Assistant Professor

点击翻译按钮获取中文摘要

With the introduction of ultra-fast 5G networks, companies and organizational infrastructures are facing an ever-increasing number of endpoint devices such as PCs, mobile devices, Internet-of-Thing (IoT) sensors, and actuators. They significantly enlarge the attack surface, and the cyber-attacks have been vastly shifting from perimeter to endpoint devices. Malware infection and fileless vulnerability exploits are two major rapidly evolving threats against endpoints, causing significant financial loss to companies and organizations. Deep Learning (DL) has been driving the next-generation malware detection and vulnerability discovery solutions for optimized endpoint security in both industry and academia, due to its simplicity for integration, low overhead, and effectiveness against future unknown attacks. However, these DL-powered solutions as black-box approaches cannot provide the same degree of insight and actionable information as legacy signature-based solutions to security analysts and officers. The proposed research addresses the critical and urgent issues of effectiveness, interpretability, and actionability of the black-box DL solutions against emerging malware and vulnerability exploits on endpoint devices. The research studies the underlying generic representation of malware and vulnerability in a software ecosystem and their relationship to build an effective DL system defending against and gaining insight from the incoming attacks. This research will be fundamental to promote Canadian cyber capability to detect, defend, and act on emerging large-scale cyber-attacks targeting both the public and private sectors. It also augments endpoint security for the general public by building a safer cyber world. The Canadian cybersecurity landscape is at risk, and Canada currently trains less than half of the skilled professionals needed in cybersecurity-related industrials. The proposed research will address this large professional shortage in Canada for both the public and private sectors. Training of HQP in this program will include demanding skills in binary analysis, vulnerability analysis, reverse engineering, large-scale data analysis, and explainable machine learning. I expect that three PhD students, six MSc students, and five undergraduate students will receive training through this program that will prepare them to launch careers in academia, industry or government agencies.