Salvatore J. Stolfo

Last updated
Salvatore Stolfo. Team-salvatore-stolfo@2x.jpg
Salvatore Stolfo.

Salvatore J. Stolfo is an academic and professor of computer science at Columbia University, specializing in computer security.

Contents

Early life

Born in Brooklyn, New York, Stolfo received a Bachelor of Science degree in Computer Science and Mathematics from Brooklyn College in 1974. He received his Ph.D. from NYU Courant Institute in 1979 and has been on the faculty of Columbia ever since, [1] where he's taught courses in Artificial Intelligence, Intrusion and Anomaly Detection Systems, Introduction to Programming, Fundamental Algorithms, Data Structures, and Knowledge-Based Expert Systems. [2]

Academic research

While at Columbia, Stolfo has received close to $50M in funding [3] for research that has broadly focused on Security, Intrusion Detection, Anomaly Detection, Machine Learning and includes early work in parallel computing and artificial intelligence. [4] He has published or co-authored over 250 papers and has over 46,000 citations with an H-index of 102. [5] In 1996 he proposed a project with DARPA that applies machine learning to behavioral patterns to detect fraud or intrusion in networks. [6]

DADO, developed by in part by Stolfo, introduced the parallel computing primitive: “Broadcast, Resolve, Report”, a hardwire implemented mechanism that today is called MapReduce. [7] [8]

Among his earliest work, Stolfo along with colleague Greg Vesonder of Bell Labs, developed a large-scale expert data analysis system, called ACE (Automated Cable Expertise) for the nation's phone system. AT&T Bell Labs distributed ACE to a number of telephone wire centers to improve the management and scheduling of repairs in the local loop. [9]

Stolfo coined the term FOG computing (not to be confused with fog computing) where technology is used “to launch disinformation attacks against malicious insiders, preventing them from distinguishing the real sensitive customer data from fake worthless data.” [10]

In 2005 Stolfo received funding from the Army Research Office to conduct a workshop to bring together a group of researchers to help identify a research program to focus on insider threats. [11]

He was elevated to IEEE Fellow in 2018 "for his contributions to machine learning based cybersecurity." [12]

He was elected as an ACM Fellow in 2019 "for contributions to machine-learning-based cybersecurity and parallel hardware for database inference systems". [13]

Career

Founded in 2011, Red Balloon Security (or RBS) is a cyber security company founded by Dr Sal Stolfo and Dr Ang Cui. A spinout from the IDS lab, RBS developed a symbiote technology called FRAK as a host defense for embedded systems under the sponsorship of DARPA's Cyber Fast Track program. [14]

Created based on their IDS lab research for the DARPA Active Authentication and the Anomaly Detection at Multiple Scales program, Dr Sal Stolfo and Dr. Angelos Keromytis founded Allure Security Technologies. Using active behavioral authentication and decoy technology Stolfo pioneered and patented in 1996. [15] [16] [17] [18] [19]

Founded in 2009, Allure Security Technology was created based on work done under DARPA sponsorship in Columbia's IDS lab based on DARPA prompts to research how to detect hackers once they are inside an organization's perimeter and how to continuously authenticate a user without a password.

Stolfo's company Electronic Digital Documents produced a “DataBlade” technology, which Informix marketed during their strategy of acquisition and development in the mid 80's. [20] Stolfo's patented merge/purge technology called EDD DataCleanser DataBlade was licensed by Informix. [21] [22] Since its acquisition by IBM in 2005, IBM Informix is one of the world's most widely used database servers, with users ranging from the world's largest corporations to startups.

System Detection was one of the companies founded by Prof. Stolfo to commercialize the Anomaly Detection technology developed in the IDS lab. The company ultimately reorganized and was rebranded as Trusted Computer Solutions. That company was recently acquired by Raytheon. [23] [24]

Recently a jury awarded Columbia University $185 million for patent infringement for one of Prof. Stolfo's inventions, the Application Communities technology. https://news.columbia.edu/news/columbia-university-awarded-185-million-patent-infringement-nortonlifelock-inc. The final order from the judge applied nearly treble damages: https://www.reuters.com/legal/litigation/gen-digital-owes-columbia-481-mln-us-patent-fight-judge-says-2023-10-02/

Related Research Articles

An intrusion detection system is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically either reported to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.

IDS may refer to:

<span class="mw-page-title-main">SRI International</span> American scientific research institute (founded 1946)

SRI International (SRI) is an American nonprofit scientific research institute and organization headquartered in Menlo Park, California. The trustees of Stanford University established SRI in 1946 as a center of innovation to support economic development in the region.

<span class="mw-page-title-main">Computer science and engineering</span> University academic program

Computer science and engineering (CSE) is an academic program at many universities which comprises approaches of computer science and computer engineering. There is no clear division in computing between science and engineering, just like in the field of materials science and engineering. However, some classes are historically more related to computer science, and other to computer engineering. CSE is also a term often used in Europe to translate the name of technical or engineering informatics academic programs. It is offered in both undergraduate as well postgraduate with specializations.

Honeytokens are fictitious words or records that are added to legitimate databases. They allow administrators to track data in situations they wouldn't normally be able to track, such as cloud-based networks. If data is stolen, honey tokens allow administrators to identify who it was stolen from or how it was leaked. If there are three locations for medical records, different honey tokens in the form of fake medical records could be added to each location. Different honeytokens would be in each set of records.

An anomaly-based intrusion detection system, is an intrusion detection system for detecting both network and computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and attempts to detect any type of misuse that falls out of normal system operation. This is as opposed to signature-based systems, which can only detect attacks for which a signature has previously been created.

<span class="mw-page-title-main">Dorothy E. Denning</span> American information security researcher

Dorothy Elizabeth Denning is a US-American information security researcher known for lattice-based access control (LBAC), intrusion detection systems (IDS), and other cyber security innovations. She published four books and over 200 articles. Inducted into the National Cyber Security Hall of Fame in 2012, she is now Emeritus Distinguished Professor of Defense Analysis, Naval Postgraduate School.

<span class="mw-page-title-main">Carnegie Mellon Silicon Valley</span> Branch campus in California

Carnegie Mellon Silicon Valley is a degree-granting branch campus of Carnegie Mellon University located in the heart of Silicon Valley in Mountain View, California. It was established in 2002 at the NASA Ames Research Center in Moffett Field.

Microsoft Research (MSR) is the research subsidiary of Microsoft. It was created in 1991 by Richard Rashid, Bill Gates and Nathan Myhrvold with the intent to advance state-of-the-art computing and solve difficult world problems through technological innovation in collaboration with academic, government, and industry researchers. The Microsoft Research team has more than 1,000 computer scientists, physicists, engineers, and mathematicians, including Turing Award winners, Fields Medal winners, MacArthur Fellows, and Dijkstra Prize winners.

In data analysis, anomaly detection is generally understood to be the identification of rare items, events or observations which deviate significantly from the majority of the data and do not conform to a well defined notion of normal behaviour. Such examples may arouse suspicions of being generated by a different mechanism, or appear inconsistent with the remainder of that set of data.

Data loss prevention (DLP) software detects potential data breaches/data exfiltration transmissions and prevents them by monitoring, detecting and blocking sensitive data while in use, in motion, and at rest.

<span class="mw-page-title-main">Sourcefire</span> American computer security company

Sourcefire, Inc was a technology company that developed network security hardware and software. The company's Firepower network security appliances were based on Snort, an open-source intrusion detection system (IDS). Sourcefire was acquired by Cisco for $2.7 billion in July 2013.

PRODIGAL is a computer system for predicting anomalous behavior among humans, by data mining network traffic such as emails, text messages and server log entries. It is part of DARPA's Anomaly Detection at Multiple Scales (ADAMS) project. The initial schedule is for two years and the budget $9 million.

Anomaly Detection at Multiple Scales, or ADAMS, was a $35 million DARPA project designed to identify patterns and anomalies in very large data sets. It is under DARPA's Information Innovation office and began in 2011 and ended in August 2014

Cyber Insider Threat, or CINDER, is a digital threat method. In 2010, DARPA initiated a program under the same name to develop novel approaches to the detection of activities within military-interest networks that are consistent with the activities of cyber espionage.

<span class="mw-page-title-main">Yuval Elovici</span>

Yuval Elovici is a computer scientist. He is a professor in the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev (BGU), where he is the incumbent of the Davide and Irene Sala Chair in Homeland Security Research. He is the director of the Cyber Security Research Center at BGU and the founder and director of the Telekom Innovation Laboratories at Ben-Gurion University. In addition to his roles at BGU, he also serves as the lab director of Singapore University of Technology and Design’s (SUTD) ST Electronics-SUTD Cyber Security Laboratory, as well as the research director of iTrust. In 2014 he co-founded Morphisec, a start-up company, that develops cyber security mechanisms related to moving target defense.

<span class="mw-page-title-main">Ang Cui</span> American computer scientist

Ang Cui is an American cybersecurity researcher and entrepreneur. He is the founder and CEO of Red Balloon Security in New York City, a cybersecurity firm that develops new technologies to defend embedded systems against exploitation.

<span class="mw-page-title-main">Lauren Wilcox</span> American professor and researcher

Lauren G. Wilcox is an American professor and researcher in responsible AI, human–computer interaction, and health informatics, known for research on enabling community participation in technology design and development and her prior contributions to health informatics systems.

Ali Dehghantanha is an academic-entrepreneur in cybersecurity and cyber threat intelligence. He is a Professor of Cybersecurity and a Canada Research Chair in Cybersecurity and Threat Intelligence.

The Lincoln Adaptable Real-time Information Assurance Testbed (LARIAT) is a physical computing platform developed by the MIT Lincoln Laboratory as a testbed for network security applications. Use of the platform is restricted to the United States military, though some academic organizations can also use the platform under certain conditions.

References

  1. "Professor Salvatore J. Stolfo". Cs.columbia.edu. 2015-02-09. Retrieved 2015-06-26.
  2. "Recent Courses". Cs.columbia.edu. Retrieved 2015-06-26.
  3. "Salvatore J. Stolfo CV" (PDF). Cs.columbia.edu. Retrieved 2015-06-26.
  4. "Salvatore Stolfo - Google Scholar Citations" . Retrieved 2015-07-01.
  5. "Salvatore Stolfo - Google Scholar Citations" . Retrieved 2015-06-26.
  6. "The JAM Project: Fraud and Intrusion Detection Using Meta-learning Agents". Sneakers.cs.columbia.edu. Archived from the original on 2014-10-23. Retrieved 2015-06-26.
  7. Strategic Computing: DARPA and the Quest for Machine Intelligence, 1983-1993, By Alex Roland, Philip Shiman, Pages 173-175.
  8. Stolfo, Salvatore; Miranker, Daniel P. (1984). "DADO: A Parallel Processor for Expert Systems - Academic Commons". Academic Commons. Academiccommons.columbia.edu. doi:10.7916/D8F196VH . Retrieved 2015-08-05.
  9. Waldes, Peter; Lustgarten, Janet; Stolfo, Salvatore (1985). "Are maintenance expert systems practical now? - Academic Commons". Academic Commons. Academiccommons.columbia.edu. doi:10.7916/D8WD481H . Retrieved 2015-07-01.
  10. Stolfo, Salvatore J. (2012-05-25). "Fog Computing: Mitigating Insider Data Theft Attacks in the Cloud - Academic Commons". Academiccommons.columbia.edu. doi:10.1109/SPW.2012.19. S2CID   6150529 . Retrieved 2015-07-01.{{cite journal}}: Cite journal requires |journal= (help)
  11. Stolfo, Salvatore J.; Stavrou, Angelos; Wright, Charles V. (2013-10-23). Research in Attacks, Intrusions, and Defenses: 16th International Symposium ... - Google Books. Springer. ISBN   9783642412844 . Retrieved 2015-07-01.
  12. "IEEE Computer Society Members Elevated to Fellow for 2018 | IEEE Computer Society". 12 April 2018.
  13. 2019 ACM Fellows Recognized for Far-Reaching Accomplishments that Define the Digital Age, Association for Computing Machinery, retrieved 2019-12-11
  14. Mark Piesing. "Hacking attacks on printers still not being taken seriously | Technology". The Guardian. Retrieved 2015-07-01.
  15. "Patent US8528091 - Methods, systems, and media for detecting covert malware - Google Patents" . Retrieved 2015-07-01.
  16. http://www.uspto.gov/web/patents/patog/week34/OG/html/1405-4/US08819825-20140826.html%5B%5D
  17. "DARPA - Open Catalog". Archived from the original on 2015-07-11. Retrieved 2015-07-10.
  18. Patent US8769684 - Methods, systems, and media for masquerade attack detection by monitoring ... - Google Patents
  19. "Archived copy". Archived from the original on 2016-03-04. Retrieved 2015-06-29.{{cite web}}: CS1 maint: archived copy as title (link)
  20. Matching Records in Multiple Databases Using a Hybridization of Several ... - Google Books
  21. "Salvatore Joseph Stolfo - Nomination and Bio". Govinfo.library.unt.edu. Retrieved 2015-06-26.
  22. Data Mining and Knowledge Discovery Handbook - Google Books
  23. "CounterStorm, Inc.: Private Company Information - Businessweek". Investing.businessweek.com. 2008-09-05. Archived from the original on June 27, 2015. Retrieved 2015-06-26.
  24. Raytheon Company : Investor Relations : News Release