An OS-agnostic Approach to Memory Forensics

Andrea Oliveri, Matteo Dell'Amico, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Bibtex

LibAFL: A Framework to Build Modular and Reusable Fuzzers

Andrea Fioraldi, Dominik Maier, Dongjia Zhang, Davide Balzarotti

Proceedings of the 29th ACM conference on Computer and communications security (CCS) , Los Angeles, U.S.A.

PDF Bibtex

How Machine Learning Is Solving the Binary Function Similarity Problem

Andrea Marcelli, Mariano Graziano, Xabier Ugarte-Pedrero, Yanick Fratantonio, Mohamad Mansouri, Davide Balzarotti

31st USENIX Security Symposium (USENIX Security 2022)

PDF Bibtex

When Sally Met Trackers: Web Tracking From the Users' Perspective

Savino Dambra, Iskander Sanchez-Rola, Leyla Bilge, Davide Balzarotti

31st USENIX Security Symposium (USENIX Security 2022)

PDF Bibtex

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Jayakrishna Vadayath, Moritz Eckert, Kyle Zeng, Nicolaas Weideman, Gokulkrishna Praveen Menon, Yanick Fratantonio, Davide Balzarotti, Adam Doupéand Tiffany Bao, Ruoyu Wang, Christophe Hauser, Yan Shoshitaishvili

31st USENIX Security Symposium (USENIX Security 2022)

PDF Bibtex

RE-Mind: a First Look Inside the Mind of a Reverse Engineer

Alessandro Mantovani, Simone Aonzo, Yanick Fratantonio, Davide Balzarotti

31st USENIX Security Symposium (USENIX Security 2022)

PDF Bibtex

The Convergence of Source Code and Binary Vulnerability Discovery -- A Case Study

Alessandro Mantovani, Luca Compagna, Yan Shoshitaishvili, Davide Balzarotti

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS22)

PDF Bibtex

Fuzzing with Data Dependency Information

Alessandro Mantovani, Andrea Fioraldi, Davide Balzarotti

Proceedings of the 7th IEEE European Symposium on Security and Privacy (EuroS\&P'22) , Genoa, Italy

PDF Bibtex

Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Applications

Feras Al Kassar, Giulia Clerici, Luca Compagna, Fabian Yamaguchi, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Bibtex

Registered Report: Dissecting American Fuzzy Lop - A FuzzBench Evaluation

Andrea Fioraldi, Alessandro Mantovani, Dominik Maier, Davide Balzarotti

Proceedings of the 1st International Fuzzing Workshop (FUZZING) 2022 , San Diego, California

PDF Bibtex

In the Land of MMUs: Multiarchitecture OS-Agnostic Virtual Memory Forensics

Andrea Oliveri, Davide Balzarotti

ACM Trans. Priv. Secur. , New York, NY, USA

PDF Bibtex

AutoProfile: Towards Automated Profile Generation for Memory Analysis

Fabio Pagani, Davide Balzarotti

ACM Transactions on Privacy and Security (TOPS)

PDF Bibtex

A Comparison of Systemic and Systematic Risks of Malware Encounters in Consumer and Enterprise Environments

Savino Dambra, Leyla Bilge, Davide Balzarotti

ACM Transactions on Privacy and Security (TOPS)

Bibtex

Tarnhelm: Isolated, Transparent & Confidential Execution of Arbitrary Code in ARM's TrustZone

Davide Quarta, Michele Ianni, Aravind Machiry, Yanick Fratantonio, Eric Gustafson, Davide Balzarotti, Martina Lindorfer, Giovanni Vigna, Christopher Kruegel

CheckMATE Workshop, co-located with ACM CCS

PDF Bibtex

Lost in the Loader: The Many Faces of the Windows PE File Format

Dario Nisi, Mariano Graziano, Yanick Fratantonio, Davide Balzarotti

Symposium on Research in Attacks, Intrusion, and Defenses (RAID) , San Sebastian

Bibtex

When Malware Changed Its Mind: Characterizing the Variability of Malicious and Unwanted Program Behaviors at Scale

Erin Avllazagaj, Ziyun Zhu, Leyla Bilge, Davide Balzarotti, Tudor Dumitras

29th USENIX Security Symposium (USENIX Security 21) , Boston, MA

Winner of the Best Paper Award for 2021 -- CSAW

Bibtex

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

Andrew Fasano, Tiemoko Ballo, Marius Muench, Tim Leek, Alexander Olienik, Brendan Dolan Gavitt, Manuel Egele, Aurélien Francillon, Long Lu, Nick Gregory, Davide Balzarotti, William Robertson

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Hong Kong, China (acceptance rate: 19.3%)

PDF Bibtex

Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships

Iskander Sanchez-Rola, Matteo dell'Amico, Davide Balzarotti, Pierre-Antoine Vervier, Leyla Bilge

IEEE Symposium on Security & Privacy , San Francisco, CA

PDF Bibtex

Trust, But Verify: A Longitudinal Analysis Of Android OEM Compliance and Customization

Possemato Andrea, Aonzo Simone, Balzarotti Davide, Fratantonio Yanick

IEEE Symposium on Security & Privacy , San Francisco, CA

PDF Bibtex

Does Every Second Count? Time-based Evolution of Malware Behavior in Sandboxes

Alexander Kuechler, Alessandro Mantovani, Yufei Han, Leyla Bilge, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Bibtex

Pre-processing Memory Dumps to Improve Similarity Score of Windows Modules

Miguel Martin-Pereand, Ricardo J. Rodriguez, Davide Balzarotti

Computers \& Security

PDF Bibtex

The Use of Likely Invariants as Feedback for Fuzzers

Andrea Fioraldi, Daniele Cono D'Elia, Davide Balzarotti

30th USENIX Security Symposium (USENIX Security 21)

PDF Bibtex

The evidence beyond the wall: Memory forensics in SGX environments

Flavio Toffalini, Andrea Oliveri, Mariano Graziano, Jianying Zhou, Davide Balzarotti

Forensic Science International: Digital Investigation

PDF Bibtex

SoK: Cyber Insurance - Technical Challenges and a System Security Roadmap

Savino Dambra, Leyla Bilge, Davide Balzarotti

IEEE Symposium on Security & Privacy , San Francisco, CA (acceptance rate: 12.4%)

PDF Bibtex

Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem

Alessandro Mantovani, Simone Aonzo, Xabier-Ugarte Pedrero, Alessio Merlo, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Slides Bibtex

When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features

Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, Christopher Kruegel

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Bibtex

Dirty Clicks: A Study of the Usability and Security Implications of Click-related Behaviors on the Web

Iskander Sanchez-Rola, Davide Balzarotti, Christopher Kruegel, Giovanni Vigna, Igor Santos

Proceedings of The Web Conference 2020 (acceptance rate: 19.2%)

PDF Bibtex

The Tangled Genealogy of IoT Malware

Emanuele Cozzi, Pierre-Antoine Vervier, Matteo Dell'Amico, Yun Shen, Leyla Bilge, Davide Balzarotti

Annual Computer Security Applications Conference (ACSAC) (acceptance rate: 23.2%)

PDF Bibtex

Cookies from the Past: Timing Server-Side Request Processing Code for History Sniffing

Iskander Sanchez-Rola, Davide Balzarotti, Igor Santos

ACM Dgital Threats: Research and Practice Journal (DTRAP) , New York, NY, USA

PDF Bibtex

Toward the Analysis of Embedded Firmware through Automated Re-hosting

Eric Gustafson, Marius Muench, Chad Spensky, Nilo Redini, Aravind Machiry, Yanick Fratantonio, Davide Balzarotti, Aurelien Francillon, Yung Ryn Choe, Christopher Kruegel, Giovanni Vigna

Symposium on Research in Attacks, Intrusion, and Defenses (RAID) , Beijing (acceptance rate: 22.3%)

PDF Bibtex

Back to the Whiteboard: a Principled Approach for the Assessment and Design of Memory Forensic Techniques

Fabio Pagani, Davide Balzarotti

28th USENIX Security Symposium (USENIX Security 19) , Santa Clara, CA (acceptance rate: 15.7%)

PDF Slides Bibtex Code

Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control

Iskander Sanchez-Rola, Matteo Dell’Amico, Platon Kotzias, Davide Balzarotti, Leyla Bilge, Pierre-Antoine Vervier, Igor Santos

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Oakland, New Zealand (acceptance rate: 17.1%)

PDF Bibtex

A Close Look at a Daily Dataset of Malware Samples

Xabier Ugarte-Pedrero, Mariano Graziano, Davide Balzarotti

ACM Transactions on Privacy and Security (TOPS)

PDF Bibtex

Introducing the Temporal Dimension to Memory Forensics

Pagani, Fabio, Fedorov, Oleksii, Balzarotti, Davide

ACM Transactions on Privacy and Security (TOPS)

PDF Bibtex

BakingTimer: Privacy Analysis of Server-Side Request Processing Time

Sanchez-Rola, Iskander, Balzarotti, Davide, Santos, Igor

Annual Computer Security Applications Conference (ACSAC) (acceptance rate: 22.6%)

PDF Bibtex

Clock Around the Clock: Time-Based Device Fingerprinting

Iskander Sanchez-Rola, Igor Santos, Davide Balzarotti

Proceedings of the 25th ACM conference on Computer and communications security (CCS) , Toronto, Canada (acceptance rate: 16.6%)

PDF Bibtex

Deception Techniques In Computer Security: A Research Perspective

Xiao Han, Nizar Kheir, Davide Balzarotti

ACM computing surveys (CSUR)

PDF Bibtex

Understanding Linux Malware

Emanuele Cozzi, Mariano Graziano, Yanick Fratantonio, Davide Balzarotti

IEEE Symposium on Security & Privacy , San Francisco, CA (acceptance rate: 11.5%)

PDF Slides Bibtex

Beyond Precision and Recall: Understanding Uses (and Misuses) of Similarity Hashes in Binary Analysis

Pagani, Fabio, Dell'Amico, Matteo, Balzarotti, Davide

Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy , Tempe, AZ, USA (acceptance rate: 20.9%)

PDF Slides Bibtex

Avatar²: A Multi-target Orchestration Platform

Marius Muench, Dario Nisi, Aurelien Francillon, Davide Balzarotti

Workshop on Binary Analysis Research (colocated with NDSS Symposium) , San Diego (USA)

PDF Slides Bibtex Tool

What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices

Marius Muench, Jan Stijohann, Frank Kargl, Aurelien Francillon, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA)

PDF Slides Bibtex Tool

Evaluation of Deception-Based Web Attacks Detection

Xiao Han, Nizar Kheir, Davide Balzarotti

ACM Workshop on Moving Targets Defense (co-located with CCS) , Dallas, USA (acceptance rate: 34.6%)

PDF Bibtex

Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies

Iskander Sanchez-Rola, Igor Santos, Davide Balzarotti

Proceedings of the 26rd USENIX Security Symposium (USENIX Security) (acceptance rate: 16.3%)

PDF Bibtex

A Lustrum of Malware Network Communication: Evolution and Insights

Chaz Lever, Platon Kotzias, Davide Balzarotti, Juan Caballero, Manos Antonakakis

Proceedings of the IEEE Symposium on Security and Privacy , San Jose, CA (acceptance rate: 13.3%)

PDF Bibtex

Attacks Landscape in the Dark Side of the Web

Onur Catakoglu, Marco Balduzzi, Davide Balzarotti

Proceedings of the 32nd Annual ACM Symposium on Applied Computing (SAC) , Marrakech, Morocco (acceptance rate: 15.7%)

Best Paper Award

PDF Bibtex

The Onions Have Eyes: A Comprehensive Structure and Privacy Analysis of Tor Hidden Services

Iskander Sanchez-Rola, Davide Balzarotti, Igor Santos

26th International World Wide Web Conference (WWW) , Perth, Australia (acceptance rate: 17.0%)

PDF Bibtex

PhishEye: Live Monitoring of Sandboxed Phishing Kits

Xiao Han, Nizar Kheir, Davide Balzarotti

Proceedings of the 23rd ACM conference on Computer and communications security (CCS) , Vienna, Austria (acceptance rate: 16.4%)

Best European Student Paper Award

PDF Slides Bibtex

Taming Transactions: Towards Hardware-Assisted Control Flow Integrity Using Transactional Memory

Marius Muench, Fabio Pagani, Yan Shoshitaishvili, Christopher Kruegel, Giovanni Vigna, Davide Balzarotti

Symposium on Research in Attacks, Intrusion, and Defenses (RAID) , Paris (acceptance rate: 25.9%)

PDF Slides Bibtex

Uses and Abuses of Server-Side Requests

Giancarlo Pellegrino, Onur Catakoglu, Davide Balzarotti, Christian Rossow

Symposium on Research in Attacks, Intrusion, and Defenses (RAID) , Paris (acceptance rate: 25.9%)

PDF Bibtex

Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks

Stefano Cristalli, Mattia Pagnozzi, Mariano Graziano, Andrea Lanzi, Davide Balzarotti

Proceedings of the 25rd USENIX Security Symposium (USENIX Security) (acceptance rate: 15.6%)

PDF Bibtex

Google Dorks: Analysis, Creation, and new Defenses

Flavio Toffalini, Maurizio Abba, Damiano Carra, Davide Balzarotti

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , San Sebastian, Spain (acceptance rate: 31.8%)

PDF Bibtex

Subverting Operating System Properties through Evolutionary DKOM Attacks

Mariano Graziano, Lorenzo Flore, Andrea Lanzi, Davide Balzarotti

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , San Sebastian, Spain (acceptance rate: 31.8%)

PDF Slides Bibtex

RAMBO: Run-time packer Analysis with Multiple Branch Observation

Xabier Ugarte-Pedrero, Davide Balzarotti, Igor Santos, Pablo G. Bringas

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , San Sebastian, Spain (acceptance rate: 31.8%)

PDF Slides Bibtex

Measuring the Role of Greylisting and Nolisting in Fighting Spam

F. Pagani, M. De Astis, M. Graziano, A. Lanzi, D. Balzarotti

International Conference on Dependable Systems and Networks (DSN) , Toulouse, France (acceptance rate: 20.5%)

PDF Slides Bibtex

ROPMEMU: A Framework for the Analysis of Complex Code-Reuse Attacks

Mariano Graziano, Davide Balzarotti, Alain Zidouemba

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Xi'an, China (acceptance rate: 20.9%)

PDF Bibtex

Automatic Extraction of Indicators of Compromise for Web Applications

Onur Catakoglu, Marco Balduzzi, Davide Balzarotti

25th International World Wide Web Conference (WWW) , Montreal, Canada (acceptance rate: 22.0%)

PDF Bibtex

PIE: Parser Identification in Embedded Systems

Lucian Cojocar, Jonas Zaddach, Roel Verdult, Herbert Bos, Aurelien Francillon, Davide Balzarotti

Annual Computer Security Applications Conference (ACSAC) (acceptance rate: 24.4%)

PDF Bibtex

The Impact of GPU-Assisted Malware on Memory Forensics: A Case Study

Antonio Villani, Davide Balzarotti, Roberto di Pietro

Annual Digital Forensics Research Conference (DFRWS) , Philadelphia, USA (acceptance rate: 34.8%)

PDF Bibtex

Needles in a Haystack: Mining Information from Public Dynamic Analysis Sandboxes for Malware Intelligence

Mariano Graziano, Davide Canali, Leyla Bilge, Andrea Lanzi, Davide Balzarotti

Proceedings of the 24rd USENIX Security Symposium (USENIX Security) (acceptance rate: 15.7%)

PDF Slides Bibtex

In the Compression Hornet's Nest: A Security Study of Data Compression in Network Services

Giancarlo Pellegrino, Davide Balzarotti, Stefan Winter, Neeraj Suri

Proceedings of the 24rd USENIX Security Symposium (USENIX Security) (acceptance rate: 15.7%)

PDF Slides Bibtex Usenix Lightning Video

Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks

Amin Kharraz, William Robertson, Davide Balzarotti, Leyla Bilge, Engin Kirda

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , Milan, Italy (acceptance rate: 22.7%)

PDF Bibtex

The Role of Cloud Services in Malicious Software: Trends and Insights

Xiao Han, Nizar Kheir, Davide Balzarotti

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , Milan, Italy (acceptance rate: 22.7%)

PDF Bibtex

[SoK] Deep Packer Inspection: A Longitudinal Study of the Complexity of Run-Time Packers

Xabier Ugarte-Pedrero, Davide Balzarotti, Igor Santos, Pablo G. Bringas

Proceedings of the IEEE Symposium on Security and Privacy , San Jose, CA (acceptance rate: 13.8%)

PDF Bibtex

Hypervisor-based Malware Protection with AccessMiner

Aristide Fattori, Andrea Lanzi, Davide Balzarotti, Engin Kirda

Computers \& Security

Bibtex PDF

Resource monitoring for the detection of parasite P2P botnets

Rafael Rodríguez-Gómez, Gabriel Maciá-Fernández, Pedro García-Teodoro, Moritz Steiner, Davide Balzarotti

Journal of Computer Networks

Bibtex PDF

A Large Scale Analysis of the Security of Embedded Firmwares

Andrei Costin, Jonas Zaddach, Aurélien Francillon, Davide Balzarotti

Proceedings of the 23rd USENIX Security Symposium (USENIX Security) (acceptance rate: 19.0%)

PDF Slides Bibtex Firmware.re

Through the Looking-Glass, and What Eve Found There

Luca Bruno, Mariano Graziano, Davide Balzarotti, Aurélien Francillon

8th USENIX Workshop on Offensive Technologies (WOOT 14) (acceptance rate: 48.6%)

PDF Bibtex About

On The Effectiveness of Risk Prediction Based on Users Browsing Behavior

Davide Canali, Leyla Bilge, Davide Balzarotti

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Kyoto, Japan (acceptance rate: 20.0%)

PDF Slides Bibtex

Optical Delusions: A Study of Malicious QR Codes in the Wild

Amin Kharraz, Engin Kirda, William Robertson, Davide Balzarotti, Aurelien Francillon

Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) , Atlanta, GA USA (acceptance rate: 21.8%)

PDF Bibtex

On the Feasibility of Software Attacks on Commodity Virtual Machine Monitors via Direct Device Assignment

Gabor Pek, Andrea Lanzi, Abhinav Srivastava, Davide Balzarotti, Aurélien Francillon, Christoph Neumann

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Kyoto, Japan (acceptance rate: 20.0%)

PDF Bibtex

Shades of Grey: A Closer Look at Emails in the Gray Area

Jelena Isacenkova, Davide Balzarotti

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Kyoto, Japan (acceptance rate: 20.0%)

PDF Bibtex

EXPOSURE: a Passive DNS Analysis Service to Detect and Report Malicious Domains

Leyla Bilge, Sevil Sen, Davide Balzarotti, Engin Kirda, Christopher Kruegel

ACM Transactions on Information and System Security (TISSEC)

PDF Bibtex

Avatar: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares

Jonas Zaddach, Luca Bruno, Aurelien Francillon, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA) (acceptance rate: 18.6%)

PDF Slides Bibtex Tool

Toward Black-Box Detection of Logic Flaws in Web Applications

Giancarlo Pellegrino, Davide Balzarotti

Network and Distributed System Security (NDSS) Symposium , San Diego (USA) (acceptance rate: 18.6%)

PDF Bibtex

Inside the SCAM Jungle: A Closer Look at 419 Scam Email Operations

Jelena Isacenkova, Olivier Thonnard, Andrei Costin, Aurelien Francillon, Davide Balzarotti

EURASIP Journal on Information Security

PDF Bibtex

Implementation and Implications of a Stealth Hard-Drive Backdoor

Jonas Zaddach, Anil Kurmus, Davide Balzarotti, Erik Olivier Blass, Aurelien Francillon, Travis Goodspeed, Moitrayee Gupta, Ioannis Koltsidas

Proceedings of the 29th Annual Computer Security Applications Conference (ACSAC) , New Orleans (acceptance rate: 19.0%)

Best Student Paper Award

PDF Bibtex

Hypervisor Memory Forensics

Mariano Graziano, Andrea Lanzi, Davide Balzarotti

Symposium on Research in Attacks, Intrusion, and Defenses (RAID) , Saint Lucia (acceptance rate: 22.9%)

Winner of the 2013 Annual Volatility Framework Plugin Contest!

PDF Bibtex Tool

The Role of Phone Numbers in Understanding Cyber-Crime Schemes

Andrei Costin, Jelena Isachenkova, Marco Balduzzi, Aurelien Francillon, Davide Balzarotti

Annual Conference on Privacy, Security, and Trust (PST) , Terragona, Spain (acceptance rate: 29.0%)

PDF Slides Bibtex

The Role of Web Hosting Providers in Detecting Compromised Websites

Davide Canali, Davide Balzarotti, Aurelien Francillon

22th International World Wide Web Conference (WWW) , Rio de Janeiro, Brazil (acceptance rate: 15.0%)

Best Paper Nominee

PDF Slides Bibtex

Inside the SCAM Jungle: A Closer Look at 419 Scam Email Operations

Jelena Isacenkova, Olivier Thonnard, Andrei Costin, Davide Balzarotti, Aurelien Francillon

Proceedings of the International Workshop on Cyber Crime (co-located with S\&P) , San Francisco, CA

PDF Slides Bibtex

Behind the Scenes of Online Attacks: an Analysis of Exploitation Behaviors on the Web

Davide Canali, Davide Balzarotti

Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS) , San Diego, CA (acceptance rate: 18.8%)

PDF Bibtex

Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis

Leyla Bilge, Davide Balzarotti, William Robertson, Engin Kirda, Christopher Kruegel

Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC) , Orlando, FL (acceptance rate: 19.0%)

PDF Bibtex

Towards network containment in malware analysis systems

Mariano Graziano, Corrado Leita, Davide Balzarotti

Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC) , Orlando, FL (acceptance rate: 19.0%)

PDF Slides Bibtex

Preventing Input Validation Vulnerabilities in Web Applications through Automated Type Analysis

Theodoor Scholte, William Robertson, Davide Balzarotti, Engin Kirda

36th Computer Software and Applications Conference (COMPSAC) , Izmir, Turkey (acceptance rate: 18.0%)

PDF Bibtex

A quantitative study of accuracy in system call-based malware detection

Davide Canali, Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, Engin Kirda

Proceedings of the 2012 International Symposium on Software Testing and Analysis (ISSTA) , Minneapolis, MN (acceptance rate: 28.7%)

PDF Bibtex

Have things changed now? An empirical study on input validation vulnerabilities in web applications

Theodoor Scholte, Davide Balzarotti, Engin Kirda

Journal on Computers & Security

Bibtex

From model-checking to automated testing of security protocols: Bridging the gap

Alessandro Armando, Giancarlo Pellegrino, Roberto Carbone, Alessio Merlo, Davide Balzarotti

6th International Conference on Tests and Proofs (TAP) , Prague, Czech Republic

PDF Bibtex

A security analysis of amazon's elastic compute cloud service

Marco Balduzzi, Jonas Zaddach, Davide Balzarotti, Engin Kirda, Sergio Loureiro

Proceedings of the 27th Annual ACM Symposium on Applied Computing (SAC) , Trento, Italy (acceptance rate: 24.0%)

PDF Bibtex

An empirical analysis of input validation mechanisms in web applications and languages

Theodoor Scholte, William Robertson, Davide Balzarotti, Engin Kirda

Proceedings of the 27th Annual ACM Symposium on Applied Computing (SAC) , Trento, Italy (acceptance rate: 24.0%)

PDF Bibtex

Insights into user behavior in dealing with internet attacks

Kaan Onarlioglu, U Ozan Yilmaz, Davide Balzarotti, Engin Kirda

19th Annual Network and Distributed System Security Symposium (NDSS) , San Diego, CA (acceptance rate: 17.8%)

PDF Bibtex

Measurement and evaluation of a real world deployment of a challenge-response spam filter

Jelena Isacenkova, Davide Balzarotti

Proceedings of the 2011 ACM SIGCOMM conference on Internet Measurement Conference (IMC) , Berlin (acceptance rate: 19.1%)

PDF Bibtex

Operating System Interface Obfuscation and the Revealing of Hidden Operations

Abhinav Srivastava, Andrea Lanzi, Jonathon Giffin, Davide Balzarotti

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , Amsterdam, The Netherlands (acceptance rate: 31.7%)

PDF Bibtex

Reverse Social Engineering Attacks in Online Social Networks

Danesh Irani, Marco Balduzzi, Davide Balzarotti, Engin Kirda, C. Pu

Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA) , Amsterdam, The Netherlands (acceptance rate: 31.7%)

PDF Bibtex

Thwarting Real-Time Dynamic Unpacking

Leyla Bilge, Andrea Lanzi, Davide Balzarotti

Proceedings of the Fourth European Workshop on System Security (EUROSEC)

PDF Bibtex

Exposing the lack of privacy in file hosting services

Nick Nikiforakis, Marco Balduzzi, S. Van Acker, W. Joosen, Davide Balzarotti

Proceedings of the 4th USENIX conference on Large-scale exploits and emergent threats (LEET)

PDF Bibtex

Quo Vadis? A Study of the Evolution of Input Validation Vulnerabilities in Web Applications

Theodor Scholte, Davide Balzarotti, Engin Kirda

Proceedings of the Fifteenth International Conference on Financial Crypto (FC) , St. Lucia (acceptance rate: 20.3%)

PDF Bibtex

Automated discovery of parameter pollution vulnerabilities in web applications

Marco Balduzzi, Carment T. Gimenez, Davide Balzarotti, Engin Kirda

Proceedings of the 18th Network and Distributed System Security Symposium (NDSS) , San Diego, CA (acceptance rate: 20.1%)

Distinguished Paper Award

PDF Bibtex

A Summary of Two Practical Attacks Against Social Networks

Leyla Bilge, Marco Balduzzi, Davide Balzarotti, Engin Kirda

Trustworthy Internet (Book Chapter)

Bibtex

G-Free: defeating return-oriented programming through gadget-less binaries

Kaan Onarlioglu, Leyla Bilge, Andrea Lanzi, Davide Balzarotti, Engin Kirda

Proceedings of the 26th Annual Computer Security Applications Conference (ACSAC) , Austin, Texas (acceptance rate: 16.3%)

PDF Bibtex

AccessMiner: using system-centric models for malware protection

Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, Engin Kirda

Proceedings of the 17th ACM conference on Computer and communications security (CCS) , Chicago, Illinois, USA (acceptance rate: 17.2%)

PDF Bibtex

Abusing Social Networks for Automated User Profiling

Marco Balduzzi, Christian Platzer, Thorsten Holz, Engin Kirda, Davide Balzarotti, Christopher Kruegel

Proceedings of the Internation Symposium on Recent Advances in Intrusion Detection (RAID) , Ottawa, Canada (acceptance rate: 23.1%)

PDF Bibtex

A Solution for the Automated Detection of Clickjacking Attacks

Marco Balduzzi, Manuel Egele, Engin Kirda, Davide Balzarotti, Christopher Kruegel

Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS) , Beijing, China (acceptance rate: 15.0%)

PDF Bibtex

Honeybot, Your Man in the Middle for Automated Social Engineering

Tobias Lauinger, Veikko Pankakoski, Davide Balzarotti, Engin Kirda

Proceedings of the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET) , San Jose, CA (acceptance rate: 31.4%)

PDF Bibtex

Efficient Detection of Split Personalities in Malware

Davide Balzarotti, Marco Cova, Christoph Karlberger, Christopher Kruegel, Engin Kirda, Giovanni Vigna

Proceedings of the Network and Distributed System Security Symposium (NDSS) , San Diego, CA (acceptance rate: 15.4%)

PDF Bibtex

An Experience in Testing the Security of Real-World Electronic Voting Systems

Davide Balzarotti, Greg Banks, Marco Cova, Viktoria Felmetsger, Richard A. Kemmerer, William Robertson, Fredrik Valeur, Giovanni Vigna

IEEE Transactions on Software Engineering

PDF Bibtex

Reducing errors in the anomaly-based detection of web-based attacks through the combined analysis of web requests and SQL queries

Giovanni Vigna, Fredrik Valeur, Davide Balzarotti, William Robertson, Christopher Kruegel, Engin Kirda

Journal of Computer Security , Amsterdam, The Netherlands, The Netherlands

PDF Bibtex

A view on current malware behaviors

Ulrich Bayer, Imam Habibi, Davide Balzarotti, Engin Kirda, Christopher Kruegel

USENIX workshop on large-scale exploits and emergent threats (LEET) , Boston, MA (acceptance rate: 40.9%)

PDF Bibtex

All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks

Leyla Bilge, Thorsten Strufe, Davide Balzarotti, Engin Kirda

20th International World Wide Web Conference (WWW) , Madrid, Spain (acceptance rate: 11.7%)

PDF Bibtex

Improving Signature Testing Through Dynamic Data Flow Analysis

Christopher Kruegel, Davide Balzarotti, William Robertson, Giovanni Vigna

Proceedings of the Annual Computer Security Applications Conference (ACSAC) , Miami, FL (acceptance rate: 20.9%)

PDF Bibtex

EVEREST: Evaluation and Validation of Election-Related Equipment, Standards and Testing

Patrick McDaniel, Matt Blaze, Giovanni Vigna, Davide Balzarotti et al.

PDF Bibtex

Supporting cooperative software processes in a decentralized and nomadic world

Davide Balzarotti, Carlo Ghezzi, Mattia Monga

IEEE Transactions on Systems, Man, and Cybernetics Part A: Systems and Humans

PDF Bibtex

Testing Network-based Intrusion Detection Signatures Using Mutant Exploits

Giovanni Vigna, William Robertson, Davide Balzarotti

Proceedings of the ACM Conference on Computer and Communication Security (ACM CCS) , Washington, DC (acceptance rate: 13.9%)

PDF Bibtex

Multi-Module Vulnerability Analysis of Web-based Applications

Davide Balzarotti, Marco Cova, Viktoria Felmetsger, Giovanni Vigna

Proceedings of the ACM Conference on Computer and Communication Security (ACM CCS) , Alexandria, VA (acceptance rate: 18.2%)

PDF Bibtex

Swaddler: An Approach for the Anomaly-based Detection of State Violations in Web Applications

Marco Cova, Davide Balzarotti, Viktoria Felmetsger, Giovanni Vigna

Proceedings of the 10th Internation Symposium on Recent Advances in Intrusion Detection (RAID) , Surfer Paradise, Australia (acceptance rate: 15.8%)

PDF Bibtex

Catch Me, If You Can: Evading Network Signatures with Web-based Polymorphic Worms

Matt Van Gundy, Davide Balzarotti, Giovanni Vigna

Proceedings of the First USENIX Workshop on Offensive Technologies (WOOT) , Boston, MA

PDF Bibtex

Testing Network Intrusion Detection Systems

D. Balzarotti

Ph.D. Dissertation

PDF Bibtex

Security Evaluation of the Sequoia Voting System

Giovanni Vigna, Richard Kemmerer, Davide Balzarotti, Greg Banks, Marco Cova, Viktoria Felmetsger, William Robertson, Fredrik Valeur

PDF Bibtex

Supporting Configuration Management for Virtual Workgroups in a Peer-to-Peer Setting

Davide Balzarotti, Carlo Ghezzi, Mattia Monga

Proceedings of International Conference on Software Engineering and Knowledge Engineering , Ischia, Italy

PDF Bibtex

Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications

Davide Balzarotti, Marco Cova, Viktoria Felmetsger, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, Giovanni Vigna

Proceedings of the IEEE Symposium on Security and Privacy , Berkeley, CA (acceptance rate: 11.2%)

PDF Bibtex

ClearShot: Eavesdropping on Keyboard Input from Video

Davide Balzarotti, Marco Cova, Giovanni Vigna

Proceedings of the IEEE Symposium on Security and Privacy , Berkeley, CA (acceptance rate: 11.2%)

PDF Bibtex

The LighTS Tuple Space Frawework and its Customization for Context-Aware Applications

Davide Balzarotti, Paolo Costa, Gian Pietro Picco

International Journal on Web Intelligence and Agent Systems (WAIS)

PDF Bibtex

Slicing {AspectJ} Woven Code

Davide Balzarotti, Antonio Castaldo D'Ursi, Luca Cavallaro, Mattia Monga

Proceedings of the Foundations of Aspect-Oriented Languages workshop (FOAL2005) , Chicago, IL (USA)

PDF Bibtex

LighTS: A Lightweight, Customizable Tuple Space Supporting Context-Aware Applications

Gian Pietro Picco, Davide Balzarotti, Paolo Costa

Proceedings of the 20$^th$ ACM Symposium on Applied Computing (SAC05) , Santa Fe (New Mexico, USA) (acceptance rate: 36.4%)

PDF Bibtex

Using Program Slicing to Analyze Aspect-Oriented Composition

Davide Balzarotti, Mattia Monga

Proceedings of Foundations of Aspect-Oriented Languages Workshop at FOAL 2004 , Lancaster (UK)

PDF Bibtex

Are Your Votes {\em Really} Counted? Testing the Security of Real-world Electronic Voting Systems

Davide Balzarotti, Greg Banks, Marco Cova, Viktoria Felmetsger, Richard Kemmerer, William Robertson, Fredrik Valeur, Giovanni Vigna

Proceedings of the International Symposium on Software Testing and Analysis (ISSTA) , Seattle, WA (acceptance rate: 26.0%)

PDF Bibtex

Assessing the risk of using vulnerable components

Davide Balzarotti, Mattia Monga, Sabrina Sicari

Quality of Protection: Security Measurements and Metrics (QoP)

PDF Bibtex

Freeing Cooperation From Servers Tyranny

Davide Balzarotti, Carlo Ghezzi, Mattia Monga

Web Engineering and Peer-to-Peer Computing

PDF Bibtex