THREAT DETECTION AND DEFENSES
Attack-detection mechanisms should be able to reliably detect, predict, and comprehensibly explain both known and novel threats, while also being able to cope with evasion techniques – like obfuscation, polymorphism, or stealth low-volume attacks.
To proactively understand potential attacks on complex IT systems, we need to perform a comprehensive threat analysis of possible attack vectors. Based on this knowledge, we can develop novel methods to reliably detect, predict, and comprehensibly explain known and emerging threats to IT systems. Such threat detection mechanisms must also be able to cope with evasion techniques such as obfuscation or low-level covert attacks. The resulting detection mechanisms should not only be able to detect every critical incident, but also raise alarms only when necessary. The more false alarms that are triggered, the higher the risk that users will ignore the warnings or even permanently disable detection mechanisms.
To create a strong line of defense, attack detection methods should be complemented by appropriate defense methods, ideally chosen autonomously by the attacked system to counter any threat it encounters. In this research area, we pursue this ideal in a variety of ways, for example, by focusing on identifying and mitigating novel system vulnerabilities, developing new methods for software security of complex systems, or novel side-channel attacks and defenses at different system levels.
IEEE Symposium on Security and Privacy (S&P) Zepade Attacks: Exploiting Zero-Page Deduplication for Side-Channel Attacks
International Workshop on Trustworthy and Responsible aUtonomous SysTems(TRUST) Can Open-Weight LLMs Predict Test Outcomes from Traces? A Cross-Subject Boundary Study on Tests4Py
International Workshop on Reliable and trustworthy Automated Software Engineering(RASE) How Grammar-Based Synthetic Data Shapes Behavior Learning: An Empirical Study of Input Generation Strategies
