Improving security through lightweight learned models

现代计算机系统的不安全威胁着互联网的成功。以病毒、蠕虫和间谍软件形式存在的恶意软件非常普遍，导致数据丢失、隐私泄露和服务中断。更令人不安的是，钓鱼电子邮件和网页现在使针对用户自身的社会工程攻击自动化。这些问题源于复杂软件中普遍存在的不完美以及人类在与此类系统交互时存在的局限性。*如果我们要有意义地提高计算机系统的安全性，我们需要能够在这些局限性面前取得成功的机制和策略。我正在进行的研究计划的中心是这样一个想法，即基于观察到的行为的轻量级学习模型可以用于提高计算机安全性。程序行为的模型可以用于检测安全违规行为；网络模型可以用于减少恶意网络使用的影响；用户模型可以检测到未经授权的个人的存在。我希望在未来开发、评估和原型模型，能够提供灵活和强大的保护，以抵御计算机用户面临的不断变化的威胁。

The insecurity of modern computer systems threaten the success of the Internet.  Malicious software, in the form of viruses, worms, and spyware are widespread, causing data loss, privacy compromises, and losses of service. Even more disturbing, phishing emails and web pages now automate social engineering attacks on users themselves.  These problems stem from the imperfections endemic in complex software and the limitations humans have when interacting with such systems.  If we are to meaningfully improve the security of computer systems, we need mechanisms and strategies that can succeed in the face of such limitations.My ongoing research program is centered around the idea that lightweight, learned models based upon observed behavior can be used to improve computer security.  Models of program behavior can be used to detect security violations; models of networks can be used to reduce the impact of malicious network use; models of users can detect the presence of unauthorized individuals.  In the future I hope to develop, evaluate, and prototype models that can provide flexible and robust protection against the ever changing threats facing computer users.