Cybersecurity is a widely recognized concern that is becoming ever more important yet remains far from being solved. With information technology now being pervasive across most aspects of our private and public lives, and with increasing digitization and use of information processes in new domains, protecting systems and information remains critical. Dr. Angelos Keromytis, Associate Professor of Computer Science, at Columbia University, is interested in protecting these complex, networked systems while keeping them stable. The challenge however is that such systems, by definition, have many components that are themselves not easily understood, and are put together in a way that defies easy understanding. Dr. Keromytis and his team work to close the gaps available to adversaries and to enable systems that are “transparent” to their users and operators. By unraveling the pathways intruders use to infiltrate our networking systems, Dr. Keromytis is able to also develop systems that are inherently resilient to attacks by using novel techniques borrowed from nature or other fields.

Networking systems are becoming more complex as technology develops. Therefore, opportunities for attackers have become more prevalent as gaps in our understanding have unearthed opportunities for adversaries, allowing them to successfully intrude while remaining hidden. Dr. Keromytis’ work seeks to restore and enhance the trust of such networking systems for users on the basis of strong guarantees and user control. Aimed at practical applications, his work is helping to confront the growing necessity for cybersecurity in our modern world. With a tireless work ethic, supported by his numerous publications, 30 issued patents, and other tangible outcomes, in addition to a creative approach to cybersecurity, Dr. Keromytis’ research will continue to have an impact. Furthermore, his experience differentiates him from many researchers within his field as he has worked within academics, commercial industry, and for the government and therefore, understands the varying perspectives that weigh in for a holistic picture of where cybersecurity is headed.

Current research includes:

• Detecting Attacks:  libDFT is a versatile and practical dynamic data flow tracking mechanism that provides insight into program execution by tracing how information is handled by a running application. This allows Dr. Keromytis and his team to detect a variety of attacks and to establish causal chains of system component interaction that can help answer the "why" question.

• CloudFence: CloudFence is a framework build on libDFT that allows users to independently audit the treatment of their private data by third-party online services, through the intervention of the cloud provider that hosts these services.

• Making Attacks a Challenge: MEERKATS is a novel architecture for cloud environments that elevates continuous system evolution, adaptation, and misdirection as first-rate design principles. Dr. Keromytis’ goal is to enable an environment for cloud services that constantly changes along several dimensions, toward creating an unpredictable target for an adversary. This unpredictability will both impede the adversary’s ability to achieve an initial system compromise and, if a compromise occurs, to detect, disrupt, and/or otherwise impede his ability to exploit this success.

• ASSURE: is a system that introduces rescue points to recover software from unknown faults, while maintaining both system integrity and availability, by mimicking system behavior under known error conditions.

• Spy in the Sandbox: Dr. Keromytis and his team have identified a new way that hackers can spy on PC users. By illuminating the ways in which hackers can gain access to computer systems, he and his team are working to mitigate their ability to do so. In other words, by understanding how hackers might gain insights, Dr. Keromytis can prevent them from doing so in the first place. More about Dr. Keromytis’ Spy in the Sandbox project can be found here.