Technical papers

1. Address-Space Randomization for Windows Systems ,
   Lixin Li, James Just and R. Sekar,
   To appear in 22nd Annual Computer Security Applications Conference (ACSAC; Miami, FL; December 2006).
   
2. Provably Correct Runtime Enforcement of Non-Interference Properties ,
   V.N. Venkatakrishnan, Wei Xu, Daniel DuVarney and R. Sekar,
   To appear in 8th International Conference on Information and Communications Security (ICICS; Raleigh, NC; December 2006).
   (An earlier version appeared as Technical Report SECLAB-04-01 A Program Transformation Technique for Enforcement of Information Flow Properties, March 2004).
   
3. Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks, [ PDF]
   Wei Xu, Sandeep Bhatkar, and R. Sekar,
   15th USENIX Security Symposium (Vancouver, BC, Canada, August 2006).
   (An earlier version appeared as Technical Report SECLAB-05-06, November 2005.
   Also supersedes Technical Report SECLAB-05-05 A Unified Approach for Preventing Attacks Exploiting a Range of Software Vulnerabilities, and
   Technical Report SECLAB-05-04 Practical dynamic taint analysis for countering input validation attacks on web applications.)
   
4. Dataflow Anomaly Detection, [ PDF]
   Sandeep Bhatkar, Abhishek Chaturvedi and R. Sekar,
   IEEE Symposium on Security and Privacy (Oakland, CA; May 2006).
   (Supercedes Tecnical Report SECLAB-05-03 Improving Attack Detection in Host-Based IDS by Learning Properties of System Call Arguments, July 2005.)
   
5. Compositional Analysis for Verification of Parameterized Systems, [ PDF],
   Samik Basu and C. R. Ramakrishnan,
   Theoretical Computer Science (354(2), pages 211--229, 2006).
   
6. On Supporting Active User Feedback in P3P, [ PDF],
   V.N. Venkatakrishnan, Wei Xu, and Rishi Kant Sharda,
   2nd Secure Knowledge Management Workshop (SKM, New York, NY, September 2006).
   
7. A Framework for Building Privacy-Conscious Composite Web Services, [ PDF],
   Wei Xu, V.N. Venkatakrishnan, R. Sekar, and I.V. Ramakrishnan,
   4th IEEE International Conference on Web Services (Application Services and Industry Track) (ICWS, Chicago, IL, September 2006).
   
8. Automatic Generation of Buffer Overflow Attack Signatures: An Approach Based on Program Behavior Models,[ PDF]
   Zhenkai Liang and R. Sekar,
   21st Annual Computer Security Applications Conference (ACSAC;Tucson, AZ; December 2005).
   (Supercedes Technical Report SECLAB-05-01 An Immune System Inspired Approach for Protection from Repetitive Attacks, March 2005.)
9. Fast and Automated Generation of Attack Signatures: A Basis for Building Self-Protecting Servers, [ PDF]
   Zhenkai Liang and R. Sekar,
   12th ACM conference on Computer and Communications Security (CCS; Alexandria, VA; November 2005).
   (Supercedes Technical Report SECLAB-05-02 Automated, Sub-second Attack Signature Generation: A Basis for Building Self-Protecting Servers, May 2005.)
   
10. Efficient Techniques for Comprehensive Protection from Memory Error Exploits, [ PS] [ PDF]
    Sandeep Bhatkar, R. Sekar and Daniel C. DuVarney,
    14th USENIX Security Symposium (Security; Baltimore, MD; August 2005).
    
11. Incremental and Demand-Driven Points-To Analysis using Logic Programming, [ PDF],
    Diptikalyan Saha and C. R. Ramakrishnan,
    7th International ACM SIGPLAN Conference on Principles and Practice of Declarative Programming (PPDP; Lisbon, Portugal; July 2005).
    
12. V-NetLab: A Cost-Effective Platform to Support Course Projects in Computer Security, [PDF]
    Kumar Krishna, Weiqing Sun, Pratik Rana, Tianning Li, and R.Sekar,
    Annual Colloquium for Information Systems Security Education (CISSE; Atlanta, GA; June 2005).
    
13. FocusCheck: A Tool for Model Checking and Debugging Sequential C Programs, [PDF]
    Curtis W. Keller, Diptikalyan Saha, Samik Basu, and Scott A. Smolka,
    International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS; Edinburgh, U.K.; April 2005).
14. Automatic synthesis of filters to discard buffer overflow attacks: A step towards realizing self-healing systems, [ PS] [ PDF]
    Zhenkai Liang, R. Sekar, and Daniel C. DuVarney,
    USENIX Annual Technical Conference (Anaheim, CA; April 2005).
    
15. One-way Isolation: An Effective Approach for Realizing Safe Execution Environments, [ PS] [ PDF](Revised version of conference paper)
    Weiqing Sun, Zhenkai Liang, V.N. Venkatakrishnan, and R. Sekar,
    ISOC Network and Distributed Systems Symposium (NDSS; San Diego, CA; February 2005).
16. A Provably Correct Compiler for Efficient Model Checking of Mobile Processes, [ PDF],
    Ping Yang, C. R. Ramakrishnan and Scott A. Smolka,
    7th International Symposium on Practical Aspects of Declarative Languages (PADL; Los Angeles, CA; January 2005).
    
17. An Approach for Realizing Privacy-Preserving Web-Based Services, [ PDF],
    Wei Xu, R. Sekar, I.V. Ramakrishnan and V.N. Venkatakrishnan,
    14th International World Wide Web Conference (Special interest tracks and posters) (WWW, Chiba, Japan, May 2005).
    
18. A Secure Composition Framework for Trustworthy Personal Information Assistants , [ PDF],
    V.N. Venkatakrishnan, Wei Xu, I.V. Ramakrishnan and R. Sekar,
    IEEE International Conference on Integration of Knowledge Intensive Multi-Agent Systems (KIMAS, Waltham MA, April 2005).
    
19. Using Predators to Combat Worms and Viruses: A Simulation-Based Study, [ PDF]
    Ajay Gupta and Daniel C. Duvarney,
    Annual Computer Security Applications Conference,(ACSAC; Tucson, Arizona; Dec 2004).
20. An Efficient and Backwards-Compatible Transformation to Ensure Memory Safety of C Programs, [ PDF]
    Wei Xu, Daniel C. Duvarney, and R. Sekar,
    ACM SIGSOFT Intl. Symposium on the Foundations of Software Engineering (SIGSOFT 2004/FSE-12; Newport Beach, CA; November 2004).
21. Immunizing Servers from Buffer-Overflow Attacks,
    Zhenkai Liang, R. Sekar and Daniel C. DuVarney,
    Adaptive and Resilient Computing Security Workshop (ARCS'04;Santa Fe Institute, NM; November 2004).
22. Localizing Program Errors for Cimple Debugging,  [PDF]
    Samik Basu, Diptikalyan Saha and Scott A. Smolka
    International Conference on Formal Techniques for Networked and Distributed Systems (FORTE; Madrid, Spain; September 2004).
23. A Logical Encoding of the pi-Calculus: Model Checking Mobile Processes Using Tabled Resolution, [ PDF]
    P. Yang, C.R. Ramakrishnan and S.A. Smolka,
    International Journal on Software Tools for Technology Transfer (STTT; July 2004).
24. Online Justification for Tabled Logic Programs, [ PS.GZ] [ PDF]
    Giridhar Pemmasani, Haifeng Guo, Yifei Dong, C. R. Ramakrishnan and I. V. Ramakrishnan,
    Intl. Symposium on Functional and Logic Programming (FLOPS'04; Nara, Japan; April 2004).
25. Isolated program execution: An application transparent approach for executing untrusted programs, [ PS] [ PDF]
    Z. Liang, V.N. Venkatakrishnan and R. Sekar,
    Annual Computer Security Applications Conference (ACSAC; Las Vegas, NV; December 2003). Best paper award!
    
26. Constraint-Based Model Checking of Data Independent Systems, [ PS.GZ] [ PDF]
    Beata Sarna-Starosta and C. R. Ramakrishnan,
    International Conference on Formal Engineering Methods, (ICFEM'03; Singapore; November 2003).
27. Model-Carrying Code: A Practical Approach for Safe Execution of Untrusted Applications, [ PS] [ PDF]
    R. Sekar, V.N. Venkatakrishnan, Samik Basu, Sandeep Bhatkar and Dan DuVarney,
    ACM Symposium on Operating Systems Principles. (SOSP'03; Bolton Landing, NY; October 2003).
28. SELF: a Transparent Security Extension for ELF Binaries, [ PS] [ PDF]
    Daniel C. DuVarney, V.N. Venkatakrishnan and Sandeep Bhatkar,
    New Security Pardigms Workshop (NSPW'03, Ascona, Switzerland; August 2003).
29. Generation of All Counter-Examples for Push-Down Systems, [PDF]
    Samik Basu, Diptikalyan Saha, Yow-Jian Lin and Scott A. Smolka,
    Application of Formal Description Techniques in Internet and Communication Domains (FORTE'03; Berlin, Germany; September 2003).
30. Address Obfuscation: an Efficient Approach to Combat a Broad Range of Memory Error Exploits, [ PS] [ PDF]
    Sandeep Bhatkar, Daniel C. DuVarney, and R. Sekar,
    USENIX Security Symposium (Security'03; DC; August 2003).
31. Evidence Explorer: A Tool for Exploring Model-Checking Proofs, [ PDF]
    Y. Dong, C.R. Ramakrishnan, and S.A. Smolka,
    Computer-Aided Verification (CAV'03; Boulder, CO; July 2003).
32. Model Checking and Evidence Exploration, [ PDF]
    Y. Dong, C.R. Ramakrishnan, and S.A. Smolka,
    Engineering of Computer Based Systems (ECBS'03; Huntsville, AL; April 2003).
33. Compositional Analysis for Verification of Parameterized Systems, [ PS.GZ] [ PDF]
    Samik Basu and C. R. Ramakrishnan,
    International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS'03; Warsaw, Poland; April 2003).
34. A Logical Encoding of the pi-Calculus: Model Checking Mobile Processes Using Tabled Resolution, [ PDF]
    P. Yang, C.R. Ramakrishnan and S.A. Smolka,
    Verification, Model Checking and Abstract Interpretation (VMCAI'03; New York, NY; January 2003).
35. An approach for Secure Software Installation, [ PS] [ PDF]
    V.N. Venkatakrishnan, R. Sekar, S. Tsipa, T. Kamat and Z. Liang,
    USENIX System Administration conference (LISA'02; Philadelphia, PA; November 2002).
36. Empowering mobile code using expressive security policies, [ PS] [ PDF]
    V.N. Venkatakrishnan, Peri Ram and R. Sekar,
    New Security Pardigms Workshop (NSPW' 02; Virginia Beach, VA; September 2002.)
37. Vacuity Checking in the Modal Mu-Calculus, [ PS.GZ] [ PDF]
    Yifei Dong, C. R. Ramakrishnan, Beata Sarna-Starosta and Scott A. Smolka
    International Conference on Algebric Methodology and Software Technology (AMAST'02; Reunion Island, France; September 2002).
38. Resource-Constrained Model Checking of Recursive Programs, [ PS.GZ] [ PDF]
    Samik Basu, K. Narayan Kumar, L. Robert Pokorny and C. R. Ramakrishnan,
    International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS'02; Grenoble, France; April 2002).
39. Experiences with Specification Based Intrusion Detection System, [ PS] [ PDF]
    P. Uppuluri and R. Sekar,
    Recent Advances in Intrusion Detection (RAID; October 2001).
    
40. Model-Carrying Code (MCC): A New Paradigm for Mobile-Code Security, [ PDF]
    R. Sekar, C.R. Ramakrishnan, I.V. Ramakrishnan, Scott A. Smolka,
    New Security Paradigms Workshop (NSPW'01; Cloudcroft, NM; Sept 2001).

Last updated: July 30, 2005
Suggestions, comments or questions: contact R. Sekar (sekar@cs.sunysb.edu)