Academic and Research Appointments

Select Research Leadership Appointments

Education

Professional Affiliations

Non-Professional Affiliations

Student Advising

Teaching

Collaborators (last 4 years, alphabetical)

Research Support

• co-PI, MURI: Cohesive and Robust Human-Bot Cybersecurity Teams, Army Research Office, $ 6,000,0000 (PSU award $ 739,527) , 07/01/2021- 06/30/2026, Collaborators: Many.
• co-PI, SaTC: CORE: Small: Adversarial Network Reconnaissance in Software Defined Networking, NSF (CNS), $ 500,000 (PSU award $ 500,000) , 1/1/2020- 12/31/2022, Collaborators: He (Penn State).
• PI, CNS Core: Medium: Automated IoT Safety and Security Analysis and Synthesis, NSF (CNS), $ 272,033 (PSU award $ 272,033) , 6/25/2019- 6/24/2022, Collaborators: Tan (Penn State).
• PI, Mapping Black-Box Attack Metrics and Parameter Spaces in Machine Learning, US Army Aviation and Missile Research, Development and Engineering Center, $ 436,677 (PSU award $ 436,677) , 6/25/2019- 6/24/2022, Collaborators: (single PI).
• PI, SaTC CORE: Frontier: Collaborative: End-to-End Trustworthiness of Machine-Learning Systems, NSF (CNS), $ 9,649,366 (PSU award $ 2,044,550) , 8/15/2018- 3/31/2023, Collaborators: Boneh (Stanford), Chaudhuri (UCSD), Evans (Virginia), Jha (Wisconsin), Liang (Stanford), Song (Berkeley).
• PI, 2017 SaTC PI Meeting, NSF (CNS), $ 99,999 (PSU award $ 50,230) , 8/15/2016- 3/31/2017, Collaborators: Antonakakis (GaTech), Mason (UIUC).
• PI, TWC: Medium: Collaborative: Scaling and Prioritizing Market-Sized Application Analysis, NSF (CNS), $ 1,147,213 (PSU award $ 547,213) , 7/01/2016- 6/30/2020, Collaborators: Jha (Wisconsin).
• PI, Student Travel Support for Symposium on Security and Privacy 2014, Army Research Office, $ 10,000 (PSU award $ 10,000) , 5/1/14- 5/1/15.
• PI, Models for Enabling Continuous Reconfigurability of Secure Missions (MACRO) Cyber-Security Collaborative Research Alliance (CRA), Army Research Laboratory, $ 24.1 million (\$48.2 million with renewal at 12/17), 9/20/2013- 9/19/2023 (renewed at 5 years), Collaborators: PSU, Carnegie Mellon, Indiana, UC Davis, UC Riverside, ARL, CERDEC.
• PI, Google Faculty Research Award, Plotting a Map of Android Inter-App Communication, Google, $ 50,000, 3/1/2012- 2/28/2013, Collaborators: PSU (McDaniel), TU Darmstadt (Bodden), University of Luxembourg (Traon), .
• PI, Battelle BGP Security Study (Phase 2), Battelle, $ 102,815, 10/1/2012- 9/30/2013, Collaborators: PSU (McDaniel), Oregon (Butler).
• PI, TWC: Medium: Collaborative: Extending Smart-Phone Application Analysis, NSF (CNS), $ 1,386,518 (plus 16k REU supplement) (PSU award $ 534,748) , 8/1/2012- 7/31/2016, Collaborators: PSU (McDaniel), Wisconsin (Jha).
• PI, Battelle BGP Security Study (Phase 1), Battelle, $ 94,400, 2/15/2012- 9/30/2012, Collaborators: PSU (McDaniel).
• co-PI, TC: Medium: Collaborative Research: Building Trustworthy Applications for Mobile Devices, NSF (CNS), $ 1,386,518 (PSU award $ 350,000) , 8/1/2011- 7/31/2014, Collaborators: PSU (McDaniel), Wisconsin (Banerjee, Jha, Swift).
• PI, Closing the Loop on Security Testing and Security Requirements, Security and Software Engineering Research Center, $ 31,000, 8/1/2011- 7/31/2012.
• co-PI, Managing Security and Vulnerability Risks in the Smart Grid, Institute for CyberScience and The Penn State Institutes of Energy and the Environment, $ 31,000, 08/1/09- 12/16/09, Collaborators: PSU (Blumsack, McDaniel).
• PI, Smart Grid Cyber Security Research, Lockheed Martin, $ 250,000, 1/1/10- 12/16/10.
• PI, NSF HECURA: Collaborative Research: Secure Provenance in High-End Computing Systems, NSF (CCF), $ 1,000,000 (PSU award $ 307,073) , 08/1/09- 8/31/13, Collaborators: PSU (McDaniel), UIUC (Winslett), Stonybrook (Sion, Zadok).
• PI, TC: Medium: Collaborative Research: Security Services in Open Telecommunications Networks, NSF (CNS), $ 1,386,518 (PSU award $ 594,941) , 08/01/09- 08/01/12, Collaborators: PSU (McDaniel, La Porta), UPenn (Blaze), Columbia (Schulzrinne).
• PI, Characterizing and Mitigating Wireless Systems Vulnerabilities, Defense University Research Instrumentation Program (DURIP), Army Research Office (ARO), $ 150,000, 05/22/09- 02/28/11, Collaborators: PSU (La Porta, McDaniel).
• co-PI, Integrity Management for ICT Development, Bell Labs Network Reliability and Security Office, Alcatel-Lucent , $ 100,000, 11/30/08- 11/30/09, Collaborators: PSU (La Porta, McDaniel).
• PI, Utility Grid Automation and Risk Management, Lockheed Martin, $ 400,000, 11/30/08- 12/16/09.
• PI, EVEREST: Evaluation and Validation of Election-Related Equipment, Standards, and Testing, The State of Ohio, $ 716,336 (PSU award $ 332,066) , 10/01/07- 01/07/08, Collaborators: PSU (McDaniel), UPenn (Blaze), UCSB (Kemmerer, Vigna), Berkeley (Hall, Quilter).
• Co-PI, Protecting Services for Emerging Wireless Telecommunications Infrastructure, NSF (CNS), $ 658,032, 09/01/07- 08/31/11, Collaborators: PSU (La Porta, Jaeger, McDaniel).
• Co-PI, Security for Internet/IMS Convergence, Cisco, $ 100,000, 9/1/07- 8/31/08, Collaborators: PSU (La Porta, McDaniel).
• Co-PI, System-Wide Information Flow Enforcement, BAA 06-11-IFKA, "National Intelligence Community Enterprise Cyber Assurance Program", $ 496,000, 2/1/07- 8/1/08, Collaborators: PSU (Jaeger, McDaniel).
• PI, CAREER: Realizing Practical High Assurance through Security-Typed Information Flow Systems, NSF (CNS), $ 400,000, 1/2/07- 1/1/12.
• Co-PI, CT-IS: Shamon: Systems Approaches for Constructing Distributed Trust, NSF (CNS), $ 400,000, 9/1/06- 8/31/10, Collaborators: PSU (Jaeger, McDaniel).
• Co-PI, Center of Excellence, Ben Franklin Technology Partners, $ 75,000, 01/01/07- 07/01/07, Collaborators: PSU (Cao, Jaeger, La Porta, McDaniel, Smith).
• Co-PI, Exploiting Asymmetry in Performance and Security Requirements for I/O in High-end Computing, NSF (CFF), $ 699,690, 9/1/06- 8/31/10, Collaborators: PSU (McDaniel, Sivasubramaniam).
• PI, Automated Configuration with the PRESTO Network Management Platform, AT\&T, $ 100,000, 6/1/06- 5/31/07.
• PI, Testbed for Network-Scale Countermeasure Evaluation, Cisco, $ 45,938, 9/1/05- 8/31/06.
• PI, Collaborative Research: CT-T: Flexible, Decentralized Information-flow Control for Dynamic Environments, NSF (CFF), $ 1,057,427 (PSU award $ 234,585) , 8/1/05- 7/31/08, Collaborators: PSU (McDaniel), UPenn (Zdancewic), Maryland (Hicks), GMU (Winsborough).
• PI, Extending Developer Tools for Security-typed Languages, Software Engineering Research Center, Sponsor: Motorola, $ 23,200, 7/1/05- 6/30/06.
• PI, Student Travel Support for ACM SIGCOMM 2005 Conference, NSF, $ 19,620, 4/1/05- 3/31/06.
• Co-PI, NSF CyberTrust: Collaborative Research: Testing and Benchmarking Methodologies for Future Network Security Mechanisms (EMIST), NSF/DHS, $ 5,344,459 (PSU award $ 2,533,447) , 8/1/04- 8/31/06, Collaborators: PSU (Kesidis, Miller, Liu), Purdue (Fahmy, Rosenberg, Spafford, Shroff, Brodley), UCDavis (Wu, Levitt, Bishop, Rowe), ICSI/Berkeley (Paxson, Floyd, Weaver).

Honors, Awards and Keynote Addresses

• Tsun-Ming Shih Professor of Computer Sciences
  • Endowed Professorship, University of Wisconsin-Madison, 2022
• SIGSAC Outstanding Innovation Award
  • for innovative research in mobile device security, trustworthiness of machine learning, and systems security, ACM Special Interest Group on Security, Audit and Control (SIGSAC), 2021
• AAAS Fellow
  • for distinguished contributions to the field of computational security and privacy, particularly for advancing algorithms for the formal analysis of mobile devices and applications, American Association for the Advancement of Science (AAAS), 2021
• Penn State Engineering Society Premier Research Award
  • Given to one faculty member per year, the Penn State Engineering Alumni Society Premier Research Award recognizes and rewards an individual whose contributions to scientific knowledge through research are exemplary and internationally acclaimed, Penn State University, 2021
• SIGOPS Hall of Fame Award
  • recognizing the paper "TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones" (Will Enck first author), "which sparked an important research agenda on smartphone privacy that continues to this day", ACM Special interest Group in Operating Systems (SIGOPS), 2020
• Penn State Engineering Society Outstanding Advising Award
  • award by the Penn State Engineering Society given to faculty in the College of Engineering who have made significant contributions as advisor, Penn State University, 2018
• William L. Weiss Professor of Information and Communications Technology
  • Endowed Professorship, Pennsylvania State University, 2017
• Outstanding Community Service Award
  • n recognition for leadership of the Technical Committee on Security and Privacy, IEEE Technical Committee on Security and Privacy, 2016
• ACM Fellow
  • for contributions to computer and mobile systems security, Association for Computing Machinery (ACM), 2015
• IEEE Fellow
  • for contributions to the security of mobile communication, Institute of Electrical and Electronics Engineers (IEEE), 2014
• Faculty Marshal, College of Engineering
  • selected by student marshals for contributions to undergraduate education, leads procession into graduation ceremony, Penn State University, 2009
• Penn State Engineering Society Outstanding Research Award
  • award by the Penn State Engineering Society given to faculty in the College of Engineering who have made significant contributions to knowledge in their field, Penn State University, 2009
• Security and Product Safety Acknowledgement
  • in recognition of efforts in improving the security of Google Android cellular phone operating system, Google, 2008
• Commendation for Exceptional Leadership and Achievement
  • in recognition of efforts as PI of the EVEREST study on election security in the state of Ohio, State of Ohio, 2008
• IEEE Technical Committee on Security and Privacy Outstanding Community Service Award
  • in recognition for technical program management of the IEEE Security and Privacy symposia, Institute of Electrical and Electronics Engineers (IEEE), 2008
• CAREER Award
  • highly competitive faculty early career research grant, National Science Foundation, 2007
• Penn State Computer Science and Engineering Outstanding Teaching Award
  • given to best teacher in the department as selected by students, Department of Computer Science and Engineering, Penn State University, 2007
• Certificate of Meritorious Service
  • acknowledging exemplary service as associate editor of ACM Transactions on Internet Technologies, Association for Computing Machinery (ACM), 2007
• Hartz Family Career Development Professor
  • Devlopment Chair Professorship, Penn State University, 2004
• Bang for the Buck Award
  • award for most feature-rich/useful software system in Dynamic Coalitions program, Defense Advanced Research Projects Agency (DARPA), 2002
• Kennedy Space Center Fellowship
  • Graduate Research Fellowship, National Aeronautics and Space Administration (NASA), 1997
• Electrical Engineering and Computer Science Summer Fellowship Award
  • summer research fellowship, University of Michigan, Ann Arbor, 1997
• Dean's Citation for Perfect Academic Record
  • acknowledement of perfect academic record earned during master's degree, Ball State University, 1991

• Paper Awards

• Andreas Pfitzmann Best Student Paper Award (runner-up), For paper: "Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)", Proceedings on Privacy Enhancing Technologies (PETS), 2024
• Most Influential Paper of PLDI, For paper: "FlowDroid: Precise Context, Flow, Field, Object-sensitive and Lifecycle-aware Taint Analysis for Android Apps", Proceedings of the 35th Conference on Programming Language Design and Implementation (PLDI), 2024
• Test of Time Award, For paper: "Semantically Rich Application-Centric Security in Android", Proceedings of the 25th Annual Computer Security Applications Conference (ACSAC), 2024
• Best paper (runner up), For paper: "The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits Against Two Years of Zero-Days", Proceedings of the ACM 2023 Internet Measurement Conference (IMC), 2023
• CSAW ARC Finalist, For paper: "DScope: A Cloud-Native Internet Telescope", 32nd USENIX Security Symposium (USENIX Security 23), 2023
• Best paper, For paper: "Understanding the Ethical Frameworks of Internet Measurement Studies", The 2nd International Workshop on Ethics in Computer Security (EthiCS 2023), 2023
• J. D. Williams student paper award, Nuclear Security and Physical Protection division, For paper: "Development of Machine Learning Algorithms for Directional Gamma Ray Detection", Proceedings of the Institute of Nuclear Materials Management Annual Meeting (INMM), 2019
• Best paper, For paper: "Mission-oriented Security Model, Incorporating Security Risk, Cost and Payout", EAI International Conference on Security and Privacy in Communication Networks (SECURECOMM), 2018
• Best student paper, For paper: "Adversarial Network Forensics in Software Defined Networking", ACM Symposium on SDN Research (SOSR), 2017
• Science of Security Index of Significant Research in Cyber Security, Science of Security Virtual Organization (SOS-VO), For paper: "Toward a Science of Secure Environments", IEEE Security \& Privacy Magazine, 2015
• Research Highlight, For paper: "TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones", Communications of the ACM, 2014
• Best artifact, For paper: "Retargeting Android Applications to Java Bytecode", 20th International Symposium on the Foundations of Software Engineering (FSE), 2012
• Best Paper, For paper: "Semantically Rich Application-Centric Security in Android", Proceedings of the 25th Annual Computer Security Applications Conference (ACSAC), 2009
• Best Student Paper, For paper: "Understanding Practical Application Development in Security-Typed Languages", 22st Annual Computer Security Applications Conference (ACSAC), 2006
• Best paper, For paper: "The Sleep Deprivation Attack in Sensor Networks: Analysis and Methods of Defense", Proceedings of the Innovations and Commercial Applications of Distributed Sensor Networks Symposi, 2005

• Keynote Addresses

• Security’s Role in Achieving Sustainability, 29th ACM Conference on Computer and Communications Security (CCS), Los Angeles, CA, November, 2022.
• Security, Game Theory, and Their Role in Achieving Sustainability, Conference on Decision and Game Theory for Security, Pittsburgh, PA, October, 2022.
• Prognosticating the Future of IoT Security, 2022 IEEE SafeThings Workshop, San Francisco, CA, May, 2022.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Robustness of AI Systems to Adversarial Attacks (RAISA3), Online, August, 2020.
• The Challenges of Machine Learning in Adversarial Settings, Triangle Area Privacy and Security Day, Durham, NC, October, 2019.
• The Challenges of Machine Learning in Adversarial Settings, 2019 Subversion and Assurance of AI Workshop, US National Reconnaissance Office, Washington, DC, March, 2019.
• Attacks, Defenses, and Impacts of Machine Learning in Adversarial Settings, 2017 Conference on Security and Privacy in Communication Networks (SecureComm), Niagara Falls, Canada, October, 2017.
• Tracing the Arc of Smartphone Application Security, 2017 ACM on International Workshop on Security And Privacy Analytics, Scottsdale, AZ, March, 2017.
• Tracing the Arc of Smartphone Application Security, 12th International Conference on Information Systems Security , Jaipur, India, December, 2016.
• The Limitations of Machine Learning in Adversarial Settings, 25th International Conference on Computer Communication and Networks (ICCCN 2016), Waikoloa, HI, August, 2016.
• Learning from Ourselves: Where are we and where can we go in mobile systems security?, Mobile Security Technologies (MOST) 2016 Workshop, IEEE Computer Society Security and Privacy Workshops, San Jose, CA, May, 2016.
• Eight Years of Mobile Smartphone Security, Center for Secure and Dependable Systems (CSDS) Cybersecurity Symposium, Coeur d'Alene, April, 2016.
• The Importance of Measurement and Decision Making to a Science of Security, 2015 IEEE Conference on Communications and Network Security, Florence, Italy, September, 2015.
• The Importance of Measurement and Decision Making to a Science of Security, 3rd International Symposium on Resilient Cyber Systems, Philadelphia, PA, August, 2015.
• The Importance of Measurement and Decision Making to a Science of Security, 2015 Symposium and Bootcamp on the Science of Security (Hotsos), University of Illinois at Urbana-Champaign, April, 2015.
• Security and Science of Agility, First ACM Workshop on Moving Target Defense (MTD 2014), Scottsdale, AZ, November, 2014.
• A Secondary Internet Revolution: How the Smart Device has Changed the Information Security Landscape, IEEE New Technology Industry Seminar (NTIS `13), Everett, WA, August, 2013.
• Permission-based Application Governance; A Step Forward or Backward?, 26th Annual WG 11.3 Conference on Data and Applications Security and Privacy (DBSec'12), Paris, France, July, 2012.
• Scalable Integrity-Guaranteed AJAX, The 14th Asia-Pacific Web Conference (APWeb), Kunming, China, April, 2012.
• Security Challenges and Solutions in Mobile Smartphone Applications, Computer Security Foundations Symposium, Domaine de l'Abbaye des Vaux de Cernay, France, June, 2011.
• Password Exhaustion: Predicting the End of Password Usefulness, 2nd International Conference on Information Systems Security , Kolkata, India, December, 2006.
• Physical and Digital Convergence: Where the Internet is the Enemy, Eighth International Conference on Information and Communications Security (ICICS '06), Raleigh, NC, December, 2006.
• Distinguished Lectures

• Adversarial Machine Learning: A 10-year Perspective, Department of Electrical and Computer Engineering, Iowa State University, Ames, IA, January, 2025.
• Adversarial Machine Learning: A 10-year Perspective, NSF ACTION AI Institute Distinguished Lecture Series, Virtual, December, 2024.
• Adversarial Machine Learning: A 10-year Perspective, Department of Electrical and Computer Engineering, University of Illinois, Champaign-Urbana, Champaign, IL, November, 2024.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Department of Electrical and Computer Engineering, University of California, Los Angeles, Los Angeles, CA, December, 2023.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Computer Science Department, Michigan State University, Lansing, MI, November, 2023.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Temple University, Philadelphia, PA, March, 2022.
• The Challenges of Machine Learning in Adversarial Settings: A Systems Perspective, Computer Science Department, University of Wisconsin-Madison, Madison, WI, February, 2020.
• The Challenges of Machine Learning in Adversarial Settings, Computer Science Department, Stonybrook University, Stonybrook, NY, December, 2019.
• The Challenges of Machine Learning in Adversarial Settings, Cylab Security and Privacy Institute, Carnegie Mellon University, Pittsburgh, PA, December, 2019.
• The Challenges of Machine Learning in Adversarial Settings, Department of Computer Science, University at Buffalo, Buffalo, NY, November, 2018.
• The Challenges of Machine Learning in Adversarial Settings, Department of Computer Science, Purdue University, West Lafeyette, Indiana, November, 2018.
• The Challenges of Machine Learning in Adversarial Settings, Department of Software and Information Systems, University of North Carolina at Charlotte, Charlotte, NC, February, 2018.
• Attacks, Defenses, and Impacts of Machine Learning in Adversarial Settings, Celebrating 50 Years of Computer Science @ NC State, North Carolina State University, Raleigh, NC, October, 2017.
• Tracing the Arc of Smartphone Application Security, Computer Science Department and the Electrical and Computer Engineering Department Seminar Series, Colorado State University, Fort Collins, CO, October, 2017.
• Tracing the Arc of Smartphone Application Security, Rochester Institute of Technology, College of Computing and Information Sciences, Rochester, NY, September, 2017.
• Tracing the Arc of Smartphone Application Security, University of Texas-Dallas, Department of Computer Science, Dallas, TX, May, 2017.
• Tracing the Arc of Smartphone Application Security, The Ohio State University, Department of Computer Science and Engineering, Columbus, OH, March, 2017.
• Tracing the Arc of Smartphone Application Security, University of California-Irvine, Computer Science Department, Irvine, CA, March, 2017.
• Tracing the Arc of Smartphone Application Security, Virginia Technical University, Department of Computer Science, Blacksburg, VA, March, 2017.
• Six Years of Mobile Smartphone Security, CISPA Distinguished Lecture Series, Max Planck Institute/Saarland University, Saarbrucken Germany, July, 2015.
• Six Years of Mobile Smartphone Security, Technische Universtat Darmstadt, Darmstadt Germany, July, 2015.
• Security Challenges and Solutions in Mobile Smartphone Applications, Computer and Information Science Department, University of Oregon, Eugene, OR, April, 2011.
• Security Challenges and Solutions in Mobile Smartphone Applications, Department of Software Information Systems College of Computing and Informatics, UNC Charlotte, Charlotte, NC, December, 2010.
• Exploiting Open Functionality in SMS-Capable Cellular Networks, Computer Science Department, University of Virginia, Charlottesville, VA, January, 2006.

Patents

Professional Service

Expert Witness

• Certain Mobile Phones, Components Thereof, and Products Containing Same, ITC Inv. No. 337-TA-1375, and In the Matter of Certain Electronic Devices, Including Mobile Phones, Tablets, Laptops, Components Thereof, and Products Containing the Same, Expert for Expert for the defense (Lenovo), International Trade Court, Case no. No. 337-TA-1375; No. 337-TA-1376; No. 5:23- cv-569; No. 5:23-cv-570.
• DivX, LLC v. Hulu, LLC and Netflix, Inc., Expert for Expert for the defense, Central District of California, Case no. Case No. 2:19-cv-01602.
• Inter Partes Review, Expert for Expert for Apple Inc., United States Patent and Trademark Office, Case no. Patent No 10,929,512.
• Finjan Inc., vs. Rapid7 Inc and Rapid7 LLC, Expert for Expert for Rapid7, District of Delaware, Case no. C.A. No. 1:18-CV-01519-MN.
• Finjan Inc., vs. Cisco Systems, Inc., Expert for Expert for CISCO, Northern District of California, San Jose Division, Case no. Case No. 5:17-cv-00072-BLF-SVK.
• Rimini Street, Inc. v. Oracle International Corporation, Expert for Expert for Oracle, United States District Court, District of Nevada, Case no. Case No. 2:14-cv-01699.
• Inter Partes Review, Expert for Expert for Samsung Electronics Co., Ltd., United States Patent and Trademark Office, Case no. Patent Nos 9,277,433 and 9,521,578.
• Inter Partes Review, Expert for Expert for Dropbox Inc., United States Patent and Trademark Office, Case no. Patent Nos 8,484,260 and 8,296,338.
• Finjan, LLC. v. SonicWall Inc., Expert for Expert for SonicWall, Northern District of California, Case no. Case No. 5:17-cv-04467-BLF-VKD.
• WebRoot, INC. and OpenText, Inc. v Kaspersky Lab, Trent Micro, Sophos LTD., Crowdstrike Holdings, INC, and Forcepoint, LCC., Expert for Expert for the Plaintiff, Western District of Texas, Case no. 6:22-CV-00243-ADA-DTG, 6:22-CV-00239-ADA-DTG, 6:22-CV-00240-ADA-DTG, 6:22-CV-00241-ADA-DTG, FORCEPOINT, LLC, and 6:22-CV-00342-ADA-DTG.

Industrial Experience