Threat Detection & Defenses

To proactively understand potential attacks on complex IT systems, we need to perform a comprehensive threat analysis of possible attack vectors. Based on this knowledge, we can develop novel methods to reliably detect, predict, and comprehensibly explain known and emerging threats to IT systems. Such threat detection mechanisms must also be able to cope with evasion techniques such as obfuscation or low-level covert attacks. The resulting detection mechanisms should not only be able to detect every critical incident, but also raise alarms only when necessary. The more false alarms that are triggered, the higher the risk that users will ignore the warnings or even permanently disable detection mechanisms.

To create a strong line of defense, attack detection methods should be complemented by appropriate defense methods, ideally chosen autonomously by the attacked system to counter any threat it encounters. In this research area, we pursue this ideal in a variety of ways, for example, by focusing on identifying and mitigating novel system vulnerabilities, developing new methods for software security of complex systems, or novel side-channel attacks and defenses at different system levels.