<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000'><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div><span></span><b>Finding Malware on a Web Scale</b>
<br>
<b><a href="http://www.cs.princeton.edu/events/event/Ben%20Livshits%20%5C%5C%20Microsoft%20Research%20%5C%5C%20http://research.microsoft.com/%7Elivshits/" target="_blank">Ben Livshits</a></b>, <a href="http://research.microsoft.com/en-us/" target="_blank">Microsoft Research</a>
<br>Monday, May 7 1:30pm<br>Computer Science 105<br>
<br>
Over the last several years, JavaScript malware has emerged as one of
the most popular ways to deliver drive-by attacks to unsuspecting users
through the browser. This talk covers recent Microsoft Research
experiences with finding malware on the web. It highlights two tools:
Nozzle and Zozzle. Nozzle is a runtime malware detector that focuses on
finding heap spraying attacks. Zozzle is a mostly static detector that
finds heap sprays and other types of JavaScript malware. Both are
extremely precise: Nozzle false positive rate is close to one in a
billion; Zozzle's is about one in a million.<br><br><p>
Both are deployed by Bing and are used daily to find thousands of
malicious web sites. This talk will focus on interesting interplay
between static and runtime analysis and cover what it takes to migrate
research ideas into real-world products. <br></p><p><br></p><p>
Ben Livshits is a researcher at Microsoft Research in Redmond, WA and an
affiliate professor at the University of Washington. Originally from
St. Petersburg, Russia, he received a bachelor's degree in Computer
Science and Math from Cornell University in 1999, and his M.S. and Ph.D.
in Computer Science from Stanford University in 2002 and 2006,
respectively. Dr. Livshits' research interests include application of
sophisticated static and dynamic analysis techniques to finding errors
in programs. <br></p><p><br></p><p>
Ben has published papers at PLDI, POPL, Oakland Security, Usenix
Security, CCS, SOSP, ICSE, FSE, and many other venues. He is known for
his work in software reliability and especially tools to improve
software security, with a primary focus on approaches to finding buffer
overruns in C programs and a variety of security vulnerabilities
(cross-site scripting, SQL injections, etc.) in Web-based applications.
He is the author of several dozen academic papers and patents. Lately he
has been focusing on how Web 2.0 application and browser reliability,
performance, and security can be improved through a combination of
static and runtime techniques. Ben generally does not speak of himself
in the third person.
<br>
</p>
<br></div></div></div></div></body></html>