Director	Kevin Butler
Phone	3525051914
Website	https://fics.institute.ufl.edu/
Mission	The Florida Institute for Cyber Security Research (FICS Research) develops advanced security algorithms, methodologies, and systems to address issues of national importance, and educates current and future members of our workforce with the skills necessary to protect, FICS Research also performs outreach to members of the corporate and government communities, helping to integrate advanced information security technologies into important organizations. Finally, the Institute also serves as a multidisciplinary nexus for the campus and beyond, combining the University's strengths across disciplines including law, engineering and public policy with information security.

Technologies

Ransomware Protection through Data Transformation Monitoring

Anti-Malware System Indicator Automatically Detects Malware Based on User Data Changes

This anti-ransomware system indicator monitors an end user’s data to automatically detect malware based on changes to that data. Data breaches occur when sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or otherwise used by an unauthorized user. Data breaches have severe legal, economic, social, and security implications. The annual cost of data breaches is estimated to exceed $2 trillion in 2019. As a result, the global cybersecurity market is estimated to grow to $170 billion by 2020. Available technologies are unable to consistently detect ransomware, resulting in the widespread loss of more than $18 million annually. Researchers at the University of Florida have developed a malware detection system for detecting ransomware, a malware that encrypts an end user’s files and holds the decryption key until a ransom is paid. This early-warning detection system alerts the end user to the large-scale changes to his/her files and automatically halts the process that appears to be tampering with large amounts of the user’s data. This anti-malware system has a low false-positive rate and is capable of rapid detection based on a set of ransomware-specific behavior indicators. This anti-malware system has the potential to meet the need for better cybersecurity tools and applications by working in conjunction with existing anti-malware programs to catch ransomware that has begun execution.

Application

Malware detection system and technique to combat ransomware’s ability to access user’s data

Advantages

Protects user data by monitoring for large-scale changes to the data, blocking changes that are indicative of a transformation from usable to unusable
Through process scoring and monitoring only data files, the system maintains a high accuracy against unknown ransomware samples, while limiting user involvement
Halted processes are unable to continue damaging the user’s data, preventing total loss and making ransom payments less likely
Works in conjunction with existing anti-malware program, providing a second chance to catch undetected malware, such as ransomware
Can also detect and block unauthorized encryption of data in use cases where encryption is undesired or only a specific implementation is approved

Technology

Ransomware represents one of the most visible threats to end users; due to its ability to evade many existing antivirus detection systems. The system monitors a user’s files and takes measurements as data is read and written, creating a reputation score for a process. When the reputation score exceeds a set threshold, the system automatically stops the process as a potential malware threat. The anti-malware system can work in conjunction with a first-defense anti-malware program, catching malware that went undetected by the first program. By recognizing ransomware’s key feature, this anti-malware system combats ransomware and prevents the malware from accessing end user’s data in its totality. Experimental results indicate that the anti-malware system detected and stopped 100 percent of 492 real-world ransomware samples, with as few as zero files lost and a median of 10 files lost.

Mobile Phone Security System

Detects SS7 Network Attacks Through Phone Conversations and Alerts Callers in Real Time

This mobile phone security system detects Signaling System 7 (SS7) redirection attacks during phone calls. SS7 is a global network that links together mobile phones, but unfortunately, hackers can abuse necessary functions of SS7 to reroute phone calls, track locations and intercept SMS messages. These attacks are difficult to identify due to the lack of detection techniques, so existing practices often fail to determine intended targets. Additionally, conventional carrier-based approaches neglect to inform consumers of incidents in real time. The universal impact of these attacks, noted in telecommunication networks across the globe, highlights the need for a for a user-side detection system.

Researchers at the University of Florida have developed a consumer-friendly, SS7-based detection system which alerts users about attempts to reroute their calls or eavesdrop on them. This is the first detection system that informs users when their calls are being covertly attacked.

Application

Mobile phone security system that detects and alerts users of rerouting and eavesdropping attacks using audio-based distance bounding

Advantages

Prevents eavesdropping, enabling secure communications and privacy to government users, companies and other organizations who place sensitive phone calls
Operates during the targeted points of a phone call, improving existing attack identification systems
Adapts to multiple production methods, allowing manufactures to include as part of either hardware or software
Utilizes a strong detection mechanism, informing users of call monitoring or rerouting

Technology

This security system uses audio-based distance bounding by transmitting cryptographically generated audio challenges and responses between cell phones while on a call. By measuring the time it takes for a signal to travel a return journey from one mobile phone to another, this application can securely estimate the round trip travel time (RTT) over the audio channel. Rerouting attacks add significant latency to call audio and cause abnormally high RTTs. This system therefore uses its estimated RTT to determine if a call is being attacked. Furthermore, the challenges and responses are encoded, meaning they cannot be imitated by hackers seeking to obscure their presence.

Binary Analysis of USB Device Firmware to Detect Malicious Activity

Uses Domain Knowledge of USB Protocol to Validate Device Firmware Against Its Expected Functionality

This USB-specific firmware analysis framework combines symbolic execution and static analysis to model USB controller firmware binaries and characterize a device’s potential for malicious behavior. The USB protocol is extremely versatile, open, and expandable, allowing numerous devices to transfer both data and power. This openness, however, leaves many computing platforms increasingly vulnerable to malicious attacks that exploit the functionality of USB devices. Available USB vetting systems focus on preventing attacks at the protocol level through sandboxing and virtualization or user authorization, which all rely on the device’s external actions to demonstrate its trustworthiness. Without a deep knowledge of the underlying software behind the devices, however, an observer cannot with certainty ensure that a device is benign.

Researchers at the University of Florida have developed a USB device vetting system that uses domain knowledge of the USB protocol to examine a device’s firmware images and determine its capacity for malicious actions. The framework applies symbolic execution targeting algorithms and static analysis to a device’s firmware binaries, modeling the device against its expected functionality reliably to validate a USB device.

Application

Binary analysis framework that examines USB device firmware to identify potentially malicious behavior

Advantages

Applies symbolic analysis to the USB device firmware, detecting malicious code and exploits such as the “BadUSB”
Vets USB controllers by analyzing firmware binaries, eliminating any need for source code
Utilizes improved targeting algorithms and domain knowledge, speeding up analysis by a factor of seven compared to unconstrained fully symbolic execution
Builds a model of the device functionality and compares it with an expected device model, generating a report of identified potentially malicious behaviors

Technology

This USB vetting framework analyzes a device’s extracted firmware image to identify signatures relating to USB operation. The firmware image goes through a static analysis stage, which identifies memory addresses and instructions that would be relevant to an attack scenario. This analysis informs semantic slicing of the firmware to improve subsequent symbolic execution, which discovers program paths that interact with the device. This program knowledge, together with the identified signatures and the database of operational information regarding USB devices, supports construction of a recovered model of operation (representing the actual functionality of the device) and an expected model of operation. After comparing these two models and identifying unexpected or unknown behaviors, the analysis framework generates a report detailing this potentially malicious activity for the user.

Co-Investigator Network

Norman Fitz-Coy

Aso Professor

Kevin Butler

EG-COMPUTER - INFO SCI & ENG | COLLEGE-ENGINEERING

Research Terms & Keywords

Research Projects

Publications

Stories

Center

Technologies

Anti-Malware System Indicator Automatically Detects Malware Based on User Data Changes

Application

Advantages

Technology

Detects SS7 Network Attacks Through Phone Conversations and Alerts Callers in Real Time

Application

Advantages

Technology

Uses Domain Knowledge of USB Protocol to Validate Device Firmware Against Its Expected Functionality

Application

Advantages

Technology

Co-Investigator Network

Expertnet Author Network

Websites

Contact Information

About

Discover

Connect

Keyword Search

Browse by STEM