Challenging security assumptions: The capabilities and limitations of real-world adversaries

When can you trust the software running on your computer? To answer this question, it is not enough to reason about the state of an individual host -- we must also understand if real-world adversaries can invalidate the assumptions behind our methods for establishing trust in software components. 

 

In this talk I will discuss my work on combining machine learning with global-scale measurements, which has exposed critical security threats and has guided industrial practices. First, I will present the Worldwide Intelligence Network Environment (WINE), an analytics platform that has enabled systematic security measurements with data from 11 million hosts from around the world. Second, I will use WINE as a vehicle for exploring open research questions, such as the duration and impact of zero-day attacks and the weaknesses in roots-of-trust that allow malware to masquerade as reputable software. I will conclude by discussing how these results have taught us important lessons about the use of machine learning in the security domain. These lessons include the ability to predict certain security incidents, the potential to interpret machine learning models and to combat adversarial data poisoning, and the impact on the emerging cyber insurance industry.