David Evans Associate Professor of Computer Science University of Virginia evans@virginia.edu Contact Information

research Students Research Group Blog: Jefferson's Wheel Security Reading Group Publications, Talks, Advice courses cs150: Computer Science from Ada and Euclid ... cs205: Engineering Software cs302: Theory of Computation JILL: Cryptography in World War II cs588: Cryptology More Courses pictures Grand Canyon, Bletchley Park, China, More... I am a little troubled about the tea service in the electronic computer building. Apparently the members of your staff consume several times as much supplies as the same number of people do in Fuld Hall and they have been especially unfair in the matter of sugar.... I should like to raise the question whether it would not be better for the computer people to come up to Fuld Hall at the end of the day at 5 o'clock and have their tea here under proper supervision. Letter to John von Neumann (shown in George Dyson's talk on The birth of the computer) Past homepage quotes

I joined UVA's Computer Science Department as an assistant professor in November 1999 after completing my PhD, SM and SB degrees at MIT. My current research seeks to enable the cost-effective production of complex computer systems that can be trusted for critical applications even in the presence of malicious attackers. This goal involves many traditional research areas, including security, software engineering, programming languages, cryptography, and networking.

I am on sabbatical for the 2008-2009 academic year. I'll be visiting UC Berkeley for the Fall semester, and Microsoft Research (Redmond) for the Spring. In Spring 2008, I taught cs302: Theory of Computation. In Fall 2007, I taught a seminar on web application security. In Spring 2007, I taught cs150: Computer Science from Ada and Euclid to Quantum Computing and the World Wide Web, an introductory Computer Science course. I am the Founding Director of the Interdisciplinary Major in Computer Science (BA) for students in the College of Arts and Sciences that was approved in February 2006.

Research

Students Blog Publications Talks Press

I have the privilege of working with a team of extraordinary students, including both graduate and undergraduate students. If you are a UVa undergraduate or graduate student interested in joining my research group, please look over our project pages (below), browse our group blog, and send me email to arrange a meeting or drop by my office hours. If you are considering applying to our PhD program, please read my advice for prospective research students. If you think you are ready for graduate school, you may also want to try our previous pre-qualification exam [PDF]. Active Projects Automatic Identification and Protection of Security-Critical Data with Westley Weimer (NSF CyberTrust) Protects vulnerable programs by storing security-critical data in a separate store that is protected by page-level hardware mechanisms, except during short update periods. Disk-Level Malware with Nate Paul, Adrienne Felt, and Sudhanva Gurumurthi (NSF CyberTrust) Uses the disk processor to improve virus detection and response by recognizing viruses by their disk-level activity. Helix with Jack Davidson, Yan Huang, John Knight, Anh Nguyen-Tuong, Jeff Shirley, Westley Weimer and colleagues at UC Davis, UCSB, New Mexico (MURI) The Helix self-regenerative architecture is designed to protect systems from sophisticated and motivated adversaries by automatically and continuously changing the attack surface of a running system. Implementable Privacy for RFID with Karsten Nohl RFID tags have already been widely deployed in security-sensitive applications including public transportation tokens and access cards. These applications raise important security and privacy concerns, but current design methods are ad hoc and have proven insufficient. We are investigating new approaches to cryptography, protocol, and system design to provide adequate security on minimal devices. Mashup Security with Adrienne Felt, Pieter Hooimeijer, and Westley Weimer Mashups combine scripts from multiple sources and deliver them to clients as a single page. We are investigating mechanisms that allow clients to enforce meaningful security policies on untrusted content in mashup web pages. N-Variant Systems with Ben Cox, Jack Davidson, John Knight, and Anh Nguyen-Tuong (NSF CyberTrust) Explores a systems framework that uses structured artificial diversity to provide high security assurances against large classes of attacks. Q: How realistic is the depiction of SIS in the James Bond films? James Bond, as Ian Fleming originally conceived him was based on reality. But any author needs to inject a level of glamour and excitement beyond reality in order to sell. By the time the filmmakers focused on Bond the gap between truth and fiction had already widened. Nevertheless, staff who join SIS can look forward to a career that will have moments when the gap narrows just a little and the certainty of a stimulating and rewarding career which, like Bond's, will be in the service of their country. Q: Why can't I download or write to you via this site? SIS has kept this site browse only for security reasons. From the FAQ of the Secret Intelligence Service Perracotta with Jinlin Yang (NSF CPA) Develops techniques for automatically inferring temporal properties of real world software using dynamic analysis. Privacy Protection for Social Network APIs with Adrienne Felt Social networking platforms integrate third-party content into the site and give third-party developers access to user data. These open interfaces pose serious privacy risks by exposing user data to third-party developers. We are developing a privacy-by-proxy design for a privacy-preserving API. Recent Projects Genesis with Jack Davidson, John Knight, and Anh Nguyen-Tuong (DARPA) Explores the potential for using automatically generated diversity at various levels of abstraction to protect computer systems. Inexpensive Program Analysis (NASA, NSF CAREER) Reducing the cost and improves the scalability of program analysis using lightweight static analysis (Splint). Physicrypt (NSF ITR) How computing in the physical world impacts security. Programming the Swarm (NSF CAREER) Getting sensible behavior from collections of unreliable, unorganized components. Recent and Upcoming Conferences All it took was for a University of Virginia student to finally outsmart the popular SMART cards... Falling into the wrong hands, this security loophole can be and will surely be used in high profile heists and break-ins, seemingly straight from a James Bond movie. Hacked RFIDs Render Smart Cards Less Smarter, TrendLabs Malware Blog, 18 March 2008. 30th IEEE Symposium on Security and Privacy (Oakland 2009), Program Committee Co-Chair 2008 USENIX/ACCURATE Electronic Voting Technology Workshop (EVT 2008), Program Committee Member 28th International Conference on Distributed Computing Systems (ICDCS 2008) (Security and Privacy Track), Program Committee Member IEEE Symposium on Security and Privacy (Oakland 2008), Program Committee Member Ninth International Conference on Information and Communications Security (ICICS 2007), Program Committee Member 14th ACM Conference on Computer and Communications Security (CCS 2007), Publications Chair Eighth International Conference on Information and Communications Security (ICICS 2006), Program Committee Member and Keynotes Chair International Conference on Software Engineering (ICSE 2006), Program Committee Member Verified Software: Theories, Tools, Experiments (10-14 October 2005), Program Committee Member ACM Workshop on Program Analysis for Software Tools and Engineering (PASTE) (Sept 2005), Program Committee Member Network and Distributed System Security Symposium (NDSS 2005), Program Committee Member 2nd International Workshop on Dynamic Analysis (WODA) (May 2004), General and PC co-chair

Teaching

UVa Courses

Other Courses

---

David Evans University of Virginia Department of Computer Science

David Evans evans@cs.virginia.edu