robustness in Network Intrusion Detection}, journal = {{ACM} Workshop on Artificial Intelligence and Security ({AISec})}, year = {2021}, } Universal Adversarial Perturbations for Malware Raphael Labaca-Castro, Luis Muñoz-González, Feargus Pendlebury, Gabi Dreo Rodosek, Fabio Pierazzi, Lorenzo Cavallaro CoRR · arXiv CoRR, 2021 @article{labacacastro2021uaps, author = {Raphael Labaca-Castro and Luis Muñoz-González and Feargus Pendlebury and Gabi Dreo Rodosek and Fabio Pierazzi and Lorenzo Cavallaro}, title = {Universal Adversarial Perturbations for Malware}, journal = {CoRR}, volume = {abs/2102.06747}, year = {2021}, url = {http://arxiv.org/abs/2102.06747}, eprint = {2102.06747}, archivePrefix = {arXiv} } Probabilistic Naming of Functions in Stripped Binaries James Patrick-Evans, Lorenzo Cavallaro, Johannes Kinder ACSAC · Annual Computer Security Applications Conference, 2020 @inproceedings{patrickevans2020punstrip, author = {James Patrick-Evans and Lorenzo Cavallaro and Johannes Kinder}, title = {Probabilistic Naming of Functions in Stripped Binaries}, booktitle = {Annual Computer Security Applications Conference (ACSAC)}, year = {2020}, } Intriguing Properties of Adversarial ML Attacks in the Problem Space Fabio Pierazzi*, Feargus Pendlebury*, Jacopo Cortellazzi, Lorenzo Cavallaro IEEE S&P · 41st IEEE Symposium on Security and Privacy, 2020 @inproceedings{pierazzi2020problemspace, author = {Fabio Pierazzi and Feargus Pendlebury and Jacopo Cortellazzi and Lorenzo Cavallaro}, booktitle = {2020 IEEE Symposium on Security and Privacy (SP)}, title = {Intriguing Properties of Adversarial ML Attacks in the Problem Space}, year = {2020}, volume = {}, issn = {2375-1207}, pages = {1308-1325}, doi = {10.1109/SP40000.2020.00073}, url = {https://doi.ieeecomputersociety.org/10.1109/SP40000.2020.00073}, publisher = {IEEE Computer Society}, } TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time Feargus Pendlebury*, Fabio Pierazzi*, Roberto Jordaney, Johannes Kinder, and Lorenzo Cavallaro USENIX Sec · 28th USENIX Security Symposium, 2019 @inproceedings{pendlebury2019tesseract, author = {Feargus Pendlebury and Fabio Pierazzi and Roberto Jordaney and Johannes Kinder and Lorenzo Cavallaro}, title = {{TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time}}, booktitle = {28th USENIX Security Symposium}, year = {2019}, address = {Santa Clara, CA}, publisher = {USENIX Association}, note = {USENIX Sec} } Transcend: Detecting Concept Drift in Malware Classification Models Roberto Jordaney, Kumar Sharad, Santanu K. Dash, Zhi Wang, Davide Papini, Ilia Nouretdinov, and Lorenzo Cavallaro USENIX Sec · 26th USENIX Security Symposium, 2017 @inproceedings {jordaney2017, author = {Roberto Jordaney and Kumar Sharad and Santanu K. Dash and Zhi Wang and Davide Papini and Ilia Nouretdinov and Lorenzo Cavallaro}, title = {{Transcend: Detecting Concept Drift in Malware Classification Models}}, booktitle = {26th USENIX Security Symposium}, year = {2017}, address = {Vancouver, BC}, url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/jordaney}, publisher = {USENIX Association}, note = {USENIX Sec} } Modular Synthesis of Heap Exploits Dusan Repel, Johannes Kinder, and Lorenzo Cavallaro ACM CCS-PLAS · ACM SIGSAC Workshop on Programming Languages and Analysis for Security, 2017 @inproceedings{plas2017, author = {Dusan Repel and Johannes Kinder and Lorenzo Cavallaro}, title = {Modular Synthesis of Heap Exploits}, booktitle = {Proc. ACM SIGSAC Workshop on Programming Languages and Analysis for Security (PLAS 2017)}, year = 2017, note = {ACM CCS-PLAS} } CopperDroid: Automatic Reconstruction of Android Malware Behaviors Kimberly Tam, Salahuddin J. Khan, Aristide Fattori, and Lorenzo Cavallaro NDSS · 22nd Annual Network and Distributed System Security Symposium, 2015 @InProceedings{copperdroid-ndss2015, author = {Kimberly Tam, Salahuddin J. Khan, Aristide Fattori, and Lorenzo Cavallaro}, title = {{CopperDroid: Automatic Reconstruction of Android Malware Behaviors}}, booktitle = {22nd Annual Network and Distributed System Security Symposium, San Diego, California, USA}, year = 2015, month = {February}, note = {NDSS} } © 2020 S2Lab ─ made with Jekyll We are part of the Department of Computer Science at University College London. 169 Euston Road London, NW1 2AE, UK Directions
