Assistant Professor

随着超高速5G网络的引入，公司和组织基础设施将面临越来越多的端点设备，如pc、移动设备、物联网（IoT）传感器和执行器。它们极大地扩大了攻击面，网络攻击已经从外围设备大量转移到端点设备。恶意软件感染和无文件漏洞利用是针对端点的两大快速发展的威胁，给公司和组织造成了重大的经济损失。深度学习（DL）一直在推动下一代恶意软件检测和漏洞发现解决方案，以优化产业界和学术界的端点安全性，因为它集成简单，开销低，对未来未知攻击的有效性。然而，这些基于dl的解决方案作为黑盒方法，不能像传统的基于签名的解决方案那样为安全分析师和官员提供相同程度的洞察力和可操作的信息。

With the introduction of ultra-fast 5G networks, companies and organizational infrastructures are facing an ever-increasing number of endpoint devices such as PCs, mobile devices, Internet-of-Thing (IoT) sensors, and actuators. They significantly enlarge the attack surface, and the cyber-attacks have been vastly shifting from perimeter to endpoint devices. Malware infection and fileless vulnerability exploits are two major rapidly evolving threats against endpoints, causing significant financial loss to companies and organizations. Deep Learning (DL) has been driving the next-generation malware detection and vulnerability discovery solutions for optimized endpoint security in both industry and academia, due to its simplicity for integration, low overhead, and effectiveness against future unknown attacks. However, these DL-powered solutions as black-box approaches cannot provide the same degree of insight and actionable information as legacy signature-based solutions to security analysts and officers. The proposed research addresses the critical and urgent issues of effectiveness, interpretability, and actionability of the black-box DL solutions against emerging malware and vulnerability exploits on endpoint devices. The research studies the underlying generic representation of malware and vulnerability in a software ecosystem and their relationship to build an effective DL system defending against and gaining insight from the incoming attacks. This research will be fundamental to promote Canadian cyber capability to detect, defend, and act on emerging large-scale cyber-attacks targeting both the public and private sectors. It also augments endpoint security for the general public by building a safer cyber world. The Canadian cybersecurity landscape is at risk, and Canada currently trains less than half of the skilled professionals needed in cybersecurity-related industrials. The proposed research will address this large professional shortage in Canada for both the public and private sectors. Training of HQP in this program will include demanding skills in binary analysis, vulnerability analysis, reverse engineering, large-scale data analysis, and explainable machine learning. I expect that three PhD students, six MSc students, and five undergraduate students will receive training through this program that will prepare them to launch careers in academia, industry or government agencies.