Gaurav S. Kc - Curriculum Vitae

Education

• • Ph.D. May 2005

  • Computer Science, Columbia University, New York

  • Advisor: Alfred V. Aho

  • Thesis: "Defending Software Against Process-Subversion Attacks"

  • M.Phil. January 2003

  • Computer Science, Columbia University, New York

  • M.S. January 2001

  • Computer Science, Columbia University, New York

  • B.Eng. October 1999

  • Department of Computing, Imperial College, London

  • Personal Tutor: Susan Eisenbach

  • Undergraduate thesis: "Java: An Operational Semantics"

Research Interests

• • Security of software systems, Compilers, Program execution environments, Programming language implementations

Honors and Awards

• • ACM Travel Support Grant October 2003

  • 10th ACM Conference on Computer and Communications Security

  • Extraordinary Teaching Assistant Award May 2003

  • for CS4115: Programming Languages and Translators Fall 2002. TA for Professor Alfred V. Aho

  • The Fu Foundation School of Engineering and Applied Science, Columbia University

  • Ph.D. Award for Excellence in TA'ing May 2002

  • for CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross

  • Computer Science Department, Columbia University

  • Extraordinary Teaching Assistant Award May 2002

  • for CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross

  • The Fu Foundation School of Engineering and Applied Science, Columbia University

  • Graduate Research Assistantship September 1999 - May 2005

  • Computer Science, Columbia University, New York

  • Associateship of the City and Guilds of London Institute October 1999

  • Award for Best Undergraduate group project January 1999

  • British Telecom, London

  • Merit-based College Scholarship and Stipend October 1996 - June 1999

  • Department for International Development, The British Council

Professional Activities

• • (IEEE S&P '06) External referee for the 2006 IEEE Symposium on Security and Privacy

  • (ICDCS '06) Reviewer for the 26th International Conference on Distributed Computing Systems

  • (NDSS '06) Reviewer for the 13th Annual Network and Distributed Security Symposium

  • (Security '05) External referee for the 14th USENIX Security Symposium

  • (ICDCS '05) Reviewer for the 25th International Conference on Distributed Computing Systems

  • (Security '04) External referee for the 13th USENIX Security Symposium

  • (NDSS '04) External referee for the 11th Annual Network and Distributed Security Symposium

Research Experience

• • Security of Software Systems September 2002 - May 2005

  • Professor Alfred V. Aho

  • Computer Science, Columbia University

  •      Investigating various compiler- and kernel-based strategies to increase the resiliency of (open-source) software against malicious attacks, e.g., by Internet crackers or worms:

    • • (Spring 2005 - May 2005) by defining a general-use framework for evaluating the efficacy of defence techniques at thwarting a variety of attacks.

      • (Fall 2003 - May 2005) use a kernel-based approach with libc support for continually monitoring all system-call requests issued by running programs. Malicious activity can be inferred from suspect and illegal invocations of system calls or functions in libc.

      • (Spring 2003) by reordering/encoding of bits within (blocks of) machine instructions in the executable sections of program binaries. A "modified" processor would then continually restore and decode/execute these instructions on the fly. This ensures that any attempt to execute injected code would result in the "restoration" of the (injected) valid machine code into a harmless code sequence that would fail to execute in the manner intended by the attacker.

      • (Fall 2002) by introducing variations in the binary signatures of executables and the memory layout of running processes (e.g., randomized sizes for activation records, and obfuscation of functions' return addresses during their execution)

  • Evaluating the Security and Privacy Considerations of Machine Readable Travel Documents July 2004 - September 2004

  • Elaine R. Palmer, JR Rao, Paul A. Karger

  • (Summer Internship) Internet Security Group, IBM Research

  •      Analysed the security and privacy issues with the International Civil Aviation Organisation's (ICAO) specifications for the use of biometrics-enabled Machine Readable Travel Documents (MRTD). Determined how flaws in the current specifications can be exploited to create passport forgeries that can be used to foil electronic and biometric checks at border posts.

  • Covert Channel Analysis for a High-Assurance Operating System May 2004 - June 2004

  • Elaine R. Palmer, JR Rao, Paul A. Karger

  • (Summer Internship) Internet Security Group, IBM Research

  •      Surveyed the field of covert channel analysis techniques to determine an approach suitable for a high-assurance operating system running on a smartcard microprocessor. Collaborated with static-analysis experts to create a proof-of-concept analysis system to detect potential covert channels in the operating system code.

  • Retargeting the GNU C Compiler to the Philips SmartXA embedded processor May 2003 - August 2003

  • Elaine R. Palmer, JR Rao, David C. Toll

  • (Summer Internship) Internet Security Group, IBM Research

  •      Involved with porting the GNU Compiler Collection's C compiler to the Philips SmartXA-2 smartcard microprocessor. This optimising compiler will be used for the high-assurance, secure operating system being developed by the Internet Security Group, IBM.

  • Survivor-NG: Survivable Middleware July 2001 - April 2002

  • Professor Gail E. Kaiser

  • Computer Science, Columbia University

  •      Extended an existing distributed workflow system by adding the ability to continue to completion even when faced with partial failure of various subcomponents. Adding survivability/dependability to the MLS Workflow System from NRL required the study of the internal process flow of the system, and replacing it with a Worklets-based alternative that had the ability to detect failure of nodes. Our enhancement then appropriately resumed execution, when possible, using previously logged and replicated states of the workflow using replacement nodes that could handle the failed sub-tasks.

  • Worklets: A Mobile Agent System June 2000 - December 2002

  • Professor Gail E. Kaiser

  • Computer Science, Columbia University

  •      Implemented a mobile code system in the Java programming language. This was an application-level infrastructure in the sense that a mobile agent saves only application-level data and not its thread-state (which would have required major changes to the JVM, disallowing us from distributing our system without Sun's permission) when transporting itself to a different node on the network. I also supervised 4 projects based on Worklets for M.S. students.

  • Data Structures in Functional Languages September 1999 - May 2000

  • Professor Chris D. Okasaki

  • Computer Science, Columbia University

  •      Experimented with implementations of advanced data structures like Patricia Tries, Lazy Binomial Heaps for functional languages, in addition to developing an implementation for (more) efficient array operations in a persistent setting.

  • Extension of an Operational Semantics for Java January 1999 - June 1999

  • Professors Sophia C. Drossopoulou, Susan Eisenbach

  • Department of Computing, Imperial College

  •      Extended the operational semantics for Java by adding formal definitions and semantic rules for access modifiers and constructors. This was based on continuing work by Drossopoulou and Eisenbach at Imperial College.

  • An Interpreter for an Operational Semantics for Java July 1998 - September 1998

  • Professors Krysia Broda, Sophia C. Drossopoulou, Susan Eisenbach

  • Department of Computing, Imperial College

  •      Studied the operational semantics for a subset of Java as defined by Drossopoulou and Eisenbach, and implemented an interpreter in prolog based on this semantics definition. This research was carried out as an Undergraduate Research Opportunities Program (UROP) project.

Employment

• • Google Inc., California August 2005 - present

  • Software Engineer.

  • IBM T.J. Watson Research Labs, New York May 2004 - September 2004

  • Evaluated the specifications for the next-generation (electronic) passports, and determined security and privacy vulnerabilities that can facilitate forgery.

  • IBM T.J. Watson Research Labs, New York May 2003 - August 2003

  • Worked in the Internet Security Group to retarget the GNU C compiler to produce code for the Philips SmartXA-2 smartcard microprocessor.

  • Linkshare Corporations, New York July 2000 - August 2000

  • Designed and built software to simulate click-through on online advertisements maintained by Linkshare. The product mimics behavior of web users who click on banner ads and then purchase services and merchandise

  • NetDecisions Ltd., London June 1999 - August 1999

  • Conducted feasibility studies for building a web-based package holiday reservation system that interacted with the Online Reservation System used by the Thomson Holidays travel agents.

Patents

1. Detecting and preventing malcode execution

   1. Gaurav S. Kc, Alfred V. Aho

   2. US Patent Number 7,971,255

Publications

1. Privacy is Essential for Secure Mobile Devices

2. Paul A. Karger, Gaurav S. Kc, David C. Toll

3. To appear in the Proceedings of the IBM Systems Journal, 2009

4. On the General Applicability of Instruction-Set Randomization

5. Stephen W. Boyd, Gaurav S. Kc, Michael E. Locasto, Angelos D. Keromytis, Vassilis Prevelakis

6. In Proceedings of the IEEE Transactions on Dependable and Secure Computing (TDSC), October 2008

7. e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via System-Call Policing

   1. Gaurav S. Kc, Angelos D. Keromytis

   2. In Proceedings of the 21st Annual Computer Security Applications Conference, December 2005

8. Security and Privacy Issues in Machine Readable Travel Documents (MRTDs)

9. Gaurav S. Kc, Paul A. Karger

10. In Cryptology ePrint Archive, Report 2005/404

11. In IBM Technical Report (RC 23575), IBM T. J. Watson Research Labs, April 2005

12. Countering Code-Injection Attacks With Instruction-Set Randomization

• 1. Gaurav S. Kc, Angelos D. Keromytis, Vassilis Prevelakis

  2. In Proceedings of the 10th ACM Conference on Computer and Communications Security, October 2003

13. An Approach to Autonomizing Legacy Systems

• 1. Gail Kaiser, Phil Gross, Gaurav Kc, Janak Parekh, Giuseppe Valetto

  2. In Proceedings of the Workshop on Self-Healing, Adaptive and self-MANaged Systems, June 2002

14. An Active Events Model for System Monitoring

• 1. Philip N. Gross, Suhit Gupta, Gail E. Kaiser, Gaurav S. Kc, Janak J. Parekh

  2. In Working Conference on Complex and Dynamic Systems Architecture, December 2001

15. A Mobile Agent Approach to Process-based Dynamic Adaptation of Complex Software Systems

• 1. Giuseppe Valetto, Gail Kaiser, and Gaurav S. Kc

  2. In Proceedings of the 8th European Workshop on Software Process Technology, June 2001

Technical Papers

1. Dissertation: Defending Software Against Process-Subversion Attacks

   1. Gaurav S. Kc

   2. Ph.D. Dissertation. Columbia University, April 2005

2. Thesis Proposal: How to Create Secure Runtime Environments for Software

• 1. Gaurav S. Kc

  2. Ph.D. Thesis Proposal, Columbia University, New York, December 2003

3. Caller-ID: Caller Validation as a Technique to Detect Process Compromise

• 1. Alfred V. Aho, Gaurav S. Kc

  2. Technical Report, Department of Computer Science, Columbia University, November 2003

4. Survivor: An Approach for Adding Dependability to Legacy Workflow Systems

• 1. Jean-Denis Greze, Gail E. Kaiser, Gaurav S. Kc

  2. Technical Report CUCS-026-02, Department of Computer Science, Columbia University, December 2002

5. CASPER: Compiler-Assisted Securing of Programs at Runtime

• 1. Gaurav S. Kc, Stephen A. Edwards, Gail E. Kaiser, Angelos D. Keromytis

  2. Technical Report CUCS-025-02, Department of Computer Science, Columbia University, November 2002

6. Java: Semantics and Type Soundness

• 1. Gaurav S. Kc

  2. Undergraduate Thesis, Imperial College, London, June 1999

Teaching Experience

• • CS6125: Web-enHanced Information Management Summer 2003. Course Manager for Columbia Video Network (CVN)

  • Graded students' research survey papers and web-based, software engineering projects.

  • CS4117: Compilers and Interpreters Spring 2003. TA for Professor Alfred V. Aho

  • Taught a class on Software Security, and use of compilation tools to enhance security. Supervised and graded compiler projects.

  • CS6125: Web-enHanced Information Management Spring 2003. TA for Professor Gail E. Kaiser

  • Graded students' research survey papers and web-based, software engineering projects.

  • CS4115: Programming Languages and Translators Fall 2002. TA for Professor Alfred V. Aho

  • Conducted tutorials on Lex and Yacc. Graded final exam, and supervised student projects.

  • CS4117: Compilers and Interpreters Spring 2002. TA for Professor Alfred V. Aho

  • Gave a tutorial on using Lex and Yacc to construct the front-end of a compiler.

  • CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross

  • Designed and developed game simulators for each of the 5 projects. Also organized tournaments for the students' players.

  • CS4115: Programming Languages and Translators Spring 2000. TA for Professor Chris D. Okasaki

  • Graded assignments, midterm and finals.

Technical Experience

• • Operating Systems Red Hat Linux, Solaris, Windows XP

  • Scripting/Programming Languages C, C++, Java, Perl, Shell scripting, AWK, Javascript, Assembler (x86, M68K, MIPS, Philips SmartXA), Prolog, SQL

  • Hacking Open-Source Software GNU C compiler, GDB debugger, Bochs x86 emulator, GNU Binutils, Linux kernel

  • Tools/libraries Lex/Yacc, Java AWT/Swing, JDBC, RMI, STL, TCP/IP

References

• • Alfred V. Aho (thesis advisor) (aho AT cs.columbia.edu)

  • Gail E. Kaiser (kaiser AT cs.columbia.edu)

  • Angelos D. Keromytis (angelos AT cs.columbia.edu)