2025-11-19T07:33:48+00:00 https://kapravelos.com Alexandros Kapravelos akaprav@ncsu.edu 2024-05-23T00:00:00+00:00 https://kapravelos.com/research/2024/05/23/secweb24-keynote <p>I gave the keynote at SecWeb 2024 focusing specifically on the thread of our work that evolves around VisibleV8. Here are the details of the talk:</p> <h1 id="unveiling-web-threats-insights-from-javascript-behavior">Unveiling Web Threats: Insights from JavaScript Behavior</h1> <p>The web has become an integral part of our daily lives, enabling communication, commerce, and access to information. However, the increasing complexity of web applications and the JavaScript language that powers them has also opened the door to security threats. Malicious actors exploit JavaScript to track users, deliver malware, and launch sophisticated attacks that compromise user privacy and security. Understanding and mitigating these threats requires deep visibility into real-world JavaScript behavior and the ability to detect emerging attack techniques.</p> <p>In this keynote, I will present our research on uncovering web threats through analysis of JavaScript behavior in the wild. We built VisibleV8 to enable in-browser monitoring of JavaScript execution across the web, providing unprecedented insights into the scripts that web pages run. Leveraging this visibility, we developed techniques to automatically discover new browser fingerprinting methods that websites use to stealthily track users. A novel approach to detect JavaScript obfuscation that hides malicious behavior was also created by identifying scripts’ usage of concealed browser APIs. Finally, I will discuss work on conducting realistic and reproducible web crawl measurements, which is critical for understanding the web threat landscape. Together, this body of research enables a novel way of studying security and privacy threats on the web.</p> <!-- <ol class="bibliography" reversed="reversed"><li><div id="bibtex-vv8webview-ndss26" class="anchor"> <strong>Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews</strong><br> <em> Sohom Datta, Michalis Diamantaris, Ahsan Zafar, Junhua Su, Anupam Das, Jason Polakis, Alexandros Kapravelos </em><br> Proceedings of the Network and Distributed System Security Symposium (NDSS), 2026 <br> <a href="/publications/vv8webview-ndss26.pdf">[PDF]</a> <a href="#bibtex-vv8webview-ndss26" id="btn-vv8webview-ndss26" onclick='showmodal("modal-vv8webview-ndss26")'>[Bibtex]</a> <a href="https://github.com/wspr-ncsu/webviewtracer">[code]</a> <div id="modal-vv8webview-ndss26" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-vv8webview-ndss26")'>×</span> <pre>@inproceedings{vv8webview-ndss26, title = {{Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews}}, author = {Datta, Sohom and Diamantaris, Michalis and Zafar, Ahsan and Su, Junhua and Das, Anupam and Polakis, Jason and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}}, month = feb, code = {{https://github.com/wspr-ncsu/webviewtracer}}, tag = {vv8}, year = {2026} } </pre> </div> </div> </div> </li> <li><div id="bibtex-fakestars-icse26" class="anchor"> <strong>Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware</strong><br> <em> Hao He, Haoqin Yang, Philipp Burckhardt, Alexandros Kapravelos, Bogdan Vasilescu, Christian Kästner </em><br> Proceedings of the International Conference on Software Engineering (ICSE), 2026 <br> <a href="/publications/fakestars-icse26.pdf">[PDF]</a> <a href="#bibtex-fakestars-icse26" id="btn-fakestars-icse26" onclick='showmodal("modal-fakestars-icse26")'>[Bibtex]</a> <a href="https://github.com/hehao98/StarScout">[code]</a> <div id="modal-fakestars-icse26" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-fakestars-icse26")'>×</span> <pre>@inproceedings{fakestars-icse26, title = {{Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware}}, author = {He, Hao and Yang, Haoqin and Burckhardt, Philipp and Kapravelos, Alexandros and Vasilescu, Bogdan and K{ä}stner, Christian}, booktitle = {{Proceedings of the International Conference on Software Engineering (ICSE)}}, code = {{https://github.com/hehao98/StarScout}}, year = {2026} } </pre> </div> </div> </div> </li> <li><div id="bibtex-vv8diverge-ccs25" class="anchor"> <strong>Same Script, Different Behavior: Characterizing Platform-Specific Divergent JavaScript Execution</strong><br> <em> Ahsan Zafar, Junhua Su, Sohom Datta, Alexandros Kapravelos, Anupam Das </em><br> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2025 <br> <a href="/publications/vv8diverge-ccs25.pdf">[PDF]</a> <a href="#bibtex-vv8diverge-ccs25" id="btn-vv8diverge-ccs25" onclick='showmodal("modal-vv8diverge-ccs25")'>[Bibtex]</a> <div id="modal-vv8diverge-ccs25" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-vv8diverge-ccs25")'>×</span> <pre>@inproceedings{vv8diverge-ccs25, title = {{Same Script, Different Behavior: Characterizing Platform-Specific Divergent JavaScript Execution}}, author = {Zafar, Ahsan and Su, Junhua and Datta, Sohom and Kapravelos, Alexandros and Das, Anupam}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, month = oct, tag = {vv8}, year = {2025} } </pre> </div> </div> </div> </li> <li><div id="bibtex-tosem-directions" class="anchor"> <strong>Research Directions in Software Supply Chain Security</strong><br> <em> Laurie Williams, Giacomo Benedetti, Sivana Hamer, Ranindya Paramitha, Imranur Rahman, Mahzabin Tamanna, Greg Tystahl, Nusrat Zahan, Patrick Morrison, Yasemin Acar, Michel Cukier, Christian Kästner, Alexandros Kapravelos, Dominik Wermke, William Enck </em><br> ACMACM Transactions on Software Engineering Methodology (TOSEM), 2025 <br> <a href="/publications/tosem-directions.pdf">[PDF]</a> <a href="#bibtex-tosem-directions" id="btn-tosem-directions" onclick='showmodal("modal-tosem-directions")'>[Bibtex]</a> <div id="modal-tosem-directions" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-tosem-directions")'>×</span> <pre>@inproceedings{tosem-directions, author = {Williams, Laurie and Benedetti, Giacomo and Hamer, Sivana and Paramitha, Ranindya and Rahman, Imranur and Tamanna, Mahzabin and Tystahl, Greg and Zahan, Nusrat and Morrison, Patrick and Acar, Yasemin and Cukier, Michel and K\"{a}stner, Christian and Kapravelos, Alexandros and Wermke, Dominik and Enck, William}, title = {Research Directions in Software Supply Chain Security}, year = {2025}, issue_date = {June 2025}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, volume = {34}, number = {5}, issn = {1049-331X}, url = {https://doi.org/10.1145/3714464}, doi = {10.1145/3714464}, booktitle = {ACM{ACM Transactions on Software Engineering Methodology (TOSEM)}}, month = may } </pre> </div> </div> </div> </li> <li><div id="bibtex-repro-icse25" class="anchor"> <strong>An Empirical Study on Reproducible Packaging in Open-Source Ecosystems</strong><br> <em> Giacomo Benedetti, Oreofe Solarin, Courtney Miller, Greg Tystahl, William Enck, Christian Kästner, Alexandros Kapravelos, Alessio Merlo, Luca Verderame </em><br> Proceedings of the International Conference on Software Engineering (ICSE), 2025 <br> <a href="/publications/repro-icse25.pdf">[PDF]</a> <a href="#bibtex-repro-icse25" id="btn-repro-icse25" onclick='showmodal("modal-repro-icse25")'>[Bibtex]</a> <div id="modal-repro-icse25" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-repro-icse25")'>×</span> <pre>@inproceedings{repro-icse25, title = {{An Empirical Study on Reproducible Packaging in Open-Source Ecosystems}}, author = {Benedetti, Giacomo and Solarin, Oreofe and Miller, Courtney and Tystahl, Greg and Enck, William and K{ä}stner, Christian and Kapravelos, Alexandros and Merlo, Alessio and Verderame, Luca}, booktitle = {{Proceedings of the International Conference on Software Engineering (ICSE)}}, year = {2025} } </pre> </div> </div> </div> </li> <li><div id="bibtex-jshint-isc24" class="anchor"> <strong>JSHint: Revealing API Usage to Improve Detection of Malicious JavaScript</strong><br> <em> Shaown Sarker, Kasimir Schulz, Aleksandr Nahapetyan, Anupam Das, Alexandros Kapravelos </em><br> Proceedings of the Information Security Conference (ISC), 2024 <br> <a href="/publications/jshint-isc24.pdf">[PDF]</a> <a href="#bibtex-jshint-isc24" id="btn-jshint-isc24" onclick='showmodal("modal-jshint-isc24")'>[Bibtex]</a> <div id="modal-jshint-isc24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-jshint-isc24")'>×</span> <pre>@inproceedings{jshint-isc24, title = {{JSHint: Revealing API Usage to Improve Detection of Malicious JavaScript}}, author = {Sarker, Shaown and Schulz, Kasimir and Nahapetyan, Aleksandr and Das, Anupam and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Information Security Conference (ISC)}}, month = oct, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-webehavior-isc24" class="anchor"> <strong>Automated Generation of Behavioral Signatures for Malicious Web Campaigns</strong><br> <em> Shaown Sarker, William Melicher, Oleksii Starov, Anupam Das, Alexandros Kapravelos </em><br> Proceedings of the Information Security Conference (ISC), 2024 <br> <a href="/publications/webehavior-isc24.pdf">[PDF]</a> <a href="#bibtex-webehavior-isc24" id="btn-webehavior-isc24" onclick='showmodal("modal-webehavior-isc24")'>[Bibtex]</a> <div id="modal-webehavior-isc24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-webehavior-isc24")'>×</span> <pre>@inproceedings{webehavior-isc24, title = {{Automated Generation of Behavioral Signatures for Malicious Web Campaigns}}, author = {Sarker, Shaown and Melicher, William and Starov, Oleksii and Das, Anupam and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Information Security Conference (ISC)}}, month = oct, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-fv8-sec24" class="anchor"> <strong>FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques</strong><br> <em> Nikolaos Pantelaios, Alexandros Kapravelos </em><br> Proceedings of the USENIX Security Symposium, 2024 <br> <a href="/publications/fv8-sec24.pdf">[PDF]</a> <a href="#bibtex-fv8-sec24" id="btn-fv8-sec24" onclick='showmodal("modal-fv8-sec24")'>[Bibtex]</a> <a href="https://github.com/wspr-ncsu/FV8">[code]</a> <div id="modal-fv8-sec24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-fv8-sec24")'>×</span> <pre>@inproceedings{fv8-sec24, title = {{FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques}}, author = {Pantelaios, Nikolaos and Kapravelos, Alexandros}, booktitle = {{Proceedings of the USENIX Security Symposium}}, code = {{https://github.com/wspr-ncsu/FV8}}, month = aug, tag = {vv8}, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-smsphishing-sp24" class="anchor"> <strong>On SMS Phishing Tactics and Infrastructure</strong><br> <em> Aleksandr Nahapetyan, Sathvik Prasad, Kevin Childs, Adam Oest, Yeganeh Ladwig, Alexandros Kapravelos, Brad Reaves </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2024 <br> <a href="/publications/smsphishing-sp24.pdf">[PDF]</a> <a href="#bibtex-smsphishing-sp24" id="btn-smsphishing-sp24" onclick='showmodal("modal-smsphishing-sp24")'>[Bibtex]</a> <div id="modal-smsphishing-sp24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-smsphishing-sp24")'>×</span> <pre>@inproceedings{smsphishing-sp24, title = {{On SMS Phishing Tactics and Infrastructure}}, author = {Nahapetyan, Aleksandr and Prasad, Sathvik and Childs, Kevin and Oest, Adam and Ladwig, Yeganeh and Kapravelos, Alexandros and Reaves, Brad}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, month = may, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-untrustide-ndss24" class="anchor"> <strong>UntrustIDE: Exploiting Weaknesses in VS Code Extensions</strong><br> <em> Elizabeth Lin, Igibek Koishybayev, Trevor Dunlap, William Enck, Alexandros Kapravelos </em><br> Proceedings of the Network and Distributed System Security Symposium (NDSS), 2024 <br> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;"><strong>Distinguished Paper Award</strong><br clear="all"> <a href="/publications/untrustide-ndss24.pdf">[PDF]</a> <a href="#bibtex-untrustide-ndss24" id="btn-untrustide-ndss24" onclick='showmodal("modal-untrustide-ndss24")'>[Bibtex]</a> <div id="modal-untrustide-ndss24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-untrustide-ndss24")'>×</span> <pre>@inproceedings{untrustide-ndss24, title = {{UntrustIDE: Exploiting Weaknesses in VS Code Extensions}}, author = {Lin, Elizabeth and Koishybayev, Igibek and Dunlap, Trevor and Enck, William and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}}, note = {Distinguished Paper Award}, month = feb, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-writ-tdsc24" class="anchor"> <strong>WRIT: Web Request Integrity and Attestation against Malicious Browser Extensions</strong><br> <em> Giorgos Vasiliadis, Apostolis Karampelas, Alexandros Shevtsov, Panagiotis Papadopoulos, Sotiris Ioannidis, Alexandros Kapravelos </em><br> IEEE Transactions on Dependable and Secure Computing, 2023 <br> <a href="/publications/writ-tdsc24.pdf">[PDF]</a> <a href="#bibtex-writ-tdsc24" id="btn-writ-tdsc24" onclick='showmodal("modal-writ-tdsc24")'>[Bibtex]</a> <div id="modal-writ-tdsc24" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-writ-tdsc24")'>×</span> <pre>@inproceedings{writ-tdsc24, title = {{WRIT: Web Request Integrity and Attestation against Malicious Browser Extensions}}, author = {Vasiliadis, Giorgos and Karampelas, Apostolis and Shevtsov, Alexandros and Papadopoulos, Panagiotis and Ioannidis, Sotiris and Kapravelos, Alexandros}, booktitle = {{IEEE Transactions on Dependable and Secure Computing}}, month = dec, pages = {1-14}, year = {2023} } </pre> </div> </div> </div> </li> <li><div id="bibtex-githubreactions-usenixsec23" class="anchor"> <strong>ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions</strong><br> <em> Siddharth Muralee, Igibek Koishybayev, Aleksandr Nahapetyan, Greg Tystahl, Brad Reaves, Antonio Bianchi, William Enck, Alexandros Kapravelos, Aravind Machiry </em><br> Proceedings of the USENIX Security Symposium, 2023 <br> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;"><strong>CSAW 2023 Applied Research Finalist</strong><br clear="all"> <a href="/publications/githubreactions-usenixsec23.pdf">[PDF]</a> <a href="#bibtex-githubreactions-usenixsec23" id="btn-githubreactions-usenixsec23" onclick='showmodal("modal-githubreactions-usenixsec23")'>[Bibtex]</a> <a href="/projects/argus/">[website]</a> <a href="https://github.com/purs3lab/ARGUS">[code]</a> <a href="https://github.blog/2023-08-09-four-tips-to-keep-your-github-actions-workflows-secure/">[news]</a> <div id="modal-githubreactions-usenixsec23" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-githubreactions-usenixsec23")'>×</span> <pre>@inproceedings{githubreactions-usenixsec23, title = {{ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions}}, author = {Muralee, Siddharth and Koishybayev, Igibek and Nahapetyan, Aleksandr and Tystahl, Greg and Reaves, Brad and Bianchi, Antonio and Enck, William and Kapravelos, Alexandros and Machiry, Aravind}, booktitle = {{Proceedings of the USENIX Security Symposium}}, month = aug, code = {{https://github.com/purs3lab/ARGUS}}, howpublished = {/projects/argus/}, pages = {6983--7000}, note = {{CSAW 2023 Applied Research Finalist}}, news = {{https://github.blog/2023-08-09-four-tips-to-keep-your-github-actions-workflows-secure/}}, tag = {githubreactions}, year = {2023} } </pre> </div> </div> </div> </li> <li><div id="bibtex-fptechniques-www23" class="anchor"> <strong>Automatic Discovery of Emerging Browser Fingerprinting Techniques</strong><br> <em> Junhua Su, Alexandros Kapravelos </em><br> Proceedings of The Web Conference (WWW), 2023 <br> <a href="/publications/fptechniques-www23.pdf">[PDF]</a> <a href="#bibtex-fptechniques-www23" id="btn-fptechniques-www23" onclick='showmodal("modal-fptechniques-www23")'>[Bibtex]</a> <a href="https://github.com/wspr-ncsu/BrowserFingerprintingAD">[code]</a> <div id="modal-fptechniques-www23" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-fptechniques-www23")'>×</span> <pre>@inproceedings{fptechniques-www23, title = {{Automatic Discovery of Emerging Browser Fingerprinting Techniques}}, author = {Su, Junhua and Kapravelos, Alexandros}, booktitle = {{Proceedings of The Web Conference (WWW)}}, month = apr, code = {{https://github.com/wspr-ncsu/BrowserFingerprintingAD}}, pages = {2178--2188}, tag = {vv8}, year = {2023} } </pre> </div> </div> </div> </li> <li><div id="bibtex-githubactions-usenixsec22" class="anchor"> <strong>Characterizing the Security of Github CI Workflows</strong><br> <em> Igibek Koishybayev, Aleksandr Nahapetyan, Raima Zachariah, Siddharth Muralee, Brad Reaves, Alexandros Kapravelos, Aravind Machiry </em><br> Proceedings of the USENIX Security Symposium, 2022 <br> <a href="/publications/githubactions-usenixsec22.pdf">[PDF]</a> <a href="#bibtex-githubactions-usenixsec22" id="btn-githubactions-usenixsec22" onclick='showmodal("modal-githubactions-usenixsec22")'>[Bibtex]</a> <a href="/projects/githubactions/">[website]</a> <a href="https://github.com/wspr-ncsu/github-actions-security-analysis">[code]</a> <div id="modal-githubactions-usenixsec22" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-githubactions-usenixsec22")'>×</span> <pre>@inproceedings{githubactions-usenixsec22, title = {{Characterizing the Security of Github CI Workflows}}, author = {Koishybayev, Igibek and Nahapetyan, Aleksandr and Zachariah, Raima and Muralee, Siddharth and Reaves, Brad and Kapravelos, Alexandros and Machiry, Aravind}, booktitle = {{Proceedings of the USENIX Security Symposium}}, month = aug, tag = {githubactions}, code = {{https://github.com/wspr-ncsu/github-actions-security-analysis}}, howpublished = {/projects/githubactions/}, pages = {2747--2763}, year = {2022} } </pre> </div> </div> </div> </li> <li><div id="bibtex-youarealiar-secweb22" class="anchor"> <strong>yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers</strong><br> <em> Dashmeet Kaur Ajmani, Igibek Koishybayev, Alexandros Kapravelos </em><br> Proceedings of the IEEE SecWeb Workshop, 2022 <br> <a href="/publications/youarealiar-secweb22.pdf">[PDF]</a> <a href="#bibtex-youarealiar-secweb22" id="btn-youarealiar-secweb22" onclick='showmodal("modal-youarealiar-secweb22")'>[Bibtex]</a> <div id="modal-youarealiar-secweb22" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-youarealiar-secweb22")'>×</span> <pre>@inproceedings{youarealiar-secweb22, title = {{yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers}}, author = {Ajmani, Dashmeet Kaur and Koishybayev, Igibek and Kapravelos, Alexandros}, booktitle = {{Proceedings of the IEEE SecWeb Workshop}}, pages = {51-58}, month = jun, year = {2022} } </pre> </div> </div> </div> </li> <li><div id="bibtex-workerounds-eurosp22" class="anchor"> <strong>SoK: Workerounds - Categorizing Service Worker Attacks and Mitigations</strong><br> <em> Karthika Subramani, Jordan Jueckstock, Alexandros Kapravelos, Roberto Perdisci </em><br> Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P), 2022 <br> <a href="/publications/workerounds-eurosp22.pdf">[PDF]</a> <a href="#bibtex-workerounds-eurosp22" id="btn-workerounds-eurosp22" onclick='showmodal("modal-workerounds-eurosp22")'>[Bibtex]</a> <div id="modal-workerounds-eurosp22" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-workerounds-eurosp22")'>×</span> <pre>@inproceedings{workerounds-eurosp22, title = {{SoK: Workerounds - Categorizing Service Worker Attacks and Mitigations}}, author = {Subramani, Karthika and Jueckstock, Jordan and Kapravelos, Alexandros and Perdisci, Roberto}, booktitle = {{Proceedings of the IEEE European Symposium on Security and Privacy (EuroS\&P)}}, month = jun, pages = {555-571}, year = {2022} } </pre> </div> </div> </div> </li> <li><div id="bibtex-ephemeralstorage-www22" class="anchor"> <strong>Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking</strong><br> <em> Jordan Jueckstock, Peter Snyder, Shaown Sarker, Alexandros Kapravelos, Ben Livshits </em><br> Proceedings of The Web Conference (WWW), 2022 <br> <a href="/publications/ephemeralstorage-www22.pdf">[PDF]</a> <a href="#bibtex-ephemeralstorage-www22" id="btn-ephemeralstorage-www22" onclick='showmodal("modal-ephemeralstorage-www22")'>[Bibtex]</a> <div id="modal-ephemeralstorage-www22" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-ephemeralstorage-www22")'>×</span> <pre>@inproceedings{ephemeralstorage-www22, title = {{Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking}}, author = {Jueckstock, Jordan and Snyder, Peter and Sarker, Shaown and Kapravelos, Alexandros and Livshits, Ben}, booktitle = {{Proceedings of The Web Conference (WWW)}}, month = apr, pages = {710–720}, year = {2022} } </pre> </div> </div> </div> </li> <li><div id="bibtex-browserprint-isc21" class="anchor"> <strong>Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy</strong><br> <em> Seyed Ali Akhavani, Jordan Jueckstock, Junhua Su, Alexandros Kapravelos, Engin Kirda, Long Lu </em><br> Proceedings of the Information Security Conference (ISC), 2021 <br> <a href="/publications/browserprint-isc21.pdf">[PDF]</a> <a href="#bibtex-browserprint-isc21" id="btn-browserprint-isc21" onclick='showmodal("modal-browserprint-isc21")'>[Bibtex]</a> <div id="modal-browserprint-isc21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-browserprint-isc21")'>×</span> <pre>@inproceedings{browserprint-isc21, title = {{Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy}}, author = {Akhavani, Seyed Ali and Jueckstock, Jordan and Su, Junhua and Kapravelos, Alexandros and Kirda, Engin and Lu, Long}, booktitle = {{Proceedings of the Information Security Conference (ISC)}}, pages = {161--176}, month = nov, tag = {vv8}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-css-fp-usenixsec21" class="anchor"> <strong>Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets</strong><br> <em> Pierre Laperdrix, Oleksii Starov, Quan Chen, Alexandros Kapravelos, Nick Nikiforakis </em><br> Proceedings of the USENIX Security Symposium, 2021 <br> <a href="/publications/css-fp-usenixsec21.pdf">[PDF]</a> <a href="#bibtex-css-fp-usenixsec21" id="btn-css-fp-usenixsec21" onclick='showmodal("modal-css-fp-usenixsec21")'>[Bibtex]</a> <a href="https://github.com/plaperdr/fingerprinting-in-style">[code]</a> <div id="modal-css-fp-usenixsec21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-css-fp-usenixsec21")'>×</span> <pre>@inproceedings{css-fp-usenixsec21, title = {{Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets}}, author = {Laperdrix, Pierre and Starov, Oleksii and Chen, Quan and Kapravelos, Alexandros and Nikiforakis, Nick}, booktitle = {{Proceedings of the USENIX Security Symposium}}, code = {https://github.com/plaperdr/fingerprinting-in-style}, month = aug, pages = {2507--2524}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-pg-sigs-sp20" class="anchor"> <strong>Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures</strong><br> <em> Quan Chen, Peter Snyder, Ben Livshits, Alexandros Kapravelos </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2021 <br> <a href="/publications/pg-sigs-sp20.pdf">[PDF]</a> <a href="#bibtex-pg-sigs-sp20" id="btn-pg-sigs-sp20" onclick='showmodal("modal-pg-sigs-sp20")'>[Bibtex]</a> <a href="https://github.com/semantic-signatures/semantic-signatures">[code]</a> <div id="modal-pg-sigs-sp20" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-pg-sigs-sp20")'>×</span> <pre>@inproceedings{pg-sigs-sp20, title = {{Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures}}, author = {Chen, Quan and Snyder, Peter and Livshits, Ben and Kapravelos, Alexandros}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, code = {{https://github.com/semantic-signatures/semantic-signatures}}, month = may, pages = {1715-1729}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-crawlphish-sp21" class="anchor"> <strong>CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing</strong><br> <em> Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, RC Johnson, Brad Wardman, Shaown Sarker, Alexandros Kapravelos, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupe, Gail-Joon Ahn </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2021 <br> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;"><strong>Best Student Paper Award</strong><br clear="all"> <a href="/publications/crawlphish-sp21.pdf">[PDF]</a> <a href="#bibtex-crawlphish-sp21" id="btn-crawlphish-sp21" onclick='showmodal("modal-crawlphish-sp21")'>[Bibtex]</a> <div id="modal-crawlphish-sp21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-crawlphish-sp21")'>×</span> <pre>@inproceedings{crawlphish-sp21, title = {{CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing}}, author = {Zhang, Penghui and Oest, Adam and Cho, Haehyun and Sun, Zhibo and Johnson, RC and Wardman, Brad and Sarker, Shaown and Kapravelos, Alexandros and Bao, Tiffany and Wang, Ruoyu and Shoshitaishvili, Yan and Doupe, Adam and Ahn, Gail-Joon}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, note = {Best Student Paper Award}, month = may, pages = {1109-1124}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-cookieparty-www21" class="anchor"> <strong>Cookie Swap Party: Abusing First-Party Cookies for Web Tracking</strong><br> <em> Quan Chen, Panagiotis Ilia, Michalis Polychronakis, Alexandros Kapravelos </em><br> Proceedings of The Web Conference (WWW), 2021 <br> <a href="/publications/cookieparty-www21.pdf">[PDF]</a> <a href="#bibtex-cookieparty-www21" id="btn-cookieparty-www21" onclick='showmodal("modal-cookieparty-www21")'>[Bibtex]</a> <div id="modal-cookieparty-www21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-cookieparty-www21")'>×</span> <pre>@inproceedings{cookieparty-www21, title = {{Cookie Swap Party: Abusing First-Party Cookies for Web Tracking}}, author = {Chen, Quan and Ilia, Panagiotis and Polychronakis, Michalis and Kapravelos, Alexandros}, booktitle = {{Proceedings of The Web Conference (WWW)}}, month = apr, pages = {2117–2129}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-vpc-www21" class="anchor"> <strong>Towards Realistic and Reproducible Web Crawl Measurements</strong><br> <em> Jordan Jueckstock, Shaown Sarker, Peter Snyder, Aidan Beggs, Panagiotis Papadopoulos, Matteo Varvello, Ben Livshits, Alexandros Kapravelos </em><br> Proceedings of The Web Conference (WWW), 2021 <br> <a href="/publications/vpc-www21.pdf">[PDF]</a> <a href="#bibtex-vpc-www21" id="btn-vpc-www21" onclick='showmodal("modal-vpc-www21")'>[Bibtex]</a> <a href="https://github.com/wspr-ncsu/reprocrawl-code-release">[code]</a> <div id="modal-vpc-www21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-vpc-www21")'>×</span> <pre>@inproceedings{vpc-www21, title = {{Towards Realistic and Reproducible Web Crawl Measurements}}, author = {Jueckstock, Jordan and Sarker, Shaown and Snyder, Peter and Beggs, Aidan and Papadopoulos, Panagiotis and Varvello, Matteo and Livshits, Ben and Kapravelos, Alexandros}, booktitle = {{Proceedings of The Web Conference (WWW)}}, code = {{https://github.com/wspr-ncsu/reprocrawl-code-release}}, pages = {80–91}, numpages = {13}, month = apr, tag = {vv8}, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-favocado-ndss21" class="anchor"> <strong>Favocado: Fuzzing Binding Code of JavaScript Engines Using Semantically Correct Test Cases</strong><br> <em> Sung Ta Dinh, Haehyun Cho, Kyle Martin, Adam Oest, Yihui Zeng, Alexandros Kapravelos, Tiffany Bao, Ruoyu "Fish" Wang, Yan Shoshitaishvili, Adam Doupe, Gail-Joon Ahn </em><br> Proceedings of the Network and Distributed System Security Symposium (NDSS), 2021 <br> <a href="/publications/favocado-ndss21.pdf">[PDF]</a> <a href="#bibtex-favocado-ndss21" id="btn-favocado-ndss21" onclick='showmodal("modal-favocado-ndss21")'>[Bibtex]</a> <div id="modal-favocado-ndss21" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-favocado-ndss21")'>×</span> <pre>@inproceedings{favocado-ndss21, title = {{Favocado: Fuzzing Binding Code of JavaScript Engines Using Semantically Correct Test Cases}}, author = {Dinh, Sung Ta and Cho, Haehyun and Martin, Kyle and Oest, Adam and Zeng, Yihui and Kapravelos, Alexandros and Bao, Tiffany and Wang, Ruoyu "Fish" and Shoshitaishvili, Yan and Doupe, Adam and Ahn, Gail-Joon}, booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}}, month = feb, year = {2021} } </pre> </div> </div> </div> </li> <li><div id="bibtex-extensiondeltas-CCS20" class="anchor"> <strong>You’ve Changed: Detecting Malicious Browser Extensions through their Update Deltas</strong><br> <em> Nikolaos Pantelaios, Nick Nikiforakis, Alexandros Kapravelos </em><br> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2020 <br> <a href="/publications/extensiondeltas-CCS20.pdf">[PDF]</a> <a href="#bibtex-extensiondeltas-CCS20" id="btn-extensiondeltas-CCS20" onclick='showmodal("modal-extensiondeltas-CCS20")'>[Bibtex]</a> <a href="https://github.com/wspr-ncsu/extensiondeltas">[code]</a> <div id="modal-extensiondeltas-CCS20" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-extensiondeltas-CCS20")'>×</span> <pre>@inproceedings{extensiondeltas-CCS20, title = {{You've Changed: Detecting Malicious Browser Extensions through their Update Deltas}}, author = {Pantelaios, Nikolaos and Nikiforakis, Nick and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, code = {https://github.com/wspr-ncsu/extensiondeltas}, month = nov, pages = {477–491}, year = {2020} } </pre> </div> </div> </div> </li> <li><div id="bibtex-jsobf-imc20" class="anchor"> <strong>Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage</strong><br> <em> Shaown Sarker, Jordan Jueckstock, Alexandros Kapravelos </em><br> Proceedings of the ACM Internet Measurement Conference (IMC), 2020 <br> <a href="/publications/jsobf-imc20.pdf">[PDF]</a> <a href="#bibtex-jsobf-imc20" id="btn-jsobf-imc20" onclick='showmodal("modal-jsobf-imc20")'>[Bibtex]</a> <div id="modal-jsobf-imc20" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-jsobf-imc20")'>×</span> <pre>@inproceedings{jsobf-imc20, title = {{Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage}}, author = {Sarker, Shaown and Jueckstock, Jordan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}}, pages = {648–661}, month = oct, tag = {vv8}, year = {2020} } </pre> </div> </div> </div> </li> <li><div id="bibtex-mininode-raid20" class="anchor"> <strong>Mininode: Reducing the Attack Surface of Node.js Applications</strong><br> <em> Igibek Koishybayev, Alexandros Kapravelos </em><br> Proceedings of the International Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2020 <br> <a href="/publications/mininode-raid20.pdf">[PDF]</a> <a href="#bibtex-mininode-raid20" id="btn-mininode-raid20" onclick='showmodal("modal-mininode-raid20")'>[Bibtex]</a> <a href="/projects/mininode/">[website]</a> <div id="modal-mininode-raid20" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-mininode-raid20")'>×</span> <pre>@inproceedings{mininode-raid20, title = {{Mininode: Reducing the Attack Surface of Node.js Applications}}, author = {Koishybayev, Igibek and Kapravelos, Alexandros}, booktitle = {{Proceedings of the International Symposium on Research in Attacks, Intrusions and Defenses (RAID)}}, month = oct, howpublished = {/projects/mininode/}, tag = {mininode}, pages = {121--134}, year = {2020} } </pre> </div> </div> </div> </li> <li><div id="bibtex-vv8-imc19" class="anchor"> <strong>VisibleV8: In-browser Monitoring of JavaScript in the Wild</strong><br> <em> Jordan Jueckstock, Alexandros Kapravelos </em><br> Proceedings of the ACM Internet Measurement Conference (IMC), 2019 <br> <a href="/publications/vv8-imc19.pdf">[PDF]</a> <a href="#bibtex-vv8-imc19" id="btn-vv8-imc19" onclick='showmodal("modal-vv8-imc19")'>[Bibtex]</a> <a href="/projects/vv8/">[website]</a> <a href="/presentations/vv8-imc19.pdf">[slides]</a> <a href="https://vimeo.com/showcase/6531379/video/369121825#t=3500s">[talk]</a> <a href="https://github.com/wspr-ncsu/visiblev8">[code]</a> <div id="modal-vv8-imc19" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-vv8-imc19")'>×</span> <pre>@inproceedings{vv8-imc19, title = {{VisibleV8: In-browser Monitoring of JavaScript in the Wild}}, author = {Jueckstock, Jordan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}}, pages = {393–405}, month = oct, howpublished = {/projects/vv8/}, code = {{https://github.com/wspr-ncsu/visiblev8}}, slides = {/presentations/vv8-imc19.pdf}, talk = {https://vimeo.com/showcase/6531379/video/369121825#t=3500s}, tag = {vv8}, year = {2019} } </pre> </div> </div> </div> </li> <li><div id="bibtex-cloakx-sec19" class="anchor"> <strong>Everyone is Different: Client-side Diversification for Defending Against Extension Fingerprinting</strong><br> <em> Erik Trickel, Oleksii Starov, Alexandros Kapravelos, Nick Nikiforakis, Adam Doupe </em><br> Proceedings of the USENIX Security Symposium, 2019 <br> <a href="/publications/cloakx-sec19.pdf">[PDF]</a> <a href="#bibtex-cloakx-sec19" id="btn-cloakx-sec19" onclick='showmodal("modal-cloakx-sec19")'>[Bibtex]</a> <a href="https://github.com/sefcom/cloakx">[code]</a> <div id="modal-cloakx-sec19" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-cloakx-sec19")'>×</span> <pre>@inproceedings{cloakx-sec19, title = {{Everyone is Different: Client-side Diversification for Defending Against Extension Fingerprinting}}, author = {Trickel, Erik and Starov, Oleksii and Kapravelos, Alexandros and Nikiforakis, Nick and Doupe, Adam}, booktitle = {{Proceedings of the USENIX Security Symposium}}, code = {https://github.com/sefcom/cloakx}, month = aug, pages = {1679--1696}, year = {2019} } </pre> </div> </div> </div> </li> <li><div id="bibtex-wildextensions-dimva19" class="anchor"> <strong>Wild Extensions: Discovering and Analyzing Unlisted Chrome Extensions</strong><br> <em> Aidan Beggs, Alexandros Kapravelos </em><br> Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), 2019 <br> <a href="/publications/wildextensions-dimva19.pdf">[PDF]</a> <a href="#bibtex-wildextensions-dimva19" id="btn-wildextensions-dimva19" onclick='showmodal("modal-wildextensions-dimva19")'>[Bibtex]</a> <div id="modal-wildextensions-dimva19" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-wildextensions-dimva19")'>×</span> <pre>@inproceedings{wildextensions-dimva19, title = {{Wild Extensions: Discovering and Analyzing Unlisted Chrome Extensions}}, author = {Beggs, Aidan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Conference on Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)}}, month = jun, pages = {3--22}, year = {2019} } </pre> </div> </div> </div> </li> <li><div id="bibtex-extbloat-www2019" class="anchor"> <strong>Unnecessarily Identifiable: Quantifying the fingerprintability of browser extensions due to bloat</strong><br> <em> Oleksii Starov, Pierre Laperdrix, Alexandros Kapravelos, Nick Nikiforakis </em><br> Proceedings of the World Wide Web Conference (WWW), 2019 <br> <a href="/publications/extbloat-www2019.pdf">[PDF]</a> <a href="#bibtex-extbloat-www2019" id="btn-extbloat-www2019" onclick='showmodal("modal-extbloat-www2019")'>[Bibtex]</a> <div id="modal-extbloat-www2019" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-extbloat-www2019")'>×</span> <pre>@inproceedings{extbloat-www2019, title = {{Unnecessarily Identifiable: Quantifying the fingerprintability of browser extensions due to bloat}}, author = {Starov, Oleksii and Laperdrix, Pierre and Kapravelos, Alexandros and Nikiforakis, Nick}, booktitle = {{Proceedings of the World Wide Web Conference (WWW)}}, month = may, pages = {3244–3250}, year = {2019} } </pre> </div> </div> </div> </li> <li><div id="bibtex-mystique-CCS18" class="anchor"> <strong>Mystique: Uncovering Information Leakage from Browser Extensions</strong><br> <em> Quan Chen, Alexandros Kapravelos </em><br> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2018 <br> <a href="/publications/mystique-CCS18.pdf">[PDF]</a> <a href="#bibtex-mystique-CCS18" id="btn-mystique-CCS18" onclick='showmodal("modal-mystique-CCS18")'>[Bibtex]</a> <a href="https://mystique.csc.ncsu.edu/">[website]</a> <a href="https://github.com/wspr-ncsu/mystique">[code]</a> <div id="modal-mystique-CCS18" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-mystique-CCS18")'>×</span> <pre>@inproceedings{mystique-CCS18, title = {Mystique: Uncovering Information Leakage from Browser Extensions}, author = {Chen, Quan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, howpublished = {https://mystique.csc.ncsu.edu/}, code = {https://github.com/wspr-ncsu/mystique}, pages = {1687–1700}, year = {2018} } </pre> </div> </div> </div> </li> <li><div id="bibtex-cloaking-SP16" class="anchor"> <strong>Cloak of Visibility: Detecting When Machines Browse A Different Web</strong><br> <em> Luca Invernizzi, Kurt Thomas, Alexandros Kapravelos, Oxana Comanescu, Jean-Michel Picod, Elie Bursztein </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2016 <br> <a href="/publications/cloaking-SP16.pdf">[PDF]</a> <a href="#bibtex-cloaking-SP16" id="btn-cloaking-SP16" onclick='showmodal("modal-cloaking-SP16")'>[Bibtex]</a> <div id="modal-cloaking-SP16" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-cloaking-SP16")'>×</span> <pre>@inproceedings{cloaking-SP16, title = {{Cloak of Visibility: Detecting When Machines Browse A Different Web}}, author = {Invernizzi, Luca and Thomas, Kurt and Kapravelos, Alexandros and Comanescu, Oxana and Picod, Jean-Michel and Bursztein, Elie}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, pages = {743-758}, year = {2016} } </pre> </div> </div> </div> </li> <li><div id="bibtex-adinjection-SP15" class="anchor"> <strong>Ad Injection at Scale: Assessing Deceptive Advertisement Modifications</strong><br> <em> Kurt Thomas, Elie Bursztein, Chris Grier, Grant Go, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, Moheeb Abu Rajab </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2015 <br> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;"><strong>Distinguished Practical Paper Award</strong><br clear="all"> <a href="/publications/adinjection-SP15.pdf">[PDF]</a> <a href="#bibtex-adinjection-SP15" id="btn-adinjection-SP15" onclick='showmodal("modal-adinjection-SP15")'>[Bibtex]</a> <div id="modal-adinjection-SP15" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-adinjection-SP15")'>×</span> <pre>@inproceedings{adinjection-SP15, title = {{Ad Injection at Scale: Assessing Deceptive Advertisement Modifications}}, author = {Thomas, Kurt and Bursztein, Elie and Grier, Chris and Go, Grant and Jagpal, Nav and Kapravelos, Alexandros and Mccoy, Damon and Nappa, Antonio and Paxson, Vern and Pearce, Paul and Provos, Niels and Abu Rajab, Moheeb}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, note = {Distinguished Practical Paper Award}, year = {2015} } </pre> </div> </div> </div> </li> <li><div id="bibtex-malvertisments-IMC14" class="anchor"> <strong>The Dark Alleys of Madison Avenue: Understanding Malicious Advertisements</strong><br> <em> Apostolis Zarras, Alexandros Kapravelos, Gianluca Stringhini, Thorsten Holz, Chris Kruegel, Giovanni Vigna </em><br> Proceedings of the Internet Measurement Conference (IMC), 2014 <br> <a href="/publications/malvertisments-IMC14.pdf">[PDF]</a> <a href="#bibtex-malvertisments-IMC14" id="btn-malvertisments-IMC14" onclick='showmodal("modal-malvertisments-IMC14")'>[Bibtex]</a> <div id="modal-malvertisments-IMC14" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-malvertisments-IMC14")'>×</span> <pre>@inproceedings{malvertisments-IMC14, title = {{The Dark Alleys of Madison Avenue: Understanding Malicious Advertisements}}, author = {Zarras, Apostolis and Kapravelos, Alexandros and Stringhini, Gianluca and Holz, Thorsten and Kruegel, Chris and Vigna, Giovanni}, booktitle = {{Proceedings of the Internet Measurement Conference (IMC)}}, year = {2014} } </pre> </div> </div> </div> </li> <li><div id="bibtex-hulk-UsenixSec14" class="anchor"> <strong>Hulk: Eliciting Malicious Behavior in Browser Extensions</strong><br> <em> Alexandros Kapravelos, Chris Grier, Neha Chachra, Chris Kruegel, Giovanni Vigna, Vern Paxson </em><br> Proceedings of the USENIX Security Symposium, 2014 <br> <a href="/publications/hulk-UsenixSec14.pdf">[PDF]</a> <a href="#bibtex-hulk-UsenixSec14" id="btn-hulk-UsenixSec14" onclick='showmodal("modal-hulk-UsenixSec14")'>[Bibtex]</a> <div id="modal-hulk-UsenixSec14" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-hulk-UsenixSec14")'>×</span> <pre>@inproceedings{hulk-UsenixSec14, title = {{Hulk: Eliciting Malicious Behavior in Browser Extensions}}, author = {Kapravelos, Alexandros and Grier, Chris and Chachra, Neha and Kruegel, Chris and Vigna, Giovanni and Paxson, Vern}, booktitle = {{Proceedings of the USENIX Security Symposium}}, year = {2014}, organization = {USENIX} } </pre> </div> </div> </div> </li> <li><div id="bibtex-pexy-DIMVA14" class="anchor"> <strong>PExy: The other side of Exploit Kits</strong><br> <em> Giancarlo De Maio, Alexandros Kapravelos, Yan Shoshitaishvili, Chris Kruegel, Giovanni Vigna </em><br> Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), 2014 <br> <a href="/publications/pexy-DIMVA14.pdf">[PDF]</a> <a href="#bibtex-pexy-DIMVA14" id="btn-pexy-DIMVA14" onclick='showmodal("modal-pexy-DIMVA14")'>[Bibtex]</a> <div id="modal-pexy-DIMVA14" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-pexy-DIMVA14")'>×</span> <pre>@inproceedings{pexy-DIMVA14, title = {{PExy: The other side of Exploit Kits}}, author = {De Maio, Giancarlo and Kapravelos, Alexandros and Shoshitaishvili, Yan and Kruegel, Chris and Vigna, Giovanni}, booktitle = {{Proceedings of the Conference on Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)}}, year = {2014} } </pre> </div> </div> </div> </li> <li><div id="bibtex-revolver-UsenixSec13" class="anchor"> <strong>Revolver: An Automated Approach to the Detection of Evasive Web-based Malware</strong><br> <em> Alexandros Kapravelos, Yan Shoshitaishvili, Marco Cova, Chris Kruegel, Giovanni Vigna </em><br> Proceedings of the USENIX Security Symposium, 2013 <br> <a href="/publications/revolver-UsenixSec13.pdf">[PDF]</a> <a href="#bibtex-revolver-UsenixSec13" id="btn-revolver-UsenixSec13" onclick='showmodal("modal-revolver-UsenixSec13")'>[Bibtex]</a> <div id="modal-revolver-UsenixSec13" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-revolver-UsenixSec13")'>×</span> <pre>@inproceedings{revolver-UsenixSec13, title = {{Revolver: An Automated Approach to the Detection of Evasive Web-based Malware}}, author = {Kapravelos, Alexandros and Shoshitaishvili, Yan and Cova, Marco and Kruegel, Chris and Vigna, Giovanni}, booktitle = {{Proceedings of the USENIX Security Symposium}}, year = {2013} } </pre> </div> </div> </div> </li> <li><div id="bibtex-cookiemonster-SP13" class="anchor"> <strong>Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting</strong><br> <em> Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Chris Kruegel, Frank Piessens, Giovanni Vigna </em><br> Proceedings of the IEEE Symposium on Security and Privacy, 2013 <br> <a href="/publications/cookiemonster-SP13.pdf">[PDF]</a> <a href="#bibtex-cookiemonster-SP13" id="btn-cookiemonster-SP13" onclick='showmodal("modal-cookiemonster-SP13")'>[Bibtex]</a> <div id="modal-cookiemonster-SP13" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-cookiemonster-SP13")'>×</span> <pre>@inproceedings{cookiemonster-SP13, title = {{Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting}}, author = {Nikiforakis, Nick and Kapravelos, Alexandros and Joosen, Wouter and Kruegel, Chris and Piessens, Frank and Vigna, Giovanni}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, year = {2013} } </pre> </div> </div> </div> </li> <li><div id="bibtex-jsinclusions-CCS12" class="anchor"> <strong>You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions</strong><br> <em> Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Chris Kruegel, Frank Piessens, Giovanni Vigna </em><br> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2012 <br> <a href="/publications/jsinclusions-CCS12.pdf">[PDF]</a> <a href="#bibtex-jsinclusions-CCS12" id="btn-jsinclusions-CCS12" onclick='showmodal("modal-jsinclusions-CCS12")'>[Bibtex]</a> <div id="modal-jsinclusions-CCS12" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-jsinclusions-CCS12")'>×</span> <pre>@inproceedings{jsinclusions-CCS12, title = {You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions}, author = {Nikiforakis, Nick and Invernizzi, Luca and Kapravelos, Alexandros and Van Acker, Steven and Joosen, Wouter and Kruegel, Chris and Piessens, Frank and Vigna, Giovanni}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, year = {2012} } </pre> </div> </div> </div> </li> <li><div id="bibtex-monkeyisland-DIMVA11" class="anchor"> <strong>Escape from Monkey Island: Evading High-Interaction Honeyclients</strong><br> <em> Alexandros Kapravelos, Marco Cova, Chris Kruegel, Giovanni Vigna </em><br> Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), 2011 <br> <a href="/publications/monkeyisland-DIMVA11.pdf">[PDF]</a> <a href="#bibtex-monkeyisland-DIMVA11" id="btn-monkeyisland-DIMVA11" onclick='showmodal("modal-monkeyisland-DIMVA11")'>[Bibtex]</a> <div id="modal-monkeyisland-DIMVA11" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-monkeyisland-DIMVA11")'>×</span> <pre>@inproceedings{monkeyisland-DIMVA11, title = {{Escape from Monkey Island: Evading High-Interaction Honeyclients}}, author = {Kapravelos, Alexandros and Cova, Marco and Kruegel, Chris and Vigna, Giovanni}, booktitle = {{Proceedings of the Conference on Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)}}, year = {2011} } </pre> </div> </div> </div> </li> <li><div id="bibtex-dial-esorics10" class="anchor"> <strong>D(e|i)aling with VoIP: Robust Prevention of Dial Attacks</strong><br> <em> Alexandros Kapravelos, Jason Polakis, Elias Athanasopoulos, Sotiris Ioannidis, Evangelos P. Markatos </em><br> Proceedings of the European Symposium on Research in Computer Security (ESORICS), 2010 <br> <a href="/publications/dial-esorics10.pdf">[PDF]</a> <a href="#bibtex-dial-esorics10" id="btn-dial-esorics10" onclick='showmodal("modal-dial-esorics10")'>[Bibtex]</a> <div id="modal-dial-esorics10" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-dial-esorics10")'>×</span> <pre>@inproceedings{dial-esorics10, title = {{D(e$\mid$i)aling with VoIP: Robust Prevention of Dial Attacks}}, author = {Kapravelos, Alexandros and Polakis, Jason and Athanasopoulos, Elias and Ioannidis, Sotiris and Markatos, Evangelos P.}, booktitle = {{Proceedings of the European Symposium on Research in Computer Security (ESORICS)}}, year = {2010} } </pre> </div> </div> </div> </li> <li><div id="bibtex-packetloss-TMA09" class="anchor"> <strong>Realistic Passive Packet Loss Measurement for High-Speed Networks</strong><br> <em> Ales Friedl, Sven Ubik, Alexandros Kapravelos, Michalis Polychronakis, Evangelos P. Markatos </em><br> Proceedings of the International Workshop on Traffic Monitoring and Analysis (TMA), 2009 <br> <a href="/publications/packetloss-TMA09.pdf">[PDF]</a> <a href="#bibtex-packetloss-TMA09" id="btn-packetloss-TMA09" onclick='showmodal("modal-packetloss-TMA09")'>[Bibtex]</a> <div id="modal-packetloss-TMA09" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-packetloss-TMA09")'>×</span> <pre>@inproceedings{packetloss-TMA09, title = {{Realistic Passive Packet Loss Measurement for High-Speed Networks}}, author = {Friedl, Ales and Ubik, Sven and Kapravelos, Alexandros and Polychronakis, Michalis and Markatos, Evangelos P.}, booktitle = {{Proceedings of the International Workshop on Traffic Monitoring and Analysis (TMA)}}, year = {2009} } </pre> </div> </div> </div> </li> <li><div id="bibtex-flexconf" class="anchor"> <strong>FleXConf: A Flexible Conference Assistant Using Context-Aware Notification Services</strong><br> <em> Nikos Armenatzoglou, Yannis Marketakis, Lito Kriara, Elias Apostolopoulos, Vicky Papavasiliou, Dimitris Kampas, Alexandros Kapravelos, Eythimis Kartsonakis, Giorgos Linardakis, Sofia Nikitaki, Antonis Bikakis, Grigoris Antoniou </em><br> Proceedings of the IEEE Workshop on Context Aware Mobile Systems (CAMS), 2009 <br> <a href="/publications/flexconf.pdf">[PDF]</a> <a href="#bibtex-flexconf" id="btn-flexconf" onclick='showmodal("modal-flexconf")'>[Bibtex]</a> <div id="modal-flexconf" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-flexconf")'>×</span> <pre>@inproceedings{flexconf, author = {Armenatzoglou, Nikos and Marketakis, Yannis and Kriara, Lito and Apostolopoulos, Elias and Papavasiliou, Vicky and Kampas, Dimitris and Kapravelos, Alexandros and Kartsonakis, Eythimis and Linardakis, Giorgos and Nikitaki, Sofia and Bikakis, Antonis and Antoniou, Grigoris}, title = {FleXConf: A Flexible Conference Assistant Using Context-Aware Notification Services}, booktitle = {Proceedings of the IEEE Workshop on Context Aware Mobile Systems (CAMS)}, year = {2009} } </pre> </div> </div> </div> </li> <li><div id="bibtex-lossestimation-coregrid06" class="anchor"> <strong>Passive end-to-end packet loss estimation for grid traffic monitoring</strong><br> <em> Antonis Papadogiannakis, Alexandros Kapravelos, Michalis Polychronakis, Evangelos P. Markatos, Augusto Ciuffoletti </em><br> Proceedings of the CoreGRID Integration Workshop, 2006 <br> <a href="/publications/lossestimation-coregrid06.pdf">[PDF]</a> <a href="#bibtex-lossestimation-coregrid06" id="btn-lossestimation-coregrid06" onclick='showmodal("modal-lossestimation-coregrid06")'>[Bibtex]</a> <div id="modal-lossestimation-coregrid06" class="modal"> <div class="modal-content"> <span class="close" onclick='closemodal("modal-lossestimation-coregrid06")'>×</span> <pre>@inproceedings{lossestimation-coregrid06, title = {{Passive end-to-end packet loss estimation for grid traffic monitoring}}, author = {Papadogiannakis, Antonis and Kapravelos, Alexandros and Polychronakis, Michalis and Markatos, Evangelos P. and Ciuffoletti, Augusto}, booktitle = {{Proceedings of the CoreGRID Integration Workshop}}, year = {2006} } </pre> </div> </div> </div> </li></ol> --> <ol class="bibliography" reversed="reversed"><li><div id="bibtex-vv8webview-ndss26" class="anchor"> <strong>Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews</strong><br /> <em> Sohom Datta, Michalis Diamantaris, Ahsan Zafar, Junhua Su, Anupam Das, Jason Polakis, Alexandros Kapravelos </em><br /> Proceedings of the Network and Distributed System Security Symposium (NDSS), 2026 <br /> <a href="/publications/vv8webview-ndss26.pdf">[PDF]</a> <a href="#bibtex-vv8webview-ndss26" id="btn-vv8webview-ndss26" onclick="showmodal(&quot;modal-vv8webview-ndss26&quot;)">[Bibtex]</a> <a href="https://github.com/wspr-ncsu/webviewtracer">[code]</a> <div id="modal-vv8webview-ndss26" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-vv8webview-ndss26&quot;)">×</span> <pre>@inproceedings{vv8webview-ndss26, title = {{Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews}}, author = {Datta, Sohom and Diamantaris, Michalis and Zafar, Ahsan and Su, Junhua and Das, Anupam and Polakis, Jason and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}}, month = feb, code = {{https://github.com/wspr-ncsu/webviewtracer}}, tag = {vv8}, year = {2026} } </pre> </div> </div> </div> </li> <li><div id="bibtex-vv8diverge-ccs25" class="anchor"> <strong>Same Script, Different Behavior: Characterizing Platform-Specific Divergent JavaScript Execution</strong><br /> <em> Ahsan Zafar, Junhua Su, Sohom Datta, Alexandros Kapravelos, Anupam Das </em><br /> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2025 <br /> <a href="/publications/vv8diverge-ccs25.pdf">[PDF]</a> <a href="#bibtex-vv8diverge-ccs25" id="btn-vv8diverge-ccs25" onclick="showmodal(&quot;modal-vv8diverge-ccs25&quot;)">[Bibtex]</a> <div id="modal-vv8diverge-ccs25" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-vv8diverge-ccs25&quot;)">×</span> <pre>@inproceedings{vv8diverge-ccs25, title = {{Same Script, Different Behavior: Characterizing Platform-Specific Divergent JavaScript Execution}}, author = {Zafar, Ahsan and Su, Junhua and Datta, Sohom and Kapravelos, Alexandros and Das, Anupam}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, month = oct, tag = {vv8}, year = {2025} } </pre> </div> </div> </div> </li> <li><div id="bibtex-fv8-sec24" class="anchor"> <strong>FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques</strong><br /> <em> Nikolaos Pantelaios, Alexandros Kapravelos </em><br /> Proceedings of the USENIX Security Symposium, 2024 <br /> <a href="/publications/fv8-sec24.pdf">[PDF]</a> <a href="#bibtex-fv8-sec24" id="btn-fv8-sec24" onclick="showmodal(&quot;modal-fv8-sec24&quot;)">[Bibtex]</a> <a href="https://github.com/wspr-ncsu/FV8">[code]</a> <div id="modal-fv8-sec24" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-fv8-sec24&quot;)">×</span> <pre>@inproceedings{fv8-sec24, title = {{FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques}}, author = {Pantelaios, Nikolaos and Kapravelos, Alexandros}, booktitle = {{Proceedings of the USENIX Security Symposium}}, code = {{https://github.com/wspr-ncsu/FV8}}, month = aug, tag = {vv8}, year = {2024} } </pre> </div> </div> </div> </li> <li><div id="bibtex-fptechniques-www23" class="anchor"> <strong>Automatic Discovery of Emerging Browser Fingerprinting Techniques</strong><br /> <em> Junhua Su, Alexandros Kapravelos </em><br /> Proceedings of The Web Conference (WWW), 2023 <br /> <a href="/publications/fptechniques-www23.pdf">[PDF]</a> <a href="#bibtex-fptechniques-www23" id="btn-fptechniques-www23" onclick="showmodal(&quot;modal-fptechniques-www23&quot;)">[Bibtex]</a> <a href="https://github.com/wspr-ncsu/BrowserFingerprintingAD">[code]</a> <div id="modal-fptechniques-www23" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-fptechniques-www23&quot;)">×</span> <pre>@inproceedings{fptechniques-www23, title = {{Automatic Discovery of Emerging Browser Fingerprinting Techniques}}, author = {Su, Junhua and Kapravelos, Alexandros}, booktitle = {{Proceedings of The Web Conference (WWW)}}, month = apr, code = {{https://github.com/wspr-ncsu/BrowserFingerprintingAD}}, pages = {2178--2188}, tag = {vv8}, year = {2023} } </pre> </div> </div> </div> </li> <li><div id="bibtex-jsobf-imc20" class="anchor"> <strong>Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage</strong><br /> <em> Shaown Sarker, Jordan Jueckstock, Alexandros Kapravelos </em><br /> Proceedings of the ACM Internet Measurement Conference (IMC), 2020 <br /> <a href="/publications/jsobf-imc20.pdf">[PDF]</a> <a href="#bibtex-jsobf-imc20" id="btn-jsobf-imc20" onclick="showmodal(&quot;modal-jsobf-imc20&quot;)">[Bibtex]</a> <div id="modal-jsobf-imc20" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-jsobf-imc20&quot;)">×</span> <pre>@inproceedings{jsobf-imc20, title = {{Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage}}, author = {Sarker, Shaown and Jueckstock, Jordan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}}, pages = {648–661}, month = oct, tag = {vv8}, year = {2020} } </pre> </div> </div> </div> </li> <li><div id="bibtex-vv8-imc19" class="anchor"> <strong>VisibleV8: In-browser Monitoring of JavaScript in the Wild</strong><br /> <em> Jordan Jueckstock, Alexandros Kapravelos </em><br /> Proceedings of the ACM Internet Measurement Conference (IMC), 2019 <br /> <a href="/publications/vv8-imc19.pdf">[PDF]</a> <a href="#bibtex-vv8-imc19" id="btn-vv8-imc19" onclick="showmodal(&quot;modal-vv8-imc19&quot;)">[Bibtex]</a> <a href="/projects/vv8/">[website]</a> <a href="/presentations/vv8-imc19.pdf">[slides]</a> <a href="https://vimeo.com/showcase/6531379/video/369121825#t=3500s">[talk]</a> <a href="https://github.com/wspr-ncsu/visiblev8">[code]</a> <div id="modal-vv8-imc19" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-vv8-imc19&quot;)">×</span> <pre>@inproceedings{vv8-imc19, title = {{VisibleV8: In-browser Monitoring of JavaScript in the Wild}}, author = {Jueckstock, Jordan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}}, pages = {393–405}, month = oct, howpublished = {/projects/vv8/}, code = {{https://github.com/wspr-ncsu/visiblev8}}, slides = {/presentations/vv8-imc19.pdf}, talk = {https://vimeo.com/showcase/6531379/video/369121825#t=3500s}, tag = {vv8}, year = {2019} } </pre> </div> </div> </div> </li></ol> 2024-03-01T00:00:00+00:00 https://kapravelos.com/research/2024/03/01/ndss24-bestpaper <p>Our paper <em>UntrustIDE: Exploiting Weaknesses in VS Code Extensions</em> has received the Distinguished Paper Award at the Network and Distributed System Security Symposium (NDSS), 2024! This was Elizabeth’s first paper and she did a fantastic job!</p> <ol class="bibliography" reversed="reversed"><li><div id="bibtex-untrustide-ndss24" class="anchor"> <strong>UntrustIDE: Exploiting Weaknesses in VS Code Extensions</strong><br /> <em> Elizabeth Lin, Igibek Koishybayev, Trevor Dunlap, William Enck, Alexandros Kapravelos </em><br /> Proceedings of the Network and Distributed System Security Symposium (NDSS), 2024 <br /> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;" /><strong>Distinguished Paper Award</strong><br clear="all" /> <a href="/publications/untrustide-ndss24.pdf">[PDF]</a> <a href="#bibtex-untrustide-ndss24" id="btn-untrustide-ndss24" onclick="showmodal(&quot;modal-untrustide-ndss24&quot;)">[Bibtex]</a> <div id="modal-untrustide-ndss24" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-untrustide-ndss24&quot;)">×</span> <pre>@inproceedings{untrustide-ndss24, title = {{UntrustIDE: Exploiting Weaknesses in VS Code Extensions}}, author = {Lin, Elizabeth and Koishybayev, Igibek and Dunlap, Trevor and Enck, William and Kapravelos, Alexandros}, booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}}, note = {Distinguished Paper Award}, month = feb, year = {2024} } </pre> </div> </div> </div> </li></ol> 2022-08-24T00:00:00+00:00 https://kapravelos.com/research/2022/08/24/s3c2 <p>Our Frontier proposal on software supply chain security has been funded by NSF!<br /> Here are the details:</p> <hr /> <h3 id="collaborative-proposal-satc-frontiers-enabling-a-secure-and-trustworthy-software-supply-chain">Collaborative Proposal: SaTC: Frontiers: Enabling a Secure and Trustworthy Software Supply Chain</h3> <p>The modern world relies on software in almost every human endeavor, and a typical software product includes 80% open source components. Attackers exploit accidentally-injected security vulnerabilities and, increasingly, aggressively implant vulnerabilities or malicious code directly into the software supply chain – open source software and its build and deployment pipelines. This Frontier project establishes the Secure Software Supply Chain Center (S3C2), a large-scale, multi-institution effort established to aid the software industry re-establish trust in the software supply chain through the development of scientific principles, synergistic tools, metrics, and models in the context of human behavior among software supply chain stakeholders. The Center contributes to a diverse workforce of professionals educated and trained in secure software supply chain methods, among others, through undergraduate research projects, summer camps, and the development of course modules for students and practitioners. S3C2’s vision is to facilitate rapid innovation with increased confidence in software supply chain security.</p> <p>S3C2 focuses on interconnected research thrusts for two supply chain attack vectors. Thrust One focuses on developing tools and techniques to aid practitioners with the risk of upstream dependencies. It enhances the utility of the Software Bill of Materials (SBoM) by identifying exploitability of vulnerabilities and changes to attack surfaces and isolates risky code as a stop-gap before patching is possible. Thrust Two focuses on developing tools and techniques to aid practitioners with the risk of build processes. It enables strong guarantees for build integrity through analysis of a continuous integration/continuous deployment (CI/CD) configuration and techniques that help developers achieve reproducible builds.</p> 2021-05-24T00:00:00+00:00 https://kapravelos.com/research/2021/05/24/sp21-bestpaper <p>Our paper <em>CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing</em>, a collaboration between Arizona State University, Paypal, Samsung Research and North Carolina State University has received the Best Student Paper Award at IEEE Symposium on Security and Privacy 2021!</p> <ol class="bibliography" reversed="reversed"><li><div id="bibtex-crawlphish-sp21" class="anchor"> <strong>CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing</strong><br /> <em> Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, RC Johnson, Brad Wardman, Shaown Sarker, Alexandros Kapravelos, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupe, Gail-Joon Ahn </em><br /> Proceedings of the IEEE Symposium on Security and Privacy, 2021 <br /> <img src="/public/prize.png" style="float:left;vertical-align: bottom; height:24px; width: 24px; display: block; margin-bottom: -1px;" /><strong>Best Student Paper Award</strong><br clear="all" /> <a href="/publications/crawlphish-sp21.pdf">[PDF]</a> <a href="#bibtex-crawlphish-sp21" id="btn-crawlphish-sp21" onclick="showmodal(&quot;modal-crawlphish-sp21&quot;)">[Bibtex]</a> <div id="modal-crawlphish-sp21" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-crawlphish-sp21&quot;)">×</span> <pre>@inproceedings{crawlphish-sp21, title = {{CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing}}, author = {Zhang, Penghui and Oest, Adam and Cho, Haehyun and Sun, Zhibo and Johnson, RC and Wardman, Brad and Sarker, Shaown and Kapravelos, Alexandros and Bao, Tiffany and Wang, Ruoyu and Shoshitaishvili, Yan and Doupe, Adam and Ahn, Gail-Joon}, booktitle = {{Proceedings of the IEEE Symposium on Security and Privacy}}, note = {Best Student Paper Award}, month = may, pages = {1109-1124}, year = {2021} } </pre> </div> </div> </div> </li></ol> 2020-04-17T00:00:00+00:00 https://kapravelos.com/ctf/2020/04/17/hackpack-CTF <p>We are organizing an educational Capture The Flag competition as part of my two courses this semester. The CTF will start on April 17th at 1pm EDT and finish on April 27th at 23:59 EDT. We got more than 500 teams registered to play! Join us!</p> <p>More details here: <a href="https://hackpack.club/ctf2020/">https://hackpack.club/ctf2020/</a><br /> NCSU CSC news article: <a href="https://www.csc.ncsu.edu/news/2323">https://www.csc.ncsu.edu/news/2323</a></p> 2019-02-01T00:00:00+00:00 https://kapravelos.com/papers/2019/02/01/www19 <p>Our paper about fingerprintable browser extensions was accepted at the <a href="https://www2019.thewebconf.org/accepted-papers">WEB Conference (WWW) 2019</a>.</p> <ol class="bibliography" reversed="reversed"></ol> 2018-07-30T00:00:00+00:00 https://kapravelos.com/papers/2018/07/30/mystique-ccs <p>Quan Chen’s paper got accepted at CCS’18! Stay tuned for a new browser extension analysis system specifically crafted to detect privacy leaks.</p> <ol class="bibliography" reversed="reversed"><li><div id="bibtex-mystique-CCS18" class="anchor"> <strong>Mystique: Uncovering Information Leakage from Browser Extensions</strong><br /> <em> Quan Chen, Alexandros Kapravelos </em><br /> Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2018 <br /> <a href="/publications/mystique-CCS18.pdf">[PDF]</a> <a href="#bibtex-mystique-CCS18" id="btn-mystique-CCS18" onclick="showmodal(&quot;modal-mystique-CCS18&quot;)">[Bibtex]</a> <a href="https://mystique.csc.ncsu.edu/">[website]</a> <a href="https://github.com/wspr-ncsu/mystique">[code]</a> <div id="modal-mystique-CCS18" class="modal"> <div class="modal-content"> <span class="close" onclick="closemodal(&quot;modal-mystique-CCS18&quot;)">×</span> <pre>@inproceedings{mystique-CCS18, title = {Mystique: Uncovering Information Leakage from Browser Extensions}, author = {Chen, Quan and Kapravelos, Alexandros}, booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}}, howpublished = {https://mystique.csc.ncsu.edu/}, code = {https://github.com/wspr-ncsu/mystique}, pages = {1687–1700}, year = {2018} } </pre> </div> </div> </div> </li></ol> 2018-05-01T00:00:00+00:00 https://kapravelos.com/students/2018/05/01/phd-students <p>Kyle Martin and Nikos Pantelaios will start their PhD at NCSU in Fall’18. Really excited to work with them and that our group is expanding!</p> 2018-04-20T00:00:00+00:00 https://kapravelos.com/ctf/2018/04/20/hackpack-CTF <p>As part of CSC-405, we are organizing a Capture the Flag competition on Friday 4/20 from 1pm - 7pm.</p> 2018-01-25T00:00:00+00:00 https://kapravelos.com/defcon/2018/01/25/oooverflow <p>I’m very excited to announce that we formed a team, called the Order of the Overflow, to organize DEF CON CTF in the years to come! The team is a mix of industry and academic people with lots of experience in organizing and participating in CTFs. You can read more about our team and philosophy <a href="https://www.defcon.org/html/defcon-26/dc-26-ctf.html#dc26ctforg">here</a>.</p> <p>Follow us on <a href="https://twitter.com/oooverflow">twitter</a> and check out the latest DEF CON CTF info on our <a href="https://twitter.com/oooverflow">page</a>.</p>