Tudor Dumitras | Measurements, Predictions and the Puzzle of Machine Learning: What Data From 10 Million Hosts Can Teach Us About Security

ABSTRACT: What are the odds that you will get hacked tomorrow? We cannot answer this question without understanding the capabilities of real-world adversaries to compromise hosts around the world; for example, among over 100,000 vulnerabilities disclosed publicly very few are likely to be exploited in the wild. Moreover, the machine learning techniques that drive the success of such inferences in non-adversarial domains, like computer vision or autonomous driving, face new challenges in security. In this talk I will discuss my work, combining machine learning with global-scale measurements, that has exposed critical security threats and has guided industrial practices. First, I will present the Worldwide Intelligence Network Environment (WINE), an analytics platform that has enabled systematic studies of security threats across more than 10 million hosts from around the world. Second, I will use WINE as a vehicle for exploring the opportunities for predicting future security incidents, such as vulnerability exploitation in the wild. I will conclude by discussing how these results have opened up new research directions and have taught us important lessons about the security of machine learning systems.BIO: Dumitraș is an Assistant Professor in the Electrical & Computer Engineering Department at University of Maryland, College Park. His research focuses on data-driven security: He studies real-world adversaries empirically, he builds machine
learning systems for detecting attacks and predicting security incidents, and he investigates the security of machine learning in adversarial environments. In his previous role at Symantec Research Labs, he built the Worldwide Intelligence Network
Environment (WINE), a data analytics platform for security research. His work on the effectiveness of certificate revocations in the Web PKI was featured in the Research Highlights of the communications of the Association for Computing Machinery  (ACM) in 2018, and his measurement of the duration and prevalence of zero-day attacks received an honorable mention in the National Security Agency competition for the Best Scientific Cybersecurity Paper of 2012. Tudor earned his Ph.D. from Carnegie Mellon University. He is the recipient of the 2011 A. G. Jordan Award from the ECE Department at Carnegie Mellon, the 2009 John Vlissides Award from ACM SIGPLAN, and the Best Paper Award at ASP-DAC’03.