Stefan Savage | |
---|---|
Born | 1969 (age 53–54) |
Nationality | American |
Occupations |
|
Title | Irwin and Joan Jacobs Chair in Information and Computer Science |
Academic background | |
Education | |
Academic work | |
Institutions | University of California,San Diego |
Stefan Savage (born 1969) is an American computer science researcher,currently a Professor in the Systems and Networking Group at the University of California,San Diego. There,he holds the Irwin and Joan Jacobs Chair in Information and Computer Science. [1] Savage is widely cited in computer security,particularly in the areas of email spam,network worms and malware propagation,distributed denial of service (DDOS) mitigation and traceback,automotive hacking and wireless security. He received his undergraduate degree at Carnegie Mellon and his Ph.D. from the University of Washington (2002). [2]
In 1999,Savage's research team published TCP Congestion Control with a Misbehaving Receiver,which uncovered protocol flaws in the TCP protocol that carries most Internet traffic. By exploiting these flaws,Savage proposed means for attackers to evade congestion control,allowing attackers to monopolize crowded network connections that would otherwise be shared by multiple users. This was the first paper to address congestion control evasion as a vulnerability,rather than as a theoretical design implication. That same year,Savage published "Sting",a paper and software tool that presented a mechanism to abuse quirks in the TCP protocol to allow a single party to infer bidirectional packet loss,a valuable contribution to traffic measurement. [3]
In 2000,Savage's team published Practical Network Support for IP Traceback,which proposed a simple stochastic extension to internet routers that would enable them to trace floods of traffic back to their origin. IP traceback is a major open networking research question,with significant implications towards DDOS mitigation:if IP traffic can be traced,Internet Service Providers can track down and halt DDOS floods. Savage later co-founded Asta Networks,which offered a product that addressed these problems. [3]
In 2001,Savage,with colleagues at UCSD and CAIDA,published Inferring Internet Denial-of-Service Activity,which introduced the idea of the network telescope and provided major empirical results regarding DDOS attacks. [3] Follow-on work has provided insight into the spread of network worms,including Code Red II and SQL Slammer. [4]
In 2003,John Bellardo and Savage published 802.11 Denial-of-Service Attacks:Real Vulnerabilities and Practical Solutions,which introduced practical attacks on 802.11 wireless protocol flaws that would allow attackers to force legitimate clients off wireless networks. The paper is also a notable example of applied reverse engineering in an academic setting;Bellardo and Savage reverse engineered the Intersil wireless chipset,finding an undocumented diagnostic mode that allowed them to directly inject malicious wireless packets onto a network. [5]
In 2004,Savage and George Varghese led a research team that published Automated Worm Fingerprinting,which introduced a novel hashing technique that allowed network operators to monitor network traffic and uncover data patterns that were "propagating",spreading across the network at an unusual rate. Propagating traffic is a strong indicator for network worm outbreaks,a key unsolved problem in network security. Varghese later co-founded Netsift to capitalize on this research;Cisco purchased Netsift in 2005. [6]
In 2005,Ishwar Ramani and Stefan Savage developed Syncscan algorithm that cuts the time needed to switch between Wi-Fi access points.
In 2004,Savage was awarded a Sloan Research Fellowship, [7] in 2010 he was named a Fellow of the Association for Computing Machinery [8] and in 2013,he received the ACM SIGOPS Mark Weiser Award. [9]
In 2015,he received the ACM Prize in Computing for "innovative research in network security,privacy,and reliability that has taught us to view attacks and attackers as elements of an integrated technological,societal,and economic system." [10]
In 2017,he was named a MacArthur Foundation Fellow (the "genius grant") for his body of work. [11] Savage was elected a Fellow of the American Academy of Arts and Sciences in 2021 [12] and was named a recipient of the American Association for the Advancement of Science-administered Golden Goose Award the same year. [13] In 2022,he was elected to the National Academy of Engineering. [14]
The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network implementation in which it complemented the Internet Protocol (IP). Therefore,the entire suite is commonly referred to as TCP/IP. TCP provides reliable,ordered,and error-checked delivery of a stream of octets (bytes) between applications running on hosts communicating via an IP network. Major internet applications such as the World Wide Web,email,remote administration,and file transfer rely on TCP,which is part of the Transport Layer of the TCP/IP suite. SSL/TLS often runs on top of TCP.
In computing,a denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Denial of service is typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.
A SYN flood is a form of denial-of-service attack on data communications in which an attacker rapidly initiates a connection to a server without finalizing the connection. The server has to spend resources waiting for half-opened connections,which can consume enough resources to make the system unresponsive to legitimate traffic.
Wi-Fi Protected Access (WPA),Wi-Fi Protected Access 2 (WPA2),and Wi-Fi Protected Access 3 (WPA3) are the three security certification programs developed after 2000 by the Wi-Fi Alliance to secure wireless computer networks. The Alliance defined these in response to serious weaknesses researchers had found in the previous system,Wired Equivalent Privacy (WEP).
Network congestion in data networking and queueing theory is the reduced quality of service that occurs when a network node or link is carrying more data than it can handle. Typical effects include queueing delay,packet loss or the blocking of new connections. A consequence of congestion is that an incremental increase in offered load leads either only to a small increase or even a decrease in network throughput.
Internet security is a branch of computer security. It encompasses the Internet,browser security,web site security,and network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules and measures to use against attacks over the Internet. The Internet is an inherently insecure channel for information exchange,with high risk of intrusion or fraud,such as phishing,online viruses,trojans,ransomware and worms.
IP traceback is any method for reliably determining the origin of a packet on the Internet. The IP protocol does not provide for the authentication of the source IP address of an IP packet,enabling the source address to be falsified in a strategy called IP address spoofing,and creating potential internet security and stability problems.
The AMPRNet or Network 44 is used in amateur radio for packet radio and digital communications between computer networks managed by amateur radio operators. Like other amateur radio frequency allocations,an IP range of 44.0.0.0/8 was provided in 1981 for Amateur Radio Digital Communications and self-administered by radio amateurs. In 2001,undocumented and dual-use of 44.0.0.0/8 as a network telescope began,recording the spread of the Code Red II worm in July 2001. In mid-2019,part of IPv4 range was sold off for conventional use,due to IPv4 address exhaustion.
A computer network is a set of computers sharing resources located on or provided by network nodes. Computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are made up of telecommunication network technologies based on physically wired,optical,and wireless radio-frequency methods that may be arranged in a variety of network topologies.
A network telescope is an Internet system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic targeting the dark (unused) address-space of the network. Since all traffic to these addresses is suspicious,one can gain information about possible network attacks as well as other misconfigurations by observing it.
In networking,a black hole,also known as a block hole,refers to a place in the network where incoming or outgoing traffic is silently discarded,without informing the source that the data did not reach its intended recipient.
Adam Dunkels is a Swedish computer scientist,computer programmer,entrepreneur,and founder of Thingsquare,an Internet of things (IoT) product development business.
An application delivery network (ADN) is a suite of technologies that,when deployed together,provide availability,security,visibility,and acceleration for Internet applications such as websites. ADN components provide supporting functionality that enables website content to be delivered to visitors and other users of that website,in a fast,secure,and reliable way.
In computing,Microsoft's Windows Vista and Windows Server 2008 introduced in 2007/2008 a new networking stack named Next Generation TCP/IP stack,to improve on the previous stack in several ways. The stack includes native implementation of IPv6,as well as a complete overhaul of IPv4. The new TCP/IP stack uses a new method to store configuration settings that enables more dynamic control and does not require a computer restart after a change in settings. The new stack,implemented as a dual-stack model,depends on a strong host-model and features an infrastructure to enable more modular components that one can dynamically insert and remove.
Hari Balakrishnan is the Fujitsu Professor of Computer Science and Artificial Intelligence in the Department of Electrical Engineering and Computer Science at MIT,and the Co-founder and CTO at Cambridge Mobile Telematics.
Anna R. Karlin is an American computer scientist,the Microsoft Professor of Computer Science &Engineering at the University of Washington.
DDoS mitigation is a set of network management techniques and/or tools,for resisting or mitigating the impact of distributed denial-of-service (DDoS) attacks on networks attached to the Internet,by protecting the target,and relay networks. DDoS attacks are a constant threat to businesses and organizations,by delaying service performance,or by shutting down a website entirely.
Multipath TCP (MPTCP) is an ongoing effort of the Internet Engineering Task Force's (IETF) Multipath TCP working group,that aims at allowing a Transmission Control Protocol (TCP) connection to use multiple paths to maximize throughput and increase redundancy.
BASHLITE is malware which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor,but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.
Mirai is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. The Mirai botnet was first found in August 2016 by MalwareMustDie,a white hat malware research group,and has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks,including an attack on 20 September 2016 on computer security journalist Brian Krebs' website,an attack on French web host OVH,and the October 2016 Dyn cyberattack. According to a chat log between Anna-senpai and Robert Coelho,Mirai was named after the 2011 TV anime series Mirai Nikki.