Dr. Kevin W. Hamlen

Uni­ver­si­ty Fools Hack­ers in­to Shar­ing Tac­tics  Re­search­ers at the Uni­ver­si­ty of Tex­as have found a way to bam­boo­zle ma­li­cious hack­ers in­to giv­ing a­way their se­crets. ...

AI-pow­ered Hon­ey­pots: Ma­chine Learn­ing May Help Im­prove In­tru­sion De­tec­tion  For­get crowd­sourc­ing, here's crook­sourc­ing. Com­put­er sci­en­tists in the US are work­ing to ap­ply ma­chine learn­ing tech­niques in or­der to de­vel­op more ef­fec­tive hon­ey­pot-style cy­ber de­fens­es. ...

Com­put­er Sci­en­tists' New Tool Fools Hack­ers in­to Shar­ing Keys for Bet­ter Cy­ber­se­cu­ri­ty  In­stead of block­ing hack­ers, a new cy­ber­se­cu­ri­ty de­fense ap­proach de­vel­oped by Uni­ver­si­ty of Tex­as at Dal­las com­put­er sci­en­tists ac­tu­al­ly wel­comes them. ...

Au­ton­o­mous Cy­ber De­cep­tion: Rea­son­ing, A­dapt­ive Plan­ning, and E­val­u­a­tion of Hon­ey­Things  Pro­vides com­pre­hen­sive cov­er­age of a­dapt­ive cy­ber de­cep­tion in many as­pects, in­clud­ing the­o­ry and prac­tice, sense-mak­ing and de­ci­sion mak­ing, and net­work and sys­tem per­spec­tives

Binary Con­trol-flow Trim­ming  Man­y com­mer­cial soft­ware prod­ucts are bloat­ed with fea­tures av­er­age us­ers don't need (or e­ven know a­bout), and that pose un­nec­es­sar­y se­cu­ri­ty risks. Bi­na­ry trim­ming au­to­mat­i­cal­ly re­moves un­want­ed bloat with­out re­ly­ing on source code.

Con­firm­ing Code Flow Se­cu­ri­ty Con­trols  Con­FIRM is the first test suite for eval­u­a­ting com­pat­i­bil­i­ty of con­trol-flow in­teg­ri­ty de­fens­es with mod­ern soft­ware.

Turn­ing Graph­ics Cards in­to Se­cu­ri­ty Guards  We in­vent­ed a meth­od for har­ness­ing GPUs to watch and se­cure Ja­va pro­grams through n-var­i­ant par­al­lel com­pu­ta­tion.

Crook-Sourcing  Gath­er­ing large vol­umes of cur­rent, rel­e­vant at­tack da­ta is a bot­tle­neck for train­ing many com­put­er de­fens­es. Rath­er than la­bo­ri­ous­ly col­lect­ing such da­ta man­u­al­ly, we “crook-source” the task by turn­ing at­tack­ers in­to un­wit­ting pen­e­tra­tion test­ers, and us­ing the col­lect­ed da­ta for pe­rim­e­ter hard­ening.

SEIS­MIC De­tec­tion of Cryp­to­jack­ing At­tacks  De­tec­ting il­lic­it cryp­to­cur­ren­cy min­ing in web brows­ers is now more re­li­able thanks to “SEIS­MIC” (SE­cure In-lined Script Mon­i­tors for In­ter­rup­ting Cryp­to­jacks), which mon­i­tors web as­sem­bly com­pu­ta­tions to de­tect the ech­oes of un­auth­or­ized cryp­to­min­ing ac­tiv­i­ty.

Ob­ject Flow In­teg­ri­ty  Our in­ven­tion of OFI al­lows bi­na­ry code con­sum­ers to au­to­mat­i­cal­ly hard­en large, closed-source, com­po­nent-driv­en soft­ware prod­ucts against hi­jack­ing at­tacks, which are among the most prev­a­lent soft­ware cy­ber­se­cu­ri­ty threats today.

Opaque Con­trol-Flow In­teg­ri­ty  This new form of con­trol-flow in­teg­ri­ty se­cu­ri­ty de­feats ad­ver­sar­ies who have full read-ac­cess to the vic­tim pro­gram's code, heap, and stack dur­ing the at­tack.

Honey-Patch­ing  This cy­ber­de­cep­tion in­no­va­tion turns se­cu­ri­ty patch­es in­to hon­ey-patch­es—cy­ber traps that lead at­tack­ers a­stray, feed them dis­in­for­ma­tion, and fool them in­to di­vulg­ing crit­i­cal threat in­tel to de­fend­ers.

Cy­ber­de­cep­tive Sof­tware En­gi­neer­ing  Our en­hance­ments to the LLVM C-com­pil­er pro­duce soft­ware that au­to­mat­i­cal­ly re­plac­es its da­ta with fakes dur­ing cy­ber­at­tacks, lur­ing crim­i­nals in­to traps.

Super­set Dis­as­sem­bly  Bi­na­ry prog­rams are like puz­zles that must be care­ful­ly dis­as­sem­bled and re­as­sem­bled to mod­i­fy them. Our in­ven­tions of su­per­set dis­as­sem­bly, shin­gled dis­as­sem­bly, and ma­chine learn­ing-based dis­as­sem­bly solve these dif­fi­cult puz­zles to aug­ment soft­ware with stronger security.

REINS: RE­writ­ing & IN-lin­ing Sys­tem  Our re­search was the first to a­chieve ful­ly au­to­mat­ed, ma­chine-ver­i­fied soft­ware fault i­so­la­tion of source-free com­mod­i­ty code for Lin­ux and Win­dows.

STIR: Self-Trans­form­ing In­struc­tion Re­lo­ca­tion  Bi­na­ry stir­ring blocks soft­ware hi­jacks by ran­dom­iz­ing the code's in­ter­nal struc­ture eve­ry time it loads, mak­ing it so un­pre­dict­a­ble that code-re­use at­tacks fail with as­tro­nom­i­cal­ly high probability.

Frank­en­stein  In 2012 we warned the world that con­ven­tion­al an­ti­vi­rus pro­tec­tions were per­il­ous­ly vul­ner­a­ble to a new mal­ware mu­ta­tion tech­nique that we dubbed Frank­en­stein.