תחומי מחקר במחלקה להנדסת מערכות תוכנה ומידע

אוניברסיטת בן-גוריון בנגב ידועה כמובילה בתחום הסייבר בארץ ובעולם, ומציעה לסטודנטים בתכנית תחומי מחקר מרתקים, חלקם בשיתוף עם חברות בינלאומיות בתעשיית הסייבר, כגון IBM, דויטשה טלקום, Dell-EMC, Microsoft ועוד, וכן עם גופים ביטחוניים כדוגמת משרד הביטחון ומפא"ת. באוניברסיטה פועלות מעבדות מחקר של מטה הסייבר הלאומי, של חברת דויטשה טלקום וכן מרכז מצויינות בתחום הסייבר של IBM.

| להלן רשימת תחומי המחקר במחלקה להנדסת מערכות תוכנה ומידע:

• תחומי מחקר במחלקה להנדסת מערכות תוכנה ומידע

  הצג הכל

  הסתר הכל

  Implementation Security - Dr. Yossi Oren

  Dr. Yossi Oren

  Side-channel analysis is a cyber-security technique that allows an attacker to extract secret information from an electronic device through examination of its physical emanations, such as power consumption, electromagnetic emanations, cache access patterns, heat or vibrations. This attack method is capable of compromising otherwise secure systems, from IoT sensors and gaming consoles to high-security cloud servers. Although systems at risk from side-channel attacks can be protected through hardware and software modifications, this results in a delicate trade-off between security and allowing the device to fulfil its intended function. Secret information stored digitally is increasingly vulnerable to emerging low-cost side-channel attacks that are highly scalable, employing malicious peripheral devices or turning components of a system against itself.

  In the Implementation Security Lab, we use expensive and precise lab equipment to carry out side-channel attacks on various devices, including mobile phones, network equipment, IoT devices and modern PCs. We then attempt to replicate our attacks using less sensitive measurement devices such as compromised phones or malicious aftermarket peripherals.  In addition, we are looking for creative and unexpected uses for the sensors found on modern mobile phones, such as the gyroscope, touch screen, and magnetic compass. This research involves subject matter from many fields, including signal processing, computer architecture, statistics and probability, electromagnetics, random processes, machine learning and cryptographic theory.

  Anomaly Detection in Streaming IoT Network Traffic - Prof. Mark Last

  Prof. Mark Last

  With the rise of IoT and cloud-based technologies, our lives are getting more and more connected. The huge spectrum of connected devices, together with their low computational power and lack of security standardization, is making the security of each and every device an extremely challenging task. In our research, we develop machine learning-based methods for automated detection of anomalies in IoT devices network traffic.

  Diagnosing System Exploits - Dr. Roni Stern

  Dr. Roni Stern

  Vulnerabilities in software are bugs in the software's source code that can be exploited by the software's users to perform malicious activities. In this research, we use techniques from the Artficial Intelligence literature to automatically identify the root cause that enables such exploits, which will allow early detection and quick repair, and eventually the production of safer and more robust software.​

  Software Test Generation Guided By Fault Prediction - Dr. Roni Stern

  Dr. Roni Stern

  While software testing is acknowledged as a key technique to significantly reduce the number of software bugs, writing tests is a tedious and time consuming task. In this research, we are developing algorithms for automatic generation of tests. The key novelty in our work is that we aim to focus these tests on software components that are more likely to contain bugs, using data-driven software fault prediction techniques.

  Internet of Things (IoT) Security - Dr. Asaf Shabtai

  Dr. Asaf Shabtai

  🔎 Detecting cyber-attacks originating from, or targeting IoT devices by analyzing network traffic

  🔎 Applying machine learning algorithms on multi-session network traffic data with the purpose of accurately identifying IoT devices connected to a network in order to allow the application of device level access control

  🔎 Analyzing the security of IoT devices by using automatic security testbed

  🔎 Investigating hardware attacks performed by replaceable units in IoT devices (e.g., replacing a broken screen in a smartphone or a battery)

  Cyber Security in Avionics Systems - Dr. Asaf Shabtai, Prof. Yuval Elovici

  Dr. Asaf Shabtai, Prof. Yuval Elovici

  🔎 Developing an innovative algorithm for intrusion detection for 1553 communication bus used in military and aerospace avionic platforms as well as for drones/UAVs

  🔎 Developing a proxy-based security solution for remote desktop protocols in order to allow secured communication of tablets and Electronic Flight Bag (EFB) servers

  🔎 Developing an anomaly detection solution for ADS-B protocol

  Traffic Analysis and Malware Detection - Dr. Asaf Shabtai

  Dr. Asaf Shabtai

  🔎 Detecting attacks and malware by analyzing network traffic such as DNS data, NetFlow data, honeypot traffic etc.

  🔎 Analyzing encrypted traffic for detection cyber-attacks exploiting SSH servers and for classifying events performed by users in social applications (such as Facebook, Twitter etc.)

  🔎 Applying static and dynamic of files (e.g., executables, apk, pdf) in order to detect new malicious code

  🔎 Applying advanced data analytics techniques (e.g., deep learning)

  🔎 Utilizing big data infrastructures and technologies​

  Securing Routing Protocols in MANET - Dr. Asaf Shabtai

  Dr. Asaf Shabtai

  Improving the security of Mobile Ad-Hoc Networks (MANET) routing protocols, which are the basis and essential for supporting the implementation of vehicle to vehicle communication (VANET), IoT or military ad-hoc networks. This is done by developing methods for detecting black-hole and gray-hole attacks in the OLSR routing protocol in MANETs without any modifications required to the routing protocol. The proposed solution does not change the behavior nor the definition of the routing protocol, but uses its capabilities for allowing each node in the MANET to detect these attacks autonomously and without relying on a central trusted entity.

  In addition, we introduce a technique for identifying high asset nodes viable for attack and requiring defense in Mobile Ad-Hoc Networks. This capability is important for providing dynamic and effective solution for MANET network by pinpointing the most important nodes.​

  Security Awareness - Dr. Asaf Shabtai, Dr. Rami Puzis

  Dr. Asaf Shabtai, Dr. Rami Puzis

  🔎 Developing passive and active methods for measuring the security awareness of users to specific cyber (social engineering) attacks

  🔎 Developing a hierarchical taxonomy for security awareness, specifically designed for mobile device users. The taxonomy defines a set of measurable criteria that are categorized according to different technological focus areas (e.g., applications and browsing) and within the context of psychological dimensions (e.g., knowledge, attitude, and behavior). We demonstrated the applicability of the proposed taxonomy by introducing an expert-based procedure for deriving mobile security awareness models for different attack classes.

  Customer Analytics and Credit Risk Assessment - Dr. Asaf Shabtai

  Dr. Asaf Shabtai

  Computing the credit risk level of individual transactions (i.e., purchases in online shops) in real-time, by applying modern machine learning combined with classic statistical methods on the customer’s purchase history.

  Social Networks Security - Dr. Asaf Shabtai, Dr. Rami Puzis

  Dr. Asaf Shabtai, Dr. Rami Puzis

  🔎 Profiling friends of a user in a social network and retrieving the relevant friends for a given Web-page (content) by utilizing the potential expertise which is latent in the user's circles of connections

  🔎 Developing innovative methods for detecting reconnaissance activity on an organization social network performed by attackers

  🔎 Using social network honeypot for detecting attackers in social networks​

  Data Leakage Detection - Dr. Asaf Shabtai, Prof. Lior Rokach, Prof. Yuval Elovici

  Dr. Asaf Shabtai, Prof. Lior Rokach, Prof. Yuval Elovici

  🔎 Developing innovative anomaly detection techniques (e.g., one-class clustering tree model) to identify suspicious insiders who have legitimate access to data stored in a database.

  🔎 Proposing a new measure, the Misuseability Score, which represents the potential damage to an organization that a dataset (tabular data) can cause when leaked; this work was later extended to textual content.

  🔎 Creating and using honeytokens as a means for detecting malicious insiders.

  🔎 Proposing and evaluating a new text fingerprinting method for representing and detecting sensitive data.

  🔎 Proposing and evaluating a collaborative approach for detecting data leakage via emails; the collaborative approach analyzes the email communication among email users (both contextual attributes and the content of the emails) in order to provide a more accurate classification of an email as either a leak or legitimate.