Dersler sayfasına geri dönüş

CMP 656: Advanced Computer and Network Security

Fall 2026

Instructor: Ahmet Burak CAN
Course Hours: Tuesday, 13:00-16:00
Classroom: Computer Enginering, D5

Course Description

The aim of this course is to study active research topics in computer and network security and to provide students with a research background in the field of security.

Course Resources

Course resources are the articles announced from this page to be read and presented during the semester.

Grading

Reading assignments - 20%
Paper presentations - 15%
Project - 25%
Final Exam - 35%
Attendance - 5%

Course Outline

Reading Assignments
  • In some weeks, a scientific paper will be assigned as a reading assignment. All students taking the course are responsible for reading this paper and writing a summary.
  • Paper summaries must be loaded in .pdf/.doc format to the submit system of the department (http://submit.cs.hacettepe.edu.tr ) before the class time.
  • In the paper summary, the aim, method and results of the study will be summarized in a few pages (in English). Also related to the article, at least one positive point, at least one negative point, and at least one future work direction should be given.
Paper Presentations
  • Each week, 2-3 students will present the related articles of the week in class. Each presentation will take 30-40 minutes
  • In these presentations, the aim, method, and results of the article should be explained and discussed with enough details.
  • After each week's presentations, the presenters must submit the presentation files in .ppt/.pptx format to the submit system (http://submit.cs.hacettepe.edu.tr ).
Project
  • Students, in groups of 2-3 people, should do a research project on active security research issues.
  • Report format should confirm to IEEE template.
  • Project reports are sent to the department's submit system (http://submit.cs.hacettepe.edu.tr) within the last week of the semester.
Final Exam
  • In the final exam, questions will be asked from the reading assignments.

Communication

  • All class communication will be done via Piazza CMP656 communication group. Please register to this group on Piazza.com


    WeekSubjectReading/Presentation Assignment
    Sep 22 Information about course outline Reading and evaluating articles:
    Preparing successful presentations:
    Watch List:
    • Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., ... & Zhou, Y. (2017). Understanding the mirai botnet. In 26th {USENIX} security symposium ({USENIX} Security 17) (pp. 1093-1110). USENIX Security 2017
    Sep 29 Some examples of Recent Security Research Watch List:
    • Fayaz, S. K., Tobioka, Y., Sekar, V., & Bailey, M. (2015). Bohatei: Flexible and elastic ddos defense. In 24th {USENIX} Security Symposium ({USENIX} Security 15) (pp. 817-832).     USENIX 2015
    • Zeng, E., & Roesner, F. (2019). Understanding and improving security and privacy in multi-user smart homes: a design exploration and in-home user study. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 159-176).     USENIX 2019
    • Oest, A., Zhang, P., Wardman, B., Nunes, E., Burgis, J., Zand, A., ... & Ahn, G. J. (2020). Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale. In 29th {USENIX} Security Symposium ({USENIX} Security 20).     USENIX 2020
    • Melicher, William, Blase Ur, Sean M. Segreti, Saranga Komanduri, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. "Fast, lean, and accurate: Modeling password guessability using neural networks." In 25th USENIX Security Symposium (USENIX Security 16), pp. 175-191. 2016.     USENIX 2016
    Oct 6 Some examples of Recent Security Research Watch List:
    • Possemato, A., Lanzi, A., Chung, S. P. H., Lee, W., & Fratantonio, Y. (2018, January). Clickshield: Are you hiding something? Towards eradicating clickjacking on Android. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (pp. 1120-1136).     ACM CCS 2018
    • Tang, Adrian, Simha Sethumadhavan, and Salvatore Stolfo. "{CLKSCREW}: Exposing the perils of {Security-Oblivious} energy management." In 26th USENIX Security Symposium (USENIX Security 17), pp. 1057-1074. 2017.    USENIX 2017
    • Wang, B., Yao, Y., Viswanath, B., Zheng, H., & Zhao, B. Y. (2018). With great training comes great vulnerability: Practical attacks against transfer learning. In 27th {USENIX} Security Symposium ({USENIX} Security 18) (pp. 1281-1297).     USENIX 2018
    • Bagdasaryan, Eugene, Rishi Jha, Vitaly Shmatikov, and Tingwei Zhang. "Adversarial illusions in {Multi-Modal} embeddings." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 3009-3025. 2024.     USENIX 2024
    • Alhuzali, Abeer, Rigel Gjomemo, Birhanu Eshete, and V. N. Venkatakrishnan. "{NAVEX}: Precise and scalable exploit generation for dynamic web applications." In 27th USENIX Security Symposium (USENIX Security 18), pp. 377-392. 2018.,     USENIX 2018
    Oct 13 Network Security Reading Assignment 1:
    Nguyen, H. V., Iacono, L. L., & Federrath, H. (2019, November). Your cache has fallen: Cache-poisoned denial-of-service attack. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (pp. 1915-1936).

    Presentation Papers:
    • Presenter: Damla Oksal
      Zheng, Xiaofeng, Chaoyi Lu, Jian Peng, Qiushi Yang, Dongjie Zhou, Baojun Liu, Keyu Man, Shuang Hao, Haixin Duan, and Zhiyun Qian. "Poison over troubled forwarders: A cache poisoning attack targeting {DNS} forwarding devices." In 29th USENIX Security Symposium (USENIX Security 20), pp. 577-593. 2020.
    • Presenter: Kaan Mutluer
      Man, K., Zhou, X. A., & Qian, Z. (2021, November). DNS cache poisoning attack: Resurrections with side channels. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 3400-3414).
    Watch List:
    • Niakanlahiji, A., Wei, J., Alam, M. R., Wang, Q., & Chu, B. T. (2020). Shadowmove: A stealthy lateral movement strategy. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 559-576). USENIX Security 2020
    • Li, Y., Chen, Z., Cao, J., Xu, Z., Peng, Q., Chen, H., ... & Cheung, S. C. (2021). ReDoSHunter: A Combined Static and Dynamic Approach for Regular Expression DoS Detection. In 30th {USENIX} Security Symposium ({USENIX} Security 21) (pp. 3847-3864). USENIX Security 2021
    • Li, Y., Li, H., Lv, Z., Yao, X., Li, Q., & Wu, J. (2021, November). Deterrence of Intelligent DDoS via Multi-Hop Traffic Divergence. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 923-939). ACM CCS 2021
    • Rizvi, A. S. M., Leandro Bertholdo, João Ceron, and John Heidemann. "Anycast Agility: Network Playbooks to Fight {DDoS}." In 31st USENIX Security Symposium (USENIX Security 22), pp. 4201-4218. 2022. USENIX Security 2022
    • McLaughlin, Robert, Fabio Pagani, Noah Spahn, Christopher Kruegel, and Giovanni Vigna. "Regulator: Dynamic Analysis to Detect {ReDoS}." In 31st USENIX Security Symposium (USENIX Security 22), pp. 4219-4235. 2022. USENIX Security 2022
    • Liu, Zaoxing, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. "Jaqen: A {High-Performance}{Switch-Native} approach for detecting and mitigating volumetric {DDoS} attacks with programmable switches." In 30th USENIX Security Symposium (USENIX Security 21), pp. 3829-3846. 2021. USENIX Security 2021
    Oct 20Network Security Presentation Papers:
    • Presenter: Ahmet Semih Temizkaya
      Mathews, N., Holland, J. K., Oh, S. E., Rahman, M. S., Hopper, N., & Wright, M. (2023, May). Sok: A critical evaluation of efficient website fingerprinting defenses. In 2023 IEEE Symposium on Security and Privacy (SP) (pp. 969-986). IEEE.
    • Presenter: Ahmet Hakan Yıldız
      Alcoz, Albert Gran, Martin Strohmeier, Vincent Lenders, and Laurent Vanbever. "Aggregate-based congestion control for pulse-wave DDoS defense." In Proceedings of the ACM SIGCOMM 2022 Conference, pp. 693-706. 2022.
    • Presenter: Ataberk Yavuzyaşar
      Rye, E. C., & Beverly, R. (2023, May). IPvSeeYou: Exploiting leaked identifiers in IPv6 for street-level geolocation. In 2023 IEEE Symposium on Security and Privacy (SP) (pp. 3129-3145). IEEE.
    Watch List:
    • Chung, Taejoong, Roland van Rijswijk-Deij, Balakrishnan Chandrasekaran, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, and Christo Wilson. "A Longitudinal,{End-to-End} View of the {DNSSEC} Ecosystem." In 26th USENIX Security Symposium (USENIX Security 17), pp. 1307-1322. 2017. USENIX Security 2017
    • Stevens, Rock, Daniel Votipka, Elissa M. Redmiles, Colin Ahern, Patrick Sweeney, and Michelle L. Mazurek. "The battle for New York: A case study of applied digital threat modeling at the enterprise level." In 27th USENIX Security Symposium (USENIX Security 18), pp. 621-637. 2018. USENIX Security 2018
    • Yoo, Sophia, Xiaoqi Chen, and Jennifer Rexford. "{SmartCookie}: Blocking {Large-Scale}{SYN} Floods with a {Split-Proxy} Defense on Programmable Data Planes." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 217-234. 2024. USENIX Security 2024
    • Barua, A., & Al Faruque, M. A. (2020). Hall spoofing: A non-invasive dos attack on grid-tied solar inverter. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 1273-1290). USENIX Security 2020
    • Xing, J., Wu, W., & Chen, A. (2021). Ripple: A Programmable, Decentralized Link-Flooding Defense Against Adaptive Adversaries. In 30th {USENIX} Security Symposium ({USENIX} Security 21). USENIX Security 2021
    • Pan, Yepeng, Anna Ascheman, and Christian Rossow. "Loopy Hell (ow):{Infinite} Traffic Loops at the Application Layer." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 235-252. 2024. USENIX Security 2024
    • Afek, Y., Bremler-Barr, A., & Shafir, L. (2020). NXNSAttack: Recursive {DNS} Inefficiencies and Vulnerabilities. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 631-648).USENIX Security 2020
    • Izhikevich, Liz, Renata Teixeira, and Zakir Durumeric. "{LZR}: Identifying Unexpected Internet Services." 30th {USENIX} Security Symposium ({USENIX} Security 21). 2021. USENIX Security 2021
    • Dai, T., Jeitner, P., Shulman, H., & Waidner, M. (2021). The Hijackers Guide To The Galaxy: Off-Path Taking Over Internet Resources. Technical Report. USENIX Security 2021
    • Ma, Jinrui, Lutong Chen, Kaiping Xue, Bo Luo, Xuanbo Huang, Mingrui Ai, Huanjie Zhang, David SL Wei, and Yan Zhuang. "{FakeBehalf}: Imperceptible Email Spoofing Attacks against the Delegation Mechanism in Email Systems." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 1243-1260. 2024. USENIX Security 2024
    Oct 27Web Security Reading Assignment 2:
    Panchenko, A., Lanze, F., Pennekamp, J., Engel, T., Zinnen, A., Henze, M., & Wehrle, K. (2016, February). Website Fingerprinting at Internet Scale. In NDSS.

    Presentation Papers:
    • Presenter: İbrahim Köse
      Kondracki, B., Azad, B. A., Starov, O., & Nikiforakis, N. (2021, November). Catching transparent phish: Analyzing and detecting mitm phishing toolkits. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 36-50).
    • Presenter: Ali Burak Pekışık
      Eriksson, B., Pellegrino, G., & Sabelfeld, A. (2021, May). Black widow: Blackbox data-driven web scanning. In 2021 IEEE Symposium on Security and Privacy (SP) (pp. 1125-1142). IEEE.
    • Presenter: Merve Nur Fırat
      Fass, A., Somé, D. F., Backes, M., & Stock, B. (2021, November). Doublex: Statically detecting vulnerable data flows in browser extensions at scale. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 1789-1804).
    Watch List:
    • Staicu, C. A., & Pradel, M. (2019). Leaky images: Targeted privacy attacks in the web. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 923-939). USENIX Security 2019
    • Azad, B. A., Laperdrix, P., & Nikiforakis, N. (2019). Less is more: quantifying the security benefits of debloating web applications. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 1697-1714). USENIX Security 2019
    • Mirheidari, S. A., Arshad, S., Onarlioglu, K., Crispo, B., Kirda, E., & Robertson, W. (2020). Cached and confused: Web cache deception in the wild. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 665-682). USENIX Security 2020
    • Gong, Jiajun, and Tao Wang. "Zero-delay lightweight defenses against website fingerprinting." 29th {USENIX} Security Symposium ({USENIX} Security 20). 2020. USENIX Security 2020
    • Xiao, F., Huang, J., Xiong, Y., Yang, G., Hu, H., Gu, G., & Lee, W. (2021). Abusing Hidden Properties to Attack the Node. js Ecosystem. In 30th {USENIX} Security Symposium ({USENIX} Security 21). USENIX Security 2021
    • Stafeev, Aleksei, and Giancarlo Pellegrino. "{SoK}: State of the Krawlers–Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 719-737. 2024.USENIX Security 2024
    • Zhang, M., Meng, W., Lee, S., Lee, B., & Xing, X. (2019). All your clicks belong to me: investigating click interception on the web. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 941-957). USENIX Security 2019 USENIX Security 2019
    • Yang, G., Huang, J., & Gu, G. (2019). Iframes/popups are dangerous in mobile webview: studying and mitigating differential context vulnerabilities. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 977-994).USENIX Security 2019 USENIX Security 2019
    • Cherubin, Giovanni, Rob Jansen, and Carmela Troncoso. "Online website fingerprinting: Evaluating website fingerprinting attacks on tor in the real world." In 31st USENIX Security Symposium (USENIX Security 22), pp. 753-770. 2022. USENIX Security 2022
    • Bock, Kevin, Abdulrahman Alaraj, Yair Fax, Kyle Hurley, Eric Wustrow, and Dave Levin. "Weaponizing middleboxes for {TCP} reflected amplification." In 30th USENIX Security Symposium (USENIX Security 21), pp. 3345-3361. 2021. USENIX Security 2021
    Nov 3Mobile Security Reading Assignment 3:
    Arzt, Steven, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. "Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps." ACM sigplan notices 49, no. 6 (2014): 259-269.

    Presentation Papers:
    • Presenter: Ercan Coş
      Milajerdi, Sadegh M., Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and V. N. Venkatakrishnan. "Holmes: real-time apt detection through correlation of suspicious information flows." In 2019 IEEE symposium on security and privacy (SP), pp. 1137-1152. IEEE, 2019.
    • Presenter: Hayrullah Alper
      Gamba, J., Rashed, M., Razaghpanah, A., Tapiador, J., & Vallina-Rodriguez, N. (2020, May). An analysis of pre-installed android software. In 2020 IEEE symposium on security and privacy (SP) (pp. 1039-1055). IEEE.
    • Presenter: Eren Demiralay
      Kim, Jinsung, Younghoon Ban, Eunbyeol Ko, Haehyun Cho, and Jeong Hyun Yi. "MAPAS: a practical deep learning-based android malware detection system." International Journal of Information Security 21, no. 4 (2022): 725-738.

    Watch List:
    • Possemato, A., & Fratantonio, Y. (2020). Towards {HTTPS} Everywhere on Android: We Are Not There Yet. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 343-360).USENIX Security 2020
    • Andow, B., Mahmud, S. Y., Wang, W., Whitaker, J., Enck, W., Reaves, B., ... & Xie, T. (2019). Policylint: investigating internal privacy policy contradictions on Google play. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 585-602).USENIX Security 2019
    • Chakraborty, D., Hanzlik, L., & Bugiel, S. (2019). simTPM: User-centric {TPM} for Mobile Devices. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 533-550).USENIX Security 2019
    • Chen, J., Hengartner, U., Khan, H., & Mannan, M. (2020). Chaperone: Real-time Locking and Loss Prevention for Smartphones. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 325-342).USENIX Security 2020
    • Reardon, J., Feal, Á., Wijesekera, P., On, A. E. B., Vallina-Rodriguez, N., & Egelman, S. (2019). 50 ways to leak your data: An exploration of apps' circumvention of the android permissions system. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 603-620).USENIX Security 2019
    • Elsabagh, M., Johnson, R., Stavrou, A., Zuo, C., Zhao, Q., & Lin, Z. (2020). FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware. In 29th {USENIX} Security Symposium ({USENIX} Security 20).USENIX Security 2020
    Nov 10Mobile Security Presentation Papers:
    • Presenter: Ezzaldeen Ehab Abdelrahman Younis
      Bui, D., Yao, Y., Shin, K. G., Choi, J. M., & Shin, J. (2021, November). Consistency analysis of data-usage purposes in mobile apps. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (pp. 2824-2843).
    • Presenter: Ali Akkaya
      Yang, Y., Zhang, Y., & Lin, Z. (2022, November). Cross miniapp request forgery: Root causes, attacks, and vulnerability detection. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (pp. 3079-3092).
    • Presenter: Akın Eren Gündüz
      Zhang, Y., Yang, Y., & Lin, Z. (2023, November). Don't leak your keys: Understanding, measuring, and exploiting the appsecret leaks in mini-programs. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (pp. 2411-2425).

    Watch List:
    • Zhang, Z., Zhang, H., Qian, Z., & Lau, B. (2021). An investigation of the android kernel patch ecosystem. In 30th USENIX Security Symposium (USENIX Security 21) (pp. 3649-3666).
    • Shen, Y., Vervier, P. A., & Stringhini, G. (2022). A large-scale temporal measurement of android malicious apps: Persistence, migration, and lessons learned. In 31st USENIX Security Symposium (USENIX Security 22) (pp. 1167-1184).
    • Xu, H., Yao, M., Zhang, R., Dawoud, M. M., Park, J., & Saltaformaggio, B. (2024). {DVa}: Extracting Victims and Abuse Vectors from Android Accessibility Malware. In 33rd USENIX Security Symposium (USENIX Security 24) (pp. 701-718).
    • Oltrogge, M., Huaman, N., Klivan, S., Acar, Y., Backes, M., & Fahl, S. (2021). Why eve and mallory still love android: Revisiting {TLS}({In) Security} in android applications. In 30th USENIX Security Symposium (USENIX Security 21) (pp. 4347-4364).
    • Hugenroth, D., & Beresford, A. R. (2023). Powering privacy: On the energy demand and feasibility of anonymity networks on smartphones. In 32nd USENIX Security Symposium (USENIX Security 23) (pp. 5431-5448).
    • Tang, B. J., & Shin, K. G. (2023). {Eye-Shield}:{Real-Time} protection of mobile device screen information from shoulder surfing. In 32nd USENIX Security Symposium (USENIX Security 23) (pp. 5449-5466).
    • Lu, H., Liu, Y., Liao, X., & Xing, L. (2024). Towards {Privacy-Preserving}{Social-Media}{SDKs} on android. In 33rd USENIX Security Symposium (USENIX Security 24) (pp. 647-664).
    • Pourali, S., Yu, X., Zhao, L., Mannan, M., & Youssef, A. (2024). Racing for {TLS} Certificate Validation: A Hijacker's Guide to the Android {TLS} Galaxy. In 33rd USENIX security symposium (USENIX security 24) (pp. 683-700).
    • Liu, D., Xiao, Y., Zhang, C., Xie, K., Bai, X., Zhang, S., & Xing, L. (2024). {iHunter}: Hunting privacy violations at scale in the software supply chain on {iOS}. In 33rd USENIX Security Symposium (USENIX Security 24) (pp. 5663-5680).
    Nov 17IoT Security Reading Assignment 4:
    Rieger, Phillip, Marco Chilese, Reham Mohamed, Markus Miettinen, Hossein Fereidooni, and Ahmad-Reza Sadeghi. "{ARGUS}:{Context-Based} detection of stealthy {IoT} infiltration attacks." In 32nd USENIX Security Symposium (USENIX Security 23), pp. 4301-4318. 2023.

    Presentation Papers:
    • Presenter: Melike Gizem Davutoğullari
      Wen, H., Lin, Z., & Zhang, Y. (2020, October). Firmxray: Detecting bluetooth link layer vulnerabilities from bare-metal firmware. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security (pp. 167-180).
    • Presenter: Halil İbrahim Çolak
      Dong, Yutao, Qing Li, Kaidong Wu, Ruoyu Li, Dan Zhao, Gareth Tyson, Junkun Peng, Yong Jiang, Shutao Xia, and Mingwei Xu. "{HorusEye}: A realtime {IoT} malicious traffic detection framework using programmable switches." In 32nd USENIX Security Symposium (USENIX Security 23), pp. 571-588. 2023.
    • Presenter: Elif Yağmur Eratalay
      Xiao, H., Zhang, Y., Shen, M., Lin, C., Zhang, C., Liu, S., & Yang, M. (2024, December). Accurate and efficient recurring vulnerability detection for iot firmware. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (pp. 3317-3331).
    Watch List:
    • He, Weijia, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus Dürmuth, Earlence Fernandes, and Blase Ur. "Rethinking access control and authentication for the home internet of things (IoT)." In 27th USENIX Security Symposium (USENIX Security 18), pp. 255-272. 2018.
    • Celik, Z. B., Babun, L., Sikder, A. K., Aksu, H., Tan, G., McDaniel, P., & Uluagac, A. S. (2018). Sensitive information tracking in commodity IoT. In 27th {USENIX} Security Symposium ({USENIX} Security 18) (pp. 1687-1704). USENIX Security 2018
    • Schuster, Roei, Vitaly Shmatikov, and Eran Tromer. "Situational access control in the internet of things." In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1056-1073. 2018. ACM CCS 2018
    • Kumar, S., Hu, Y., Andersen, M. P., Popa, R. A., & Culler, D. E. (2019). {JEDI}: Many-to-Many End-to-End Encryption and Key Delegation for IoT. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 1519-1536). USENIX Security 2019
    • Celik, Z. B., Tan, G., & McDaniel, P. D. (2019, February). IoTGuard: Dynamic Enforcement of Security and Safety Policy in Commodity IoT. In NDSS 2019. NDSS 2019
    • Yuan, B., Jia, Y., Xing, L., Zhao, D., Wang, X., Zou, D., ... & Zhang, Y. (2020). Shattered Chain of Trust: Understanding Security Risks in Cross-Cloud IoT Access Delegation. In 29th {USENIX} Security Symposium ({USENIX} Security 20) (pp. 1183-1200).USENIX Security 2020
    • FU, Chenglong, ZENG, Qiang, et DU, Xiaojiang. Hawatcher: Semantics-aware anomaly detection for appified smart homes. In : 30th {USENIX} Security Symposium USENIX Security 2021
    • Wang, Q., Ji, S., Tian, Y., Zhang, X., Zhao, B., Kan, Y., ... & Beyah, R. (2021). {MPInspector}: A systematic and automatic approach for evaluating the security of {IoT} messaging protocols. In 30th USENIX Security Symposium (USENIX Security 21) (pp. 4205-4222).
    • Alrawi, O., Lever, C., Valakuzhy, K., Snow, K., Monrose, F., & Antonakakis, M. (2021). The Circle Of Life: A Large-Scale Study of The IoT Malware Lifecycle. In 30th {USENIX} Security Symposium ({USENIX} Security 21). USENIX Security 2021 .
    • Nan, Yuhong, Xueqiang Wang, Luyi Xing, Xiaojing Liao, Ruoyu Wu, Jianliang Wu, Yifan Zhang, and XiaoFeng Wang. "Are you spying on me?{Large-Scale} analysis on {IoT} data exposure through companion apps." In 32nd USENIX Security Symposium (USENIX Security 23), pp. 6665-6682. 2023. USENIX Security 2023
    • Vetrivel, Swaathi, Brennen Bouwmeester, Michel van Eeten, and Carlos H. Gañán. "{IoT} Market Dynamics: An Analysis of Device Sales, Security and Privacy Signals, and their Interactions." In 33rd USENIX Security Symposium (USENIX Security 24), pp. 7031-7048. 2024. USENIX Security 2024
    Nov 24IoT/CPS Security Reading Assignment 5:
    Sato, T., Shen, J., Wang, N., Jia, Y., Lin, X., & Chen, Q. A. (2021). Dirty road can attack: Security of deep learning based automated lane centering under {Physical-World} attack. In 30th USENIX security symposium (USENIX Security 21) (pp. 3309-3326).

    Presentation Papers:
    • Presenter: Murat Tatli
      Soltan, S., Mittal, P., & Poor, H. V. (2018). {BlackIoT}:{IoT} Botnet of High Wattage Devices Can Disrupt the Power Grid. In 27th USENIX Security Symposium (USENIX Security 18) (pp. 15-32).
    • Presenter: Roya Habibzade
      Jin, Z., Ji, X., Cheng, Y., Yang, B., Yan, C., & Xu, W. (2023, May). Pla-lidar: Physical laser attacks against lidar-based 3d object detection in autonomous vehicle. In 2023 IEEE Symposium on Security and Privacy (SP) (pp. 1822-1839). IEEE.
    • Presenter: Bilal Özlü
      Tang, Z., Serag, K., Zonouz, S., Celik, Z. B., Xu, D., & Beyah, R. (2024, December). ERACAN: defending against an emerging CAN threat model. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (pp. 1894-1908).
    Watch List:
    • Huang, B., Cardenas, A. A., & Baldick, R. (2019). Not everything is dark and gloomy: Power grid protections against IoT demand attacks. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 1115-1132).USENIX Security 2019
    • Too Good to Be Safe: Tricking Lane Detection in Autonomous Driving with Crafted Perturbations
    • Automated Discovery of Denial-of-Service Vulnerabilities in Connected Vehicle Protocols
    • PatchVerif: Discovering Faulty Patches in Robotic Vehicles
    • Discovering Adversarial Driving Maneuvers against Autonomous Vehicles
    • You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks
    • That Person Moves Like A Car: Misclassification Attack Detection for Autonomous Systems Using Spatiotemporal Consistency
    • Wu, Y., Wang, J., Wang, Y., Zhai, S., Li, Z., He, Y., ... & Zhang, N. (2024). Your firmware has arrived: A study of firmware update vulnerabilities. In 33rd USENIX Security Symposium (USENIX Security 24) (pp. 5627-5644).
    Dec 1Machine Learning Security Reading Assignment 6:
    Nguyen, Anh, Jason Yosinski, and Jeff Clune. "Deep neural networks are easily fooled: High confidence predictions for unrecognizable images." In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 427-436. 2015.

    Presentation Papers:
    • Presenter: Can Koçak
      Carlini, N., & Wagner, D. (2017, May). Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) (pp. 39-57). Ieee.
    • Presenter: Yasin Arslan
      Shokri, Reza, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. "Membership inference attacks against machine learning models." In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
    • Presenter: Alper Solmaz
      Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., & Zhao, B. Y. (2019, May). Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP) (pp. 707-723). IEEE.
    Watch List:
    • Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., & Song, D. (2019). The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th {USENIX} Security Symposium ({USENIX} Security 19) (pp. 267-284).USENIX Security 2019
    Dec 8Machine Learning Security Reading Assignment 7:
    Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., ... & Liu, Y. (2023). Masterkey: Automated jailbreak across multiple large language model chatbots. Network and Distributed System Security (NDSS) Symposium, 2023

    Presentation Papers:
    • Presenter: Orhan Algül
      Shen, X., Chen, Z., Backes, M., Shen, Y., & Zhang, Y. (2024, December). "Do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (pp. 1671-1685).
    • Presenter: Salih Aydın
      Zou, W., Geng, R., Wang, B., & Jia, J. (2025). {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models. In 34th USENIX Security Symposium (USENIX Security 25) (pp. 3827-3844).
    Watch List:
    • Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., & Papernot, N. (2020). High Accuracy and High Fidelity Extraction of Neural Networks. In 29th {USENIX} Security Symposium ({USENIX} Security 20).USENIX Security 2020
    • Carlini, Nicolas, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. "Extracting training data from diffusion models." In 32nd USENIX security symposium (USENIX Security 23), pp. 5253-5270. 2023..
    Dec 15Project presentations Project presentations
    Dec 22Project presentations Project presentations