Academic and Research Appointments

Select Research Leadership Appointments

Education

Professional Affiliations

Student Advising

Teaching

Collaborators (last 4 years, alphabetical)

Research Support

• co-PI, MURI: Cohesive and Robust Human-Bot Cybersecurity Teams, Army Research Office, $ 6,000,0000 (PSU award $ 739,527) , 07/01/2021- 06/30/2026, Collaborators: Many.
• co-PI, SaTC: CORE: Small: Adversarial Network Reconnaissance in Software Defined Networking, NSF (CNS), $ 500,000 (PSU award $ 500,000) , 1/1/2020- 12/31/2022, Collaborators: He (Penn State).
• PI, CNS Core: Medium: Automated IoT Safety and Security Analysis and Synthesis, NSF (CNS), $ 272,033 (PSU award $ 272,033) , 6/25/2019- 6/24/2022, Collaborators: Tan (Penn State).
• PI, Mapping Black-Box Attack Metrics and Parameter Spaces in Machine Learning, US Army Aviation and Missile Research, Development and Engineering Center, $ 436,677 (PSU award $ 436,677) , 6/25/2019- 6/24/2022, Collaborators: (single PI).
• PI, SaTC CORE: Frontier: Collaborative: End-to-End Trustworthiness of Machine-Learning Systems, NSF (CNS), $ 9,649,366 (PSU award $ 2,044,550) , 8/15/2018- 3/31/2023, Collaborators: Boneh (Stanford), Chaudhuri (UCSD), Evans (Virginia), Jha (Wisconsin), Liang (Stanford), Song (Berkeley).
• PI, 2017 SaTC PI Meeting, NSF (CNS), $ 99,999 (PSU award $ 50,230) , 8/15/2016- 3/31/2017, Collaborators: Antonakakis (GaTech), Mason (UIUC).
• PI, TWC: Medium: Collaborative: Scaling and Prioritizing Market-Sized Application Analysis, NSF (CNS), $ 1,147,213 (PSU award $ 547,213) , 7/01/2016- 6/30/2020, Collaborators: Jha (Wisconsin).
• PI, Student Travel Support for Symposium on Security and Privacy 2014, Army Research Office, $ 10,000 (PSU award $ 10,000) , 5/1/14- 5/1/15.
• PI, Models for Enabling Continuous Reconfigurability of Secure Missions (MACRO) Cyber-Security Collaborative Research Alliance (CRA), Army Research Laboratory, $ 24.1 million (\$48.2 million with renewal at 12/17), 9/20/2013- 9/19/2023 (renewed at 5 years), Collaborators: PSU, Carnegie Mellon, Indiana, UC Davis, UC Riverside, ARL, CERDEC.
• PI, Google Faculty Research Award, Plotting a Map of Android Inter-App Communication, Google, $ 50,000, 3/1/2012- 2/28/2013, Collaborators: PSU (McDaniel), TU Darmstadt (Bodden), University of Luxembourg (Traon), .
• PI, Battelle BGP Security Study (Phase 2), Battelle, $ 102,815, 10/1/2012- 9/30/2013, Collaborators: PSU (McDaniel), Oregon (Butler).
• PI, TWC: Medium: Collaborative: Extending Smart-Phone Application Analysis, NSF (CNS), $ 1,386,518 (plus 16k REU supplement) (PSU award $ 534,748) , 8/1/2012- 7/31/2016, Collaborators: PSU (McDaniel), Wisconsin (Jha).
• PI, Battelle BGP Security Study (Phase 1), Battelle, $ 94,400, 2/15/2012- 9/30/2012, Collaborators: PSU (McDaniel).
• co-PI, TC: Medium: Collaborative Research: Building Trustworthy Applications for Mobile Devices, NSF (CNS), $ 1,386,518 (PSU award $ 350,000) , 8/1/2011- 7/31/2014, Collaborators: PSU (McDaniel), Wisconsin (Banerjee, Jha, Swift).
• PI, Closing the Loop on Security Testing and Security Requirements, Security and Software Engineering Research Center, $ 31,000, 8/1/2011- 7/31/2012.
• co-PI, Managing Security and Vulnerability Risks in the Smart Grid, Institute for CyberScience and The Penn State Institutes of Energy and the Environment, $ 31,000, 08/1/09- 12/16/09, Collaborators: PSU (Blumsack, McDaniel).
• PI, Smart Grid Cyber Security Research, Lockheed Martin, $ 250,000, 1/1/10- 12/16/10.
• PI, NSF HECURA: Collaborative Research: Secure Provenance in High-End Computing Systems, NSF (CCF), $ 1,000,000 (PSU award $ 307,073) , 08/1/09- 8/31/13, Collaborators: PSU (McDaniel), UIUC (Winslett), Stonybrook (Sion, Zadok).
• PI, TC: Medium: Collaborative Research: Security Services in Open Telecommunications Networks, NSF (CNS), $ 1,386,518 (PSU award $ 594,941) , 08/01/09- 08/01/12, Collaborators: PSU (McDaniel, La Porta), UPenn (Blaze), Columbia (Schulzrinne).
• PI, Characterizing and Mitigating Wireless Systems Vulnerabilities, Defense University Research Instrumentation Program (DURIP), Army Research Office (ARO), $ 150,000, 05/22/09- 02/28/11, Collaborators: PSU (La Porta, McDaniel).
• co-PI, Integrity Management for ICT Development, Bell Labs Network Reliability and Security Office, Alcatel-Lucent , $ 100,000, 11/30/08- 11/30/09, Collaborators: PSU (La Porta, McDaniel).
• PI, Utility Grid Automation and Risk Management, Lockheed Martin, $ 400,000, 11/30/08- 12/16/09.
• PI, EVEREST: Evaluation and Validation of Election-Related Equipment, Standards, and Testing, The State of Ohio, $ 716,336 (PSU award $ 332,066) , 10/01/07- 01/07/08, Collaborators: PSU (McDaniel), UPenn (Blaze), UCSB (Kemmerer, Vigna), Berkeley (Hall, Quilter).
• Co-PI, Protecting Services for Emerging Wireless Telecommunications Infrastructure, NSF (CNS), $ 658,032, 09/01/07- 08/31/11, Collaborators: PSU (La Porta, Jaeger, McDaniel).
• Co-PI, Security for Internet/IMS Convergence, Cisco, $ 100,000, 9/1/07- 8/31/08, Collaborators: PSU (La Porta, McDaniel).
• Co-PI, System-Wide Information Flow Enforcement, BAA 06-11-IFKA, "National Intelligence Community Enterprise Cyber Assurance Program", $ 496,000, 2/1/07- 8/1/08, Collaborators: PSU (Jaeger, McDaniel).
• PI, CAREER: Realizing Practical High Assurance through Security-Typed Information Flow Systems, NSF (CNS), $ 400,000, 1/2/07- 1/1/12.
• Co-PI, CT-IS: Shamon: Systems Approaches for Constructing Distributed Trust, NSF (CNS), $ 400,000, 9/1/06- 8/31/10, Collaborators: PSU (Jaeger, McDaniel).
• Co-PI, Center of Excellence, Ben Franklin Technology Partners, $ 75,000, 01/01/07- 07/01/07, Collaborators: PSU (Cao, Jaeger, La Porta, McDaniel, Smith).
• Co-PI, Exploiting Asymmetry in Performance and Security Requirements for I/O in High-end Computing, NSF (CFF), $ 699,690, 9/1/06- 8/31/10, Collaborators: PSU (McDaniel, Sivasubramaniam).
• PI, Automated Configuration with the PRESTO Network Management Platform, AT\&T, $ 100,000, 6/1/06- 5/31/07.
• PI, Testbed for Network-Scale Countermeasure Evaluation, Cisco, $ 45,938, 9/1/05- 8/31/06.
• PI, Collaborative Research: CT-T: Flexible, Decentralized Information-flow Control for Dynamic Environments, NSF (CFF), $ 1,057,427 (PSU award $ 234,585) , 8/1/05- 7/31/08, Collaborators: PSU (McDaniel), UPenn (Zdancewic), Maryland (Hicks), GMU (Winsborough).
• PI, Extending Developer Tools for Security-typed Languages, Software Engineering Research Center, Sponsor: Motorola, $ 23,200, 7/1/05- 6/30/06.
• PI, Student Travel Support for ACM SIGCOMM 2005 Conference, NSF, $ 19,620, 4/1/05- 3/31/06.
• Co-PI, NSF CyberTrust: Collaborative Research: Testing and Benchmarking Methodologies for Future Network Security Mechanisms (EMIST), NSF/DHS, $ 5,344,459 (PSU award $ 2,533,447) , 8/1/04- 8/31/06, Collaborators: PSU (Kesidis, Miller, Liu), Purdue (Fahmy, Rosenberg, Spafford, Shroff, Brodley), UCDavis (Wu, Levitt, Bishop, Rowe), ICSI/Berkeley (Paxson, Floyd, Weaver).

Honors, Awards and Keynote Addresses

• Most Influential Paper of PLDI 2014
  • for the paper "FlowDroid: Precise Context, Flow, Field, Object-sensitive and Lifecycle-aware Taint Analysis for Android Apps" , Presented annually to the author(s) of a paper presented at the PLDI held 10 years prior to the award year, June 2024.
• SIGSAC Outstanding Innovation Award
  • for innovative research in mobile device security, trustworthiness of machine learning, and systems security, November 2021
• Penn State Engineering Society Premier Research Award
  • Given to one faculty member per year, the Penn State Engineering Alumni Society Premier Research Award recognizes and rewards an individual whose contributions to scientific knowledge through research are exemplary and internationally acclaimed, April 2021
• AAAS Fellow
  • for distinguished contributions to the field of computational security and privacy, particularly for advancing algorithms for the formal analysis of mobile devices and applications, November 2020
• SIGOPS Hall of Fame Award
  • recognizing the paper "TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones" (Will Enck first author), "which sparked an important research agenda on smartphone privacy that continues to this day", November 2020
• J. D. Williams student paper award, Nuclear Security and Physical Protection division
  • recognizing the best student papers by area in Proceedings of the Institute of Nuclear Materials Management Annual Meeting (INMM), July 2019
• Penn State Engineering Society Outstanding Advising Award
  • highly selective award by the Penn State Engineering Society given to faculty in the College of Engineering who have made significant contributions as advisor, October 2018
• Best Paper, 2017 EAI SECURECOMM 2018
  • with Sayed M. Saghaian, Tom La Porta, Trent Jaeger and Z. Berkay Celik, August 2018
• Best Student Paper, 2017 ACM Symposium on SDN Research (SOSR)
  • with Stefan Achleitner, Thomas La Porta and Trent Jaeger, April 2017
• IEEE Technical Committee on Security and Privacy Outstanding Community Service Award
  • in recognition for leadership of the Technical Committee on Security and Privacy, May 2016
• ACM Fellow
  • for contributions to computer and mobile systems security, December 2015
• Science of Security Index of Significant Research in Cyber Security
  • acknowledging paper 'Toward a Science of Secure Environments', Science of Security Virtual Organization (SOS-VO), August 2015
• IEEE Fellow
  • for contributions to the security of mobile communications, November 2014
• Best Artifact Award, 20th International Symposium on the Foundations of Software Engineering (FSE)
  • with advisee Damien Octeau and collaborator Somesh Jha, November 2012
• Best Paper, 25th Annual Computer Security Applications Conference
  • with advisees Machigar Ongtang, Stephen McLaughlin, and William Enck, December 2009
• Faculty Marshal, College of Engineering
  • selected by student marshals for contributions to undergraduate education, leads procession into graduation ceremony, May 2009
• Penn State Engineering Society Outstanding Research Award
  • highly selective award by the Penn State Engineering Society given to faculty in the College of Engineering who have made significant contributions to knowledge in their field, March 2009
• Google Security and Product Safety Acknowledgement
  • in recognition of efforts in improving the security of Google Android cellular phone operating system, 2008
• Commendation for Exceptional Leadership and Achievement
  • in recognition of efforts as PI of the EVEREST study, from Ohio Secretary of State Jennifer Brunner, August 2008
• IEEE Technical Committee on Security and Privacy Outstanding Community Service Award
  • in recognition for technical program management of the IEEE Security and Privacy symposia, August 2008
• National Science Foundation CAREER Award
  • Faculty early career development grant, August 2007
• Penn State Computer Science and Engineering Outstanding Teaching Award
  • Given to best teacher in the department as selected by students, March 2007
• ACM Certificate of Meritorious Service
  • Certificate acknowledging exemplary service as associate editor of ACM Transactions on Internet Technologies, April 2007
• Best Student Paper, 22nd Annual Computer Security Applications Conference
  • as advisor, with Boniface Hicks and Kiyan Ahmadizadeh, December 2006
• Best Paper, Innovations and Commercial Applications of Distributed Sensor Networks Symposia
  • Awarded for best paper in conference, October 2005.
• Hartz Family Career Development Professor
  • Endowed Professorship, Pennsylvania State University, Fall 2004-2007
• Bang for the Buck Award, DARPA Dynamic Coalitions Program
  • Award for most feature-rich/useful software system, April 2002
• National Aeronautics and Space Administration, Kennedy Space Center Fellowship
  • Research Fellowship, September 1997 - August 2000
• Electrical Engineering and Computer Science Summer Fellowship Award
  • University of Michigan, June 1997
• Dean's Citation for Perfect Academic Record
  • Ball State University, June 1991

• Keynote Addresses

• Securitys Role in Achieving Sustainability, 29th ACM Conference on Computer and Communications Security (CCS), Los Angeles, CA, November, 2022.
• Security, Game Theory, and Their Role in Achieving Sustainability, Conference on Decision and Game Theory for Security, Pittsburgh, PA, October, 2022.
• Prognosticating the Future of IoT Security, 2022 IEEE SafeThings Workshop, San Francisco, CA, May 2022.
• The Challenges of Machine Learning in Adversarial Settings. Triangle Area Privacy and Security Day, Durham, NC, October, 2019.
• The Challenges of Machine Learning in Adversarial Settings. 2019 Subversion and Assurance of AI Workshop, US National Reconnaissance Office, Washington, DC, March, 2019.
• Attacks, Defenses, and Impacts of Machine Learning in Adversarial Settings. 2017 Conference on Security and Privacy in Communication Networks (SecureComm), Niagara Falls, Canada, October, 2017.
• Tracing the Arc of Smartphone Application Security. 2017 ACM on International Workshop on Security And Privacy Analytics. Scottsdale, AZ, March, 2017.
• Tracing the Arc of Smartphone Application Security. 12th International Conference on Information Systems Security, Jaipur, India, December, 2016.
• The 25th International Conference on Computer Communication and Networks (ICCCN 2016), August, 2016, Waikoloa, Hawaii.
• Learning from Ourselves: Where are we and where can we go in mobile systems security?. Mobile Security Technologies (MOST) 2016 Workshop, IEEE Computer Society Security and Privacy Workshops, San Jose, CA, May, 2016.
• Eight Years of Mobile Smartphone Security. Center for Secure and Dependable Systems (CSDS) Cybersecurity Symposium, Coeur d'Alene, April, 2016.
• The Importance of Measurement and Decision Making to a Science of Security, 2015 IEEE Conference on Communications and Network Security (CNS), September 2015, Florence, Italy.
• The Importance of Measurement and Decision Making to a Science of Security. 3rd International Symposium on Resilient Cyber Systems, Philadelphia, PA, August, 2015.
• The Importance of Measurement and Decision Making to a Science of Security, 2015 Symposium And Bootcamp on the Science of Security (Hotsos), April 2015, University of Illinois at Urbana-Champaign
• Security and Science of Agility, ACM Workshop on Moving Target Defense (MTD 2014), November 2014, Scottsdale, AZ
• A Secondary Internet Revolution: How the Smart Device has Changed the Information Security Landscape, IEEE New Technology Industry Seminar (NTIS `13), Everett WA, August, 2013
• Permission-based Application Governance; A Step Forward or Backward?, 26th Annual WG 11.3 Conference on Data and Applications Security and Privacy (DBSec'12), Paris, France, July 2012.
• Scalable Integrity-Guaranteed AJAX, The 14th Asia-Pacific Web Conference (APWeb), Kunming, China, April 2012.
• Security Challenges and Solutions in Mobile Smartphone Applications, IEEE Computer Security Foundations (CSF 2011), Abbaye des Vaux de Cernay, France, June 2012.
• Password Exhaustion: Predicting the End of Password Usefulness. 2nd International Conference on Information Systems Security, Kolkata India, December, 2006.
• Physical and Digital Convergence: Where the Internet is the Enemy. Eighth International Conference on Information and Communications Security (ICICS '06), Raleigh, NC, December, 2006.
• Distinguished Lectures

• Adversarial Machine Learning: A 10-year Perspective, NSF ACTION AI Institute Distinguished Lecture Series, Virtual, December, 2024.
• Adversarial Machine Learning: A 10-year Perspective, University of Illinois, Champaign-Urbana, Champaign, IL, November, 2024.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, University of California, Los Angeles, Los Angeles, CA, December, 2023.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Michigan State University, Lansing, MI, November, 2023.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective. Computer Science Department, Temple University, Philadelphia, PA, February, 2022.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective. Computer Science Department, University of Wisconsin-Madison, Madison, WI, February, 2020.
• Shutterstock Distinguished Lecture: The Challenges of Machine Learning in Adversarial Settings. Computer Science Department, Stonybrook University, Stonybrook, NY, December, 2019.
• Distinguished Blockchain Lecture: The Challenges of Machine Learning in Adversarial Settings. Cylab Security and Privacy Institute, Carnegie Mellon University, Pittsburgh, PA, December, 2019.
• Distinguished Speaker Series: The Challenges of Machine Learning in Adversarial Settings. Department of Computer Science, University at Buffalo, Buffalo, NY, November, 2018.
• Samuel D. Conte Distinguished Lecture Series: The Challenges of Machine Learning in Adversarial Settings. Department of Computer Science, Purdue University, West Lafeyette, Indiana, November, 2018.
• The Challenges of Machine Learning in Adversarial Settings. Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC, February, 2018.
• Tracing the Arc of Smartphone Application Security. Celebrating 50 Years of Computer Science @ NC State, North Carolina State University, Raleigh, NC, October, 2017.
• Tracing the Arc of Smartphone Application Security. Computer Science Department and the Electrical and Computer Engineering Department Seminar Series, Colorado State University, Fort Colins, CO, October, 2017.
• Tracing the Arc of Smartphone Application Security. Rochester Institute of Technology, College of Computing and Information Sciences, Rochester, NY, September, 2017.
• Tracing the Arc of Smartphone Application Security, University of Texas-Dallas Department of Computer Science, Dallas, TX, May 2017.
• Tracing the Arc of Smartphone Application Security. Rochester Institute of Technology, College of Computing and Information Sciences, Rochester, NY, May 2017.
• Tracing the Arc of Smartphone Application Security. University of California-Irvine, Computer Science Department, Irvine CA, March, 2017.
• Tracing the Arc of Smartphone Application Security. The Ohio State University, Department of Computer Science and Engineering, Columbus, OH, March, 2017.
• Tracing the Arc of Smartphone Application Security. Virginia Technical University, Department of Computer Science, Blacksburg, VA, March, 2017.
• Six Years of Mobile Smartphone Security, CISPA Distinguished Lecture Series, Max Planck Institute/Saarland University, Saarbrucken Germany, July, 2015.
• Six Years of Mobile Smartphone Security. Technische Universtat Darmstadt, Darmstadt Germany, July, 2015.
• Security Challenges and Solutions in Mobile Smartphone Applications. Computer and Information Science Department, University of Oregon, Eugene, OR, April, 2011.
• Security Challenges and Solutions in Mobile Smartphone Applications. Department of Software Information Systems College of Computing and Informatics, UNC Charlotte, Charlotte, NC, December, 2010.

Patents

Professional Service

Expert Witness

• Certain Mobile Phones, Components Thereof, and Products Containing Same, ITC Inv. No. 337-TA-1375, and In the Matter of Certain Electronic Devices, Including Mobile Phones, Tablets, Laptops, Components Thereof, and Products Containing the Same, Expert for Expert for the defense (Lenovo), International Trade Court, Case no. No. 337-TA-1375; No. 337-TA-1376; No. 5:23- cv-569; No. 5:23-cv-570.
• DivX, LLC v. Hulu, LLC and Netflix, Inc., Expert for Expert for the defense, Central District of California, Case no. Case No. 2:19-cv-01602.
• Inter Partes Review, Expert for Expert for Apple Inc., United States Patent and Trademark Office, Case no. Patent No 10,929,512.
• Finjan Inc., vs. Rapid7 Inc and Rapid7 LLC, Expert for Expert for Rapid7, District of Delaware, Case no. C.A. No. 1:18-CV-01519-MN.
• Finjan Inc., vs. Cisco Systems, Inc., Expert for Expert for CISCO, Northern District of California, San Jose Division, Case no. Case No. 5:17-cv-00072-BLF-SVK.
• Rimini Street, Inc. v. Oracle International Corporation, Expert for Expert for Oracle, United States District Court, District of Nevada, Case no. Case No. 2:14-cv-01699.
• Inter Partes Review, Expert for Expert for Samsung Electronics Co., Ltd., United States Patent and Trademark Office, Case no. Patent Nos 9,277,433 and 9,521,578.
• Inter Partes Review, Expert for Expert for Dropbox Inc., United States Patent and Trademark Office, Case no. Patent Nos 8,484,260 and 8,296,338.
• Finjan, LLC. v. SonicWall Inc., Expert for Expert for SonicWall, Northern District of California, Case no. Case No. 5:17-cv-04467-BLF-VKD.
• WebRoot, INC. and OpenText, Inc. v Kaspersky Lab, Trent Micro, Sophos LTD., Crowdstrike Holdings, INC, and Forcepoint, LCC., Expert for Expert for the Plaintiff, Western District of Texas, Case no. 6:22-CV-00243-ADA-DTG, 6:22-CV-00239-ADA-DTG, 6:22-CV-00240-ADA-DTG, 6:22-CV-00241-ADA-DTG, FORCEPOINT, LLC, and 6:22-CV-00342-ADA-DTG.

Industrial Experience