The UMBC Cyber Defense Lab presents

Transparent Dishonesty: Front-Running Attacks on Blockchain

Professor Jeremy Clark
Concordia Institute for Information Systems Engineering
Concordia University, Montreal, Canada

12–1 pm ET Friday, March 26, 2021
online via WebEx

We consider front-running to be a course of action where an entity benefits from prior access to privileged market information about upcoming transactions and trades. Front-running has been an issue in financial instrument markets since the 1970s. With the advent of blockchain technology, front-running has resurfaced in new forms we explore here, instigated by blockchain’s decentralized and transparent nature. I will discuss our “systemization of knowledge” paper which draws from a scattered body of knowledge and instances of front-running across the top 25 most active decentral applications (DApps) deployed on Ethereum blockchain. Additionally, we carry out a detailed analysis of Status.im initial coin offering (ICO) and show evidence of abnormal miner’s behavior indicative of front-running token purchases. Finally, we map the proposed solutions to front-running into useful categories.

Jeremy Clark is an associate professor at the Concordia Institute for Information Systems Engineering. At Concordia, he holds the NSERC/Raymond Chabot Grant Thornton/Catallaxy Industrial Research Chair in Blockchain Technologies. He earned his Ph.D. from the University of Waterloo, where his gold medal dissertation was on designing and deploying secure voting systems including Scantegrity—the first cryptographically verifiable system used in a public sector election. He wrote one of the earliest academic papers on Bitcoin, completed several research projects in the area, and contributed to the first textbook. Beyond research, he has worked with several municipalities on voting technology and testified to both the Canadian Senate and House finance committees on Bitcoin. email:

Host: Alan T. Sherman, . Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays. All meetings are open to the public. Upcoming CDL Meetings: April 9, (UMBC), MeetingMayhem: A network adversarial thinking game; April 23, Peter Peterson (University of Minnesota Duluth), Adversarial thinking;
May 7, Farid Javani (UMBC), Anonymization by oblivious transfer.

(Don’t) Mind the Gap: Bridging the Worlds of People and IoT Devices

Dr. Roberto Yus
University of California, Irvine

1:00-2:00 pm ET, Tuesday, 23 March 2021
online via WebEx

The Internet of Things (IoT) has the potential to improve our lives through different services given the diversity of smart devices and their capabilities. For example, the IoT can empower services to make the re-opening of business during the current pandemic safer by monitoring adherence to regulations. But the large amounts of highly heterogeneous data captured by IoT devices typically require further processing to become useful information. The challenge is thus for IoT systems to determine which sensor data has to be captured/stored/processed/shared to, for instance, determine the occupancy of a specific office building or the spaces in which a potential exposure took place. This becomes even more challenging when IoT systems have to take into account the privacy preferences of individuals, such as the need to prevent sharing data about their daily patterns or habits.

In this talk, I will discuss my efforts into helping IoT systems bridge the gap between the world of IoT devices and the world where people act. First, I will introduce a model to represent knowledge about sensors/actuators, people, spaces, events, and their relationships. Based on the model, I will explain an algorithmic solution to translate user requests and privacy preferences defined in a high-level, more semantically meaningful way into operations on IoT devices and their captured data. Second, I will talk about the enforcement of privacy preferences in the context of the IoT. Finally, I will overview my experience building and deploying an IoT data management system, TIPPERS, which has been deployed at UC Irvine and two US Navy vessels and is soon to be deployed on other campuses. I will conclude the talk by discussing the exciting future work opportunities towards supporting the next generation of ubiquitous IoT data management systems and technologies that autonomously, transparently, and at scale, balance the trade-off between providing users with high utility and respecting people’s privacy requirements.

Roberto Yus is a Postdoctoral Researcher in the Computer Science department at the University of California, Irvine working with Prof. Sharad Mehrotra. Before that, he spent a year as a visiting researcher at the University of Maryland, Baltimore County working with Prof. Anupam Joshi and Prof. Tim Finin. He obtained his Ph.D. in Computer Science from the University of Zaragoza, Spain, funded through a 4-year fellowship from the Spanish Ministry of Science and Innovation. His research interests are in the fields of data management, knowledge representation, privacy, and the Internet of Things (IoT). His research focuses on the design of semantic data management solutions to empower IoT systems to understand user information requirements and user privacy preferences and adapt their operations taking those into account. Roberto’s research has been published in top-tier conferences and journals such as VLDB and the Journal of Web Semantics. He is part of the editorial board of the “Sensors” and “Frontiers in Big Data” journals and has served as part of the organizing and program committee of several conferences and workshops in addition to serving as an external reviewer for multiple conferences and journals.

ACM chapter talk
Career, job search, and interviewing tips

Nikhil Kumar Mengani (UMBC MS CS ’18), Microsoft SDE

The UMBC student ACM chapter will hold a session on careers and job searches from 4:00 pm to 5:00 pm ET on Saturday, March 13.  Nikhil Mengani, a UMBC graduate and current Microsoft Software Development Engineer, will talk about interview tips, using LinkedIn, and overall job search best practices. 

Join the online meeting for some great insights and a Q&A session with Nikhil.  Join via webex. For more information, contact Samit Shivadekar at .

The UMBC Cyber Defense Lab presents

Moving Target Mobile IPv6 Defense

Prof. Vahid Heydari
Computer Science, Rowan University

12:00–1 pm ET, Friday, 26 February 26, 2021

remotely via WebEx  

Remote cyberattacks can be started from an unlimited distance through the Internet. These attacks include particular actions that allow attackers to compromise systems remotely. Address-based Distributed Denial-of-Service (DDoS) attacks and remote exploits are two main categories of these attacks. A remote exploit takes advantage of a bug or vulnerability to view or steal data or gain unauthorized access to a vulnerable system. Current security solutions in IPv6 such as IPsec, firewall, and Intrusion Detection and Prevention System (IDPS) can prevent remote attacks against known vulnerability exploits. However, zero-day exploits can defeat the best firewalls and IDPSs due to using undisclosed and uncorrected computer application vulnerability. Therefore, a new solution is needed to prevent these attacks. This talk discusses a Moving Target Mobile IPv6 Defense (MTM6D) that randomly and dynamically changes the IP addresses to prevent remote attacks in the reconnaissance step. The talk briefly covers the wide range of applications of MTM6D including critical infrastructure networks, virtual private networks, web servers, Internet-controlled robots, and anti-censorship.

 Vahid Heydari received the M.S. degree in Cybersecurity and the Ph.D. degree in Electrical and Computer Engineering from the University of Alabama in Huntsville. He is currently an Associate Professor of Computer Science and the Director of the Center for Cybersecurity Education and Research at Rowan University, Glassboro, NJ. He is also a co-founder of a cybersecurity startup ObtegoCyber. His research interests include moving target defenses, mobile ad-hoc, sensor, and vehicular network security. He is a member of ACM, IEEE Computer Society and Communications Society. 

Host: Alan T. Sherman, , Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays.  All meetings are open to the public. Upcoming CDL Meetings:

Mar 12, Chao Liu (UMBC), Efficient asynchronous BFT with adaptive security
Mar 26, Jeremy Clark (Concordia)
April 9, (UMBC), MeetingMayhem: A network adversarial thinking game
April 23, Peter Peterson (University of Minnesota Duluth), Adversarial thinking
May 7, Farid Javani (UMBC), Anonymization by oblivious transfer

UMBC Information Systems Department

Machine Learning for Malware:
Challenges and Progress 

Dr. Edward Raff
Booz Allen Hamilton
Visiting Prof. UMBC Computer Science & Electrical Engineering

12:00-1:00 pm ET Wednesday, 17 February 2021

online via WebEx

Malware is an ever-growing problem, single malware families have caused billions in damages, and the first direct death attributed to malware taking down a hospital has occurred. To detect new malware, machine learning is a naturally attractive approach. However, malware poses a number of unique challenges that have slowed the progress of ML-based solutions. In this talk, we will look at the task of malware detection from byte-based analysis, why it poses many challenging machine learning research problems, and progress we have made on these tasks by taking some non-standard approaches to machine learning: building shallow and wide networks instead of deep, handicapping the features of our model to make it robust, and using literal compression algorithms (LZMA) to find similar content. 

Edward Raff leads Booz Allen’s machine learning research group and supports clients in developing new ML solutions. His research includes cybersecurity, adversarial machine learning, fairness and ethics, fingerprint biometrics, and high-performance computing. In his spare time, he is the author of the JSAT machine learning library. He received his BS and MS in Computer Science from Purdue University and his Ph.D. in CS from UMBC. Dr. Raff is a Nvidia Deep Learning certified instructor, and Visiting Professor at UMBC.

CARTA Distinguished Lecture

Modeling and Simulation for
Reducing the Risks Associated with
Extreme Weather

Dr. Robert Atlas

Research Professor & Global Coordinator for CARTA
Director Emeritus/ NOAA Atlantic Oceanographic and Meteorological Laboratory

 11:00-12:00 ET Wednesday, 10 February 2021

WebEX link

The reduction of losses related to hurricanes and other extreme weather phenomena involves many complex aspects ranging from purely theoretical, observational, computational, and numerical, to operational and decisional. A correct warning can lead to proper evacuation and damage mitigation, and produce immense benefits. However, over-warning can lead to substantial unnecessary costs, a reduction of confidence in warnings, and a lack of appropriate response. In this chain of information, the role played by scientific research is crucial.

The National Oceanic and Atmospheric Administration (NOAA), in combination with the National Aeronautics and Space Administration (NASA), other agencies, and universities is contributing to these efforts through observational and theoretical research to better understand the processes associated with extreme weather. This includes model and data assimilation development, Observing System Experiments (OSE), and Observing System Simulation Experiments (OSSE) designed to ascertain the value of existing observing systems and the potential of new observing systems to improve weather prediction and theoretical understanding. This high-level talk, which was first given as the Keynote address at the 2019 Winter Simulation Conference, will describe innovative research for developing advanced next-generation global and regional models to improve weather prediction, and the application of OSSEs to optimize the observing system.

Dr. Robert Atlas is the former Chief Meteorologist at NASA’s Goddard Laboratory for Atmospheres and is Director Emeritus of the National Oceanic and Atmospheric Administration’s (NOAA) Atlantic Oceanographic and Meteorological Laboratory in Miami, Fla. Some of the areas he focused his research on included the prediction, movement, and strengthening of hurricanes. He has worked with both satellite data and computer models as a means to study these hurricane behaviors.

Dr. Atlas received his Ph.D. in Meteorology and Oceanography in 1976 from New York University. Prior to receiving the doctorate, he was a weather forecaster in the U.S. Air Force where he maintained greater than 95 percent forecast accuracy. From 1976 to 1978, Dr. Atlas was a National Research Council Research Associate at NASA’s Goddard Institute for Space Studies, New York, an Assistant Professor of Atmospheric and Oceanic Science for SUNY, and Chief Consulting Meteorologist for the ABC television network.

In 1978, Dr. Atlas joined NASA as a research scientist. He served as head of the NASA Data Assimilation Office from 1998-2003, and as Chief meteorologist at NASA GSFC from 2003-2005. Dr. Atlas has performed research to assess and improve the impact of satellite data on numerical weather prediction since 1973. He was a key member of the team that first demonstrated the significant impact of quantitative satellite data on numerical weather prediction and is the world’s leading expert on Observing System Simulation Experiments, a technology that enables scientists to determine the quantitative value of new observing systems before funds are allocated for their development.

He served as a member of the Satellite Surface Stress Working Group, the NASA Scatterometer (NSCAT) Science Team, the ERS Science Team, the SeaWinds Satellite Team, the Working Group for Space-based Laser Winds, the Scientific Steering Group for GEWEX, the Council of the American Meteorological Society, and as Chairman of the U.S. World Ocean Circulation Experiment (WOCE) Advisory Group for model-based air-sea fluxes. He is currently a member of the Science Teams for two NASA space missions.

From 1974-1976, he developed a global upper-ocean model and studied oceanic response to atmospheric wind forcing as well as large-scale atmospheric response to sea surface temperature (SST) anomalies (unusual events). In more recent years, his research concentrated on the role of how the air and sea interact in the development of cyclones, the role of soil moisture and unusual SST events in the initiation, maintenance, and decay of prolonged heatwaves and drought, and most recently on the modeling and prediction of hurricane formation, movement, and intensification.

He is a recipient of the NASA Medal for Exceptional Scientific Achievement and the American Meteorological Society’s Banner I. Miller Award. In 2019, just prior to his retirement from NOAA, he was honored by the National Hurricane Center for Enduring Contributions to the nation’s hurricane forecast and warning program, and by the U.S. House of Representatives for his service to the nation.

Theoryful Machine Learning
in the Chemical Sciences

Prof. Tyler R. Josephson

ATOMS Lab: AI & Theory-Oriented Molecular Science
Chemical, Biochemical & Environmental Engineering, UMBC

1:00-2:00 pm, 5 February 2021
online via webex

Modern machine learning (ML) algorithms have achieved remarkable success in “theoryless” problems of image recognition and natural language processing. When these algorithms find applications in “theoryful” domains like physical sciences, they frequently benefit from the incorporation of domain knowledge into the ML architecture, whether enforcing constraints or symmetries or interpreting neural networks as physical systems.

The chemical sciences have many “theoryful” ML problems. In this talk, I will discuss three projects in which we leverage background theory when designing and adopting ML algorithms. In the first project, we use classical thermodynamics to derive a method to characterize mixture properties in molecular simulations and show that multiple linear regression (with no bias) is the formally correct and thermodynamically consistent model for fitting and predicting these properties. We recently developed an alternative proof from statistical thermodynamics that gives the same result, and we provide evidence that nonlinear methods provide no improvement in performance. In the second project, we perform high-throughput molecular simulations of adsorption (when molecules from a gas or liquid stick on the surface or in the pores of a material), which we analyze using neural networks. We derive a correspondence between theories of multicomponent adsorption and the self-attention mechanism in the transformer architecture and show how the theory-inspired architecture has improved generalization over the multilayer perceptron.

In the final project, I will share work on symbolic regression, in collaboration with the Mathematics of AI department at IBM. In symbolic regression, given a data set, a search through some “space of possible equations” identifies accurately-fitting and parsimonious equations that can be easily inspected by humans. We formulate the symbolic regression problem as a mixed-integer nonlinear programming (MINLP) problem and use MINLP solvers to systematically solve multiple functional forms at once, instead of via the traditional approaches that use genetic algorithms. Future approaches to integrate symbolic regression with chemical theory will be discussed.

Tyler R. Josephson is an Assistant Professor in the Chemical, Biochemical, and Environmental Engineering department at the University of Maryland, Baltimore County. He received his B.S. in Chemical Engineering from the University of Minnesota in 2011, and his Ph.D. in Chemical Engineering from the University of Delaware in 2017, after which he was a postdoctoral associate in the University of Minnesota Chemistry Department. Prof. Josephson uses multi-scale modeling and machine learning to study catalysis, solvation, adsorption, and phase equilibria. During his downtime, he loves learning new things, thinking about deep topics (like science and philosophy), and playing the piano.

The 2021 SFS Research Study: Vulnerabilities in UMBC’s Incident Management System

Cyrus Bonyadi and Enis Golaszewski
CSEE Department, UMBC

12:00noon–1pm Friday, 29 January 2021

remotely via WebEx 

 January 11–15, 2020, UMBC scholars in the CyberCorps: Scholarship for Service (SFS) and the DoD Cybersecurity Scholarship (CySP) programs collaboratively analyzed the security of UMBC’s Incident Management System (IMS). Students found numerous serious issues, including race conditions, code-injection, and cross-site scripting attacks, improper API implementation, and denial-of-service attacks. We present findings, recommendations, and details of these vulnerabilities.

UMBC’s Incident Management System (IMS) is a web application under development by UMBC’s DoIT to supplement their RequestTracker (RT). IMS allows DoIT security staff to supplement the information in RT by linking IMS incidents to RT tickets. IMS incidents store additional information and files regarding existing and potential security campaigns. Using the information in IMS and RT, DoIT generates executive reports, which can influence decisions related to budget, training, and other security concerns. Our study is helping to improve the architecture and implementation of IMS.

Participants comprised BS, MS, MPS, and Ph.D. students studying computer science, computer engineering, information systems, and cybersecurity, including SFS scholars who transferred from Montgomery College (MC) and Prince George’s Community College (PGCC) to complete their four-year degrees at UMBC.

About the Speakers. Cyrus Jian Bonyadi is a Ph.D. Student at UMBC working on distributed computing consensus theory. He is an alumnus of the varsity CyberDawgs team. email: . Enis Golaszewski is a Ph.D. Student at UMBC working on protocol analysis. He is a leading member of the Protocol Analysis Lab under Dr. Sherman. email: , 

Host: Alan T. Sherman, . Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays 12-1 pm.  All meetings are open to the public. Upcoming CDL Meetings:

• Feb 12, Richard Carback (xxnetwork), Startup lessons learned
• Feb 26, Vahid Heydari (Rowan University)
• Mar 12, Chao Liu (UMBC), Efficient asynchronous BFT with adaptive security
• Mar 26, Jeremy Clark (Concordia)
• April 9, (UMBC), MeetingMayhem: A network adversarial thinking game
• April 23, Peter Peterson (University of Minnesota Duluth), Adversarial thinking
• May 7, Farid Javani (UMBC), Anonymization by oblivious transfer