1. 1 CAP6133: Advanced Topics in Computer Security and Computer Forensics (spring’08) Class Overview Dr. Cliff Zou

2. 2 Monday/Wednesday 1:30pm – 2:45pm Office Hour: M/W 11:30am – 1:30pm HEC-335, czou@cs.ucf.edu, 407-823-5015czou@cs.ucf.edu Class webpage:  http://www.cs.ucf.edu/~czou/CAP6133 http://www.cs.ucf.edu/~czou/CAP6133 No required textbooks  Online resources, published papers

3. 3 Why Am I Teaching This Course? Computer Security is important  A broad research/application issue  Impact on many important applications  Become more important as we rely heavily on computer and the Internet Computer Forensics is also important  To capture bad guys  Learn from previous mistakes for improvement

4. 4 Why Am I Teaching This Course? Helpful to your graduate study and future career:  If you plan to conduct security research related work  If you plan to conduct any research-related work  Help you to learn basic steps in conducting research  How to: Read paper? Find weaknesses in paper? Find new topics to do? Make presentation? Conduct collaborated research?

5. 5 A “Seminar” Type Course Focus on cybersecurity-related research Study research papers, publications, online resources Not an introductory lecturing class  No textbooks  No lab experiments  No lectures on security appliance or cryptography  I will give introductory lecture on some research topics before we begin those topics

6. 6 Students must have active roles:  Present papers in class  Be active in class discussion, ask questions!  Count in your grade! However, you are not required to have much knowledge of computer security beforehand

7. 7 Prerequisite You should have knowledge of computer networking!  TCP/IP, packet, Internet (addr., DNS, routing…) Basic knowledge on:  Probability (many research work uses this!)  Software (stack, system call…)  Operating system

8. 8 Class Grading Policy Class presentations: 20% Homework (paper review/summary): 10% In-class participation/discussion: 20% Final term project: 50%  Two students as a group Will use +/- grading system

9. 9 Class Workload Presentation  Two students present two papers in one class Informal homework  Weekly review of two papers presented in the next week Final term project (2 students in a group)  Work on any security research topic you choose  Finish an academic paper format project report and give a presentation in the end

10. 10 Class Workload Class workload is light-weighted  No mid-term exam, no final-term exam  No formal homework  Weekly review help you glance over papers presented in the next week  No programming projects  Your term project might need you to program Need your active participation!  Present papers carefully in class help you and others!  In-class discussion is counted (20% of grade)

11. 11 Topics Covered in Class Focus on wired Internet security  Internet worm, Internet security measurement  Honeypot, Spam, Denial-of-Service  Network attack techniques  Host-based computer security  Software security, OS security More papers to be added in the following two weeks

12. 12 Topics Covered in Class Also focus on computer forensics research:  Intrusion detection  Steganography, watermarking  Rootkit  Anonymity  Covert Channel, timing attack Dr. Sheau-Dong Lang will give several guest lectures on computer forensics in this class

13. 13 Term Project Two students form a group to do term project together  A research oriented term project  Project report follows the same format as a paper for publish  Learn how to conduct research and write paper  Learn how to communicate and collaborate with your colleague Form the group and decide your topic 6-8 weeks later

14. 14 Example of Term Project Simple:  Survey of the state-of-art research work in a topic  Repeat and realize algorithm/experiments in a published paper Middle:  Minor improvement of algorithms in published papers Advanced:  Present a novel idea with support from simulation or real experiments  E.g., success in using an idea from another area to a new topic in computer security  Has potential to be developed as a publishable paper

15. 15 Class Format Papers are grouped according to topics As we move to a new topic, usually I will present a brief introduction In each class, two students present two papers  Presentation: 25 min  Discussion: 10 min  My summary: 5 min (at the end if time allows)  Point out what you do right, wrong  Help you improve your paper reading, presentation skill

16. 16 Next I will give two presentations in this Wednesday  “Introduction of Internet worm modeling and defense”  “Modeling and Measuring Botnet” Objective:  Give you an example on paper presentation  Show how to ask questions in reading a paper  Show how to find points to do further research by yourself Come ready to ask questions and discuss  Remember, class discussion counts 20% of grade!