Curriculum Vitae - The University of Texas at Dallas

9. A Semantic Web Based Framework for Social Network Access Control, Proceedings of ACMSymposium on Access Control Models and Technologies (SACMAT 2009), p. 177-186, (coauthors:B. Carminati, E. Ferrari, R. Heatherly, M Kantarcioglu). Co-AuthorMy Contribution: I conceived the idea. Much of the design was carried out by Prof. Kantarciogluand Prof. Carminati. The student (Mr. Heatherly) carried out the implementation. The paper waswritten by all.10. The SCIFC Model for Information Flow Control in Web Service Composition, ProceedingsIEEE International Conference on Web Services (ICWS 2009) (co-authors: W. She, I. Yen,E. Bertino). Co-AuthorMy Contribution: I conceived the initial ideas. Our student carried out the detailed designand implementation. Much of the paper was written by Prof. Yen.11. Security Issues for Cloud Computing, International Journal of Information Security and Privacy,Vol. 4, No. 2, 2010, p. 36 – 48 (co-authors: K. Hamlen, L. Khan, M. Kantarcioglu). Lead AuthorMy Contribution: I conceived the ideas and the high level design. My colleagues contributed todetails of the design. I wrote the paper.17.5 DATA MINING FOR MALWARE DETECTIONI gave several keynote presentations on Data Mining, Security, Privacy and Civil Liberties starting in1996 and wrote a position paper while at NSF that resulted in significant emphasis on privacy research.However, I also continued with data mining for security applications research both for national securityand cyber security. When I joined The University of Texas at Dallas, I collaborated with a professor andstudents and together we designed and developed a number of data mining algorithms for malwaredetection. We have also developed a data mining toolkit based on our algorithm.Data Mining for Intrusion Detection: Our initial focus was on applying data mining for intrusiondetection. We applied various data mining techniques based on Support Vector Machines (SVM) as wellas developed a novel technique called dynamical growing self-organizing tree (DGSOT) and comparedthe results to the work of others. This research was published in Paper #1 that appeared in the prestigiousVery Large Database Journal. We also included this paper as part of a book that we published in 2009 onthe Design and Implementation of Data Mining Tools.Data Mining for Malware Detection: We then started a focused research program on data miningapplications in cyber security funded by the Air Force. In Paper #2 (ICC), we developed a hybrid modelthat examined both byte code and assembly code for detecting malicious code. This was a novel approachat that time. Then in Paper #3 (Information Systems Frontiers), we developed scalable solutions to featureextraction for detecting buffer overflow as well as malicious executables.Stream Mining for Fault Detection: The research for the last two papers are jointly carried out with theUniversity of Illinois at Urbana Champaign and funded by NASA. Here our goal was to develop datamining techniques for fault detection. Data is emanating from multiple sources in the form of streams. Wehave developed novel stream mining techniques for classifying data streams. Our approach is based onexamining multiple and hierarchical chunks of data. The results are published in Paper #4 (ICDM).However, with our previous approach, new faults cannot be detected. Therefore, we have come up with abreakthrough technique where novel classes can be detected with high accuracy. This result is publishedin Paper #5 (IEEE Transactions on Knowledge and Data Engineering).Active Defense: The results in Papers #2 and #3 focus on defensive detection mechanisms. The challengewe face now is that the malicious code will change its patterns, thereby making it very difficult to detect.Therefore, we have developed a breakthrough approach to be able to detect the malicious code before thevirus is detected. Our results are published in Paper #6 (Computer Standards and Interface Journal).109