Stock

Although detection of many types of web-based flaws has been in the focus of researchers over the previous years, notifying affected parties barely got any attention. For this project, we try to identify potential channels for notification and evaluate their effectiveness (Stock et al. 2016). Also, we try to improve not only on technical measures like avoiding spam filters, but also try to understand the human aspects of a notification, such as how different wording might influence the success of a notification. (Stock et al. 2018)

With its prevalence in the browser, JavaScript also makes for a prime target for attackers. Therefore, our group researches new ways of detecting malicious JavaScript in the wild. Specifically, this subsumes work in which we automatically generate signatures for exploit kits, alleviating the burden of malware analysists (Stock, Livshits, and Zorn 2016). In addition, our work focusses on detection of malicious JavaScript in general through methods of machine learning (Fass et al. 2018; Fass, Backes, and Stock 2019) and novel ways of bypassing existing static analysis tools (Fass, Backes, and Stock 2019).