Max-Planck-Institut für Informatik
max planck institut
informatik
mpii logo Minerva of the Max Planck Society
 

MPI-INF or MPI-SWS or Local Campus Event Calendar

<< Previous Entry Next Entry >> New Event Entry Edit this Entry Login to DB (to update, delete)
What and Who
Title:Data-driven Software security: Motivation and Methods
Speaker:Ulfar Erlingsson
coming from:Google
Speakers Bio:Úlfar currently heads a security research team at Google. Previously, he has been a researcher at Microsoft Research, Silicon Valley,

an Associate Professor at Reykjavik University, Iceland, and led security technology at two startups: GreenBorder and deCODE Genetics.
He holds a PhD in computer science from Cornell University.

Event Type:SWS Distinguished Lecture Series
Visibility:SWS, RG1, MMCI
We use this to send out email in the morning.
Level:Expert Audience
Language:English
Date, Time and Location
Date:Wednesday, 20 April 2016
Please note: New Time!
Time:13:00
Duration:90 Minutes
Location:Saarbrücken
Building:E1 5
Room:002
Abstract
For computer software, our security models, policies, mechanisms, and means of assurance were primarily conceived and developed before the end of the 1970's. However, since that time, software has changed radically: it is thousands of times larger, comprises countless libraries, layers, and services, and is used for more purposes, in far more complex ways. This suggests that we should revisit some of our core computer security concepts. For example, what does the Principle of Least Privilege mean when all software contains libraries that can express arbitrary functionality? And, what security policy should be enforced when software is too complex for either its developers or its users to explain its intended behavior in detail?
One possibility is to take an empirical, data-driven approach to modern software, and determine its exact, concrete behavior via comprehensive, online monitoring. Such an approach can be a practical, effective basis for security—as demonstrated by its success in spam and abuse fighting—but its use to constrain software behavior raises many questions. In particular, two questions seem critical. First, is it possible to learn the details of how software *is* behaving, without intruding on the privacy of its users?  Second, are those details a good foundation for deriving security policies that constrain how software *should* behave?  This talk answers both these questions in the affirmative, as part of an overall approach to data-driven security. Specifically, the talk describes techniques for learning detailed software statistics while providing differential privacy for its users, and how deep learning can help derive useful security policies that match users' expectations with intended software behavior. Those techniques are both practical and easy to adopt, and have already been used at scale for billions of users.
Contact
Name(s):Claudia Richter
Phone:9303 9103
EMail:--email address not disclosed on the web
Video Broadcast
Video Broadcast:YesTo Location:Kaiserslautern
To Building:G26To Room:111
Tags, Category, Keywords and additional notes
Note:
Attachments, File(s):

Created by:Claudia Richter/MPI-SWS, 04/15/2016 11:31 AMLast modified by:Uwe Brahm/MPII/DE, 11/24/2016 04:14 PM
  • Christian Klein, 10/13/2016 04:02 PM
  • Claudia Richter, 04/18/2016 09:42 AM
  • Claudia Richter, 04/15/2016 11:37 AM -- Created document.