Skip to main content
Previous page
Next page

Groups

The Security Cluster consists of the following groups. The people in the cluster are listed on the Staff page.

Threat Analysis

We study attacker actions in order to support human analysts in finding their traces in log and alert data. This research concerns two overarching topics:

  • Threat Intelligence, which studies attackers in their ecosystem and social engineering frontiers.
  • Security Monitoring in a Security Operations Center, which studies analyst processes and models for log analysis.

Staff Expertise

  • Luca Allodi: Investigates attacker operations, economics, and how these are ultimately delivered to the (human) user to improve operational defense capabilities.
  • Emmanuele Zambon: Investigates the security of Industrial Control Systems (ICS) to improve their defense capabilities.
  • Christoffer Leite da Silva: IoT, cyber threat intelligence, anomaly detection.
  • Peter Boosten: Networking within the small world called cybersecurity.
  • Roelf Wichertjes: Everything and anything on the operational side of IT.
  • Sam Baggen: Trying to keep the IT afloat.

Data Protection

Privacy and security of electronic data (e.g., electronic health records, financial data, demographic data) has become a hugely important issue. Access control is often employed as the first line of defense for data protection. Existing access control models and mechanisms, however, are often not suited for the challenges introduced by modern IT systems. Moreover, access control can be circumvented, for instance, by insiders exploiting policy misconfiguration or by attackers gaining unauthorized access through social engineering attacks against legitimate users. The Data Protection group aims to realize novel theories, methods, and technology that enable the realization of an adaptive authorization infrastructure capable of responding to security threats. To achieve this goal, we focus on three orthogonal and complementary research lines: Access Control, Data analytics for security, and Social Engineering.

Staff Expertise

  • Nicola Zannone: Access Control, Data analytics for Security, Social Engineering
  • Savio Sciancalepore: Applied Network Security and Privacy for IoT, IoT Security, Network Security for IoT, Wireless Security for IoT, Mobile Security
  • Dung Le: Lead developer of the SAFAX project.

Security

Research in the Security (SEC) group spans two areas vital to the security of decentralized and embedded systems, and has its center of gravity in the intersection of these areas. The two areas are security policy specification & enforcement and security of embedded systems.

Security Policy Specification

While the Internet allows for a free exchange of data, the security boundaries needed to guarantee privacy and confidentiality have become the main obstacle to flexible cooperation within and between (virtual) organizations. The classical preventive access control mechanisms cannot cope with heterogeneous distributed systems and they have to be at least partially replaced by more elaborate trust management and compliance control systems. This is where SEC expertise lies: in the specification and implementation of policies for distributed systems.

Security of Embedded Systems

Securing networked embedded systems is particularly challenging because of their lack of computational and physical resources. In this area, SEC focuses presently on the security of mobile (e.g. smart-card based) systems; for instance in the PinpasJC project we are studying side channel attacks on smart cards. One of the challenges that embedded devices face is secure key storage. This issue is addressed by SEC’s research on Physical Unclonable Functions, a novel approach based on the extraction of randomness from the physical components of the device itself. Also in this area and closely linked to coding and crypto we have the project PinpasJC (on the analysis of smart card algorithms to identify possible side-channel attacks). These areas overlap to a great extent and their intersection forms the core of SEC’s research: compliance control for distributed and embedded systems. SEC’s approach is to start from a concrete security problem and solve it by addressing the fundamental issues behind it. SEC’s strength lies precisely in the ability to understand deeply both the user’s concern as well as the theory behind it.

Staff Expertise

  • Sandro Etalle: Network intrusion detection, protection of industrial control systems and trust management.
  • Wil Michiels: Cryptography, reverse engineering and attack tracing.
  • Milan Petkovic: Artificial intelligence and Machine Learning, Secure data management and Big Data.
  • Boris Skoric: Security with noisy data, using quantum physics for security and collusion-resistant watermarking codes.
  • Jerry den Hartog: Network situational awareness and intrusion detection as well as on access control, trust management and formal verification.