All Publications

---

Black-box Attacks Against Neural Binary Function Detection

• Joshua Bundt, Michael Davinroy, Ioannis Agadakos, Alina Oprea, William Robertson
• Proceedings of the International Symposium on Research in Attacks, Intrusions and Defenses (RAID)
• September 2023
PDF

ThreadLock: Native Principal Isolation Through Memory Protection Keys

• William Blair, William Robertson, Manuel Egele
• Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS)
• July 2023
PDF

HotFuzz: Discovering Temporal and Spatial Denial-of-Service Vulnerabilities Through Guided Micro-Fuzzing

• William Blair, Andrea Mambretti, Sajjad Arshad, Michael Weissbacher, William Robertson, Engin Kirda, Manuel Egele
• ACM Transactions on Privacy and Security 25(4)
• November 2022
PDF

MPKAlloc: Efficient Heap Meta-data Integrity Through Hardware Memory Protection Keys

• William Blair, William Robertson, Manuel Egele
• Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
• May 2022
PDF

Bypassing Memory Safety Mechanisms through Speculative Control Flow Hijacks

• Andrea Mambretti, Alexandra Sandulescu, Alessandro Sorniotti, William Robertson, Engin Kirda, Anil Kurmus
• Proceedings of the IEEE European Symposium on Security and Privacy (EuroSP)
• September 2021
PDF

Evaluating Synthetic Bugs

• Joshua Bundt, Andrew Fasano, Brendan Dolan-Gavitt, William Robertson, Tim Leek
• Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS)
• June 2021
PDF

SoK: Enabling Security Analyses of Embedded Systems via Rehosting

• Andrew Fasano, Tiemoko Ballo, Marius Muench, Tim Leek, Alexander Olienik, Brendan Dolan-Gavitt, Manuel Egele, Aurélien Francillon, Long Lu, Nick Gregory, Davide Balzarotti, William Robertson
• Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS)
• June 2021
PDF

PyPANDA: Taming the PANDAmonium of Whole System Dynamic Analysis

• Luke Craig, Andrew Fasano, Tiemoko Ballo, Tim Leek, Brendan Dolan-Gavitt, William Robertson
• Proceedings of the Workshop on Binary Analysis Research (BAR), co-located with NDSS
• February 2021
PDF

What's in an Exploit: An Empirical Analysis of Reflected Server XSS Exploitation Techniques

• Ahmet Buyukkayhan, Can Gemicioglu, Tobias Lauinger, Alina Oprea, William Robertson, Engin Kirda
• Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2020
PDF

Cached and Confused: Web Cache Deception in the Wild

• Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda, William Robertson
• Proceedings of the USENIX Security Symposium
• August 2020
PDF

HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Guided Micro-Fuzzing

• William Blair, Andrea Mambretti, Sajjad Arshad, Michael Weissbacher, William Robertson, Engin Kirda, Manuel Egele
• Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS)
• February 2020
PDF

Speculator: A Tool to Analyze Speculative Execution Attacks and Mitigations

• Andrea Mambretti, Matthias Neugschwandtner, Alessandro Sorniotti, Engin Kirda, William Robertson, Anil Kurmus
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2019
PDF

A Longitudinal Analysis of the ads.txt Standard

• Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson
• Proceedings of the Internet Measurement Conference (IMC)
• October 2019
PDF

Getting Under Alexa’s Umbrella: Infiltration Attacks Against Internet Top Domain Lists

• Walter Rweyemamu, Tobias Lauinger, Christo Wilson, William Robertson, Engin Kirda
• Proceedings of the International Conference on Information Security (ISC)
• September 2019
PDF

USBESAFE: An End-Point Solution to Protect Against USB-Based Attacks

• Amin Kharraz, Brandon Daley, Graham Baker, William Robertson, Engin Kirda
• Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2019
PDF

It's Not What It Looks Like: Measuring Attacks and Defensive Registrations of Homograph Domains

• Florian Quinkert, Tobias Lauinger, William Robertson, Engin Kirda, Thorsten Holz
• Proceedings of the IEEE Conference on Communications and Network Security (CNS)
• June 2019
PDF

Clustering and the Weekend Effect: Recommendations for the Use of Top Domain Lists in Security Research

• Walter Rweyemamu, Tobias Lauinger, Christo Wilson, William Robertson, Engin Kirda
• Proceedings of the International Conference on Passive and Active Network Measurement (PAM)
• March 2019
PDF

On the Effectiveness of Type-based Control Flow Integrity

• Reza Mirzazade Farkhani, Saman Jafari, Sajjad Arshad, William Robertson, Engin Kirda, Hamed Okhravi
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2018
PDF

From Deletion to Re-Registration in Zero Seconds: Domain Registrar Behaviour During the Drop

• Tobias Lauinger, Abdelberi Chaabane, Ahmet Buyukkayhan, William Robertson, Engin Kirda
• Proceedings of the ACM Internet Measurement Conference (IMC)
• October 2018
PDF

How Tracking Companies Circumvent Ad Blockers Using WebSockets

• Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson
• Proceedings of the ACM Internet Measurement Conference (IMC)
• October 2018
PDF

Surveylance: Automatically Detecting Online Survey Scams

• Amin Kharraz, William Robertson, Engin Kirda
• Proceedings of the IEEE Symposium on Security and Privacy (Oakland)
• May 2018
PDF

ERASER: Your Data Won't Be Back

• Kaan Onarlioglu, William Robertson, Engin Kirda
• Proceedings of the IEEE European Symposium on Security and Privacy (EuroSP)
• April 2018
PDF

Large-Scale Analysis of Style Injection by Relative Path Overwrite

• Sajjad Arshad, Seyed Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda, William Robertson
• Proceedings of the Web Conference (WWW)
• April 2018
PDF

Ex-Ray: Detection of History-Leaking Browser Extensions

• Michael Weissbacher, Enrico Mariconti, Guillermo Suarez de Tangil, Gianluca Stringhini, William Robertson, Engin Kirda
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2017
PDF

Lens on the Endpoint: Hunting for Malicious Software through Endpoint Data Analysis

• Ahmet Buyukkayhan, Alina Oprea, Zhou Li, William Robertson
• Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2017
PDF

Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers

• Tobias Lauinger, Abdelberi Chaabane, Ahmet Buyukkayhan, Kaan Onarlioglu, William Robertson
• Proceedings of the USENIX Security Symposium
• August 2017
PDF

Semi-automated Discovery of Server-Based Information Oversharing Vulnerabilities in Android Applications

• Wil Koch, Abdelberi Chaabane, Manuel Egele, William Robertson, Engin Kirda
• Proceedings of the International Symposium on Software Testing and Analysis (ISSTA)
• July 2017
PDF

Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web

• Tobias Lauinger, Abdelberi Chaabane, William Robertson, Christo Wilson, Engin Kirda
• Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS)
• February 2017
PDF

WHOIS Lost in Translation: (Mis)Understanding Internet Domain Name Expiration and Re-Registration

• Tobias Lauinger, Kaan Onarlioglu, Abdelberi Chaabane, William Robertson, Engin Kirda
• Proceedings of the ACM Internet Measurement Conference (IMC)
• November 2016
PDF

Identifying Extension-based Ad Injection via Fine-grained Web Content Provenance

• Sajjad Arshad, Amin Kharraz, William Robertson
• Proceedings of the International Conference on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2016
PDF

Trellis: Privilege Separation for Multi-User Applications Made Easy

• Andrea Mambretti, Kaan Onarlioglu, Collin Mulliner, William Robertson, Engin Kirda, Federico Maggi, Stefano Zanero
• Proceedings of the International Conference on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2016
PDF

Runtime Integrity Checking for Exploit Mitigation on Lightweight Embedded Devices

• Matthias Neugschwandtner, Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the International Conference on Trust & Trustworthy Computing (TRUST)
• August 2016
PDF

Tracing Information Flows Between Ad Exchanges Using Retargeted Ads

• Muhammad Bashir, Sajjad Arshad, William Robertson, Christo Wilson
• Proceedings of the USENIX Security Symposium
• August 2016
PDF

UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware

• Amin Kharraz, Sajjad Arshad, Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the USENIX Security Symposium
• August 2016
PDF

EmailProfiler: Spearphishing Filtering with Header and Stylometric Features of Emails

• Sevtap Duman, Kubra Kalkan, Manuel Egele, William Robertson, Engin Kirda
• Proceedings of the IEEE Conferences on Computers, Software, and Applications (COMPSAC)
• June 2016
PDF

Overhaul: Input-Driven Access Control for Better Privacy on Traditional Operating Systems

• Kaan Onarlioglu, William Robertson, Engin Kirda
• Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
• June 2016
PDF

LAVA: Large-scale Automated Vulnerability Addition

• Brendan Dolan-Gavitt, Patrick Hulin, Engin Kirda, Tim Leek, Andrea Mambretti, William Robertson, Frederick Ulrich, Ryan Whelan
• Proceedings of the IEEE Symposium on Security and Privacy (Oakland)
• May 2016
PDF

Towards Detecting Logic Bombs in Android Applications

• Yanick Fratantonio, Antonio Bianchi, William Robertson, Christopher Kruegel, Engin Kirda, Giovanni Vigna
• Proceedings of the IEEE Symposium on Security and Privacy (Oakland)
• May 2016
PDF

CrossFire: An Analysis of Firefox Extension-Reuse Vulnerabilities

• Ahmet Buyukkayhan, Kaan Onarlioglu, William Robertson, Engin Kirda
• Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS)
• February 2016
PDF

CuriousDroid: Automated User Interface Interaction for Android Application Analysis Sandboxes

• Patrick Carter, Collin Mulliner, Martina Lindorfer, William Robertson, Engin Kirda
• Proceedings of the International Conference on Financial Cryptography and Data Security (FC)
• February 2016
PDF

Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions

• Sajjad Arshad, Amin Kharraz, William Robertson
• Proceedings of the International Conference on Financial Cryptography and Data Security (FC)
• February 2016
PDF

ZigZag: Automatically Hardening Web Applications Against Client-side Validation Vulnerabilities

• Michael Weissbacher, William Robertson, Engin Kirda, Christopher Kruegel, Giovanni Vigna
• Proceedings of the USENIX Security Symposium
• August 2015
PDF

Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks

• Amin Kharraz, William Robertson, Davide Balzarotti, Leyla Bilge, Engin Kirda
• Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
• July 2015
PDF

On the Security and Engineering Implications of Finer-Grained Access Controls for Android Developers and Users

• Yanick Fratantonio, Antonio Bianchi, William Robertson, Manuel Egele, Engin Kirda, Christopher Kruegel, Giovanni Vigna
• Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
• July 2015
PDF

BabelCrypt: The Universal Encryption Layer for Mobile Messaging Applications

• Ahmet Ozcan, Can Gemicioglu, Kaan Onarlioglu, Michael Weissbacher, Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the International Conference on Financial Cryptography and Data Security (FC)
• January 2015
PDF

Sentinel: Securing Legacy Firefox Extensions

• Kaan Onarlioglu, Ahmet Buyukkayhan, William Robertson, Engin Kirda
• Journal of Computers and Security 49 (0)
• January 2015
PDF

TrueClick: Automatically Distinguishing Trick Banners from Genuine Download Links

• Sevtap Duman, Kaan Onarlioglu, Ali Ulosoy, William Robertson, Engin Kirda
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2014
PDF

Why is CSP Failing? Trends and Challenges in CSP Adoption

• Michael Weissbacher, Tobias Lauinger, William Robertson
• Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)
• September 2014
PDF

Optical Delusions: A Study of Malicious QR Codes in the Wild

• Amin Kharraz, Engin Kirda, William Robertson, Davide Balzarotti, Aurélien Francillon
• Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
• June 2014
PDF

VirtualSwindle: An Automated Attack Against In-App Billing on Android

• Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the ACM Asia Conference on Computer and Communications Security (AsiaCCS)
• June 2014
PDF

Hidden GEMs: Automated Discovery of Access Control Vulnerabilities in Graphical User Interfaces

• Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the IEEE Symposium on Security and Privacy (Oakland)
• May 2014
PDF

Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks

• Ting-Fang Yen, Alina Oprea, Kaan Onarlioglu, Todd Leetham, William Robertson, Ari Juels, Engin Kirda
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2013
PDF

PatchDroid: Scalable Third-Party Patches for Android Devices

• Collin Mulliner, Jon Oberheide, William Robertson, Engin Kirda
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2013
PDF

Holiday Pictures or Blockbuster Movies? Insights into Copyright Infringement in User Uploads to One-Click File Hosters

• Tobias Lauinger, Kaan Onarlioglu, Abdelberi Chaabane, Engin Kirda, William Robertson, Mohamed Kaafar
• Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID)
• October 2013
PDF

Securing Legacy Firefox Extensions with Sentinel

• Kaan Onarlioglu, Mustafa Battal, William Robertson, Engin Kirda
• Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
• July 2013
PDF

PrivExec: Private Execution as an Operating System Service

• Kaan Onarlioglu, Collin Mulliner, William Robertson, Engin Kirda
• Proceedings of the IEEE Symposium on Security and Privacy (Oakland)
• May 2013
PDF

A Practical, Targeted, and Stealthy Attack Against WPA Enterprise Authentication

• Aldo Cassola, William Robertson, Engin Kirda, Guevara Noubir
• Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS)
• February 2013
PDF

DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysis

• Leyla Bilge, Davide Balzarotti, William Robertson, Engin Kirda, Christopher Kruegel
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2012
PDF

TRESOR-HUNT: Attacking CPU-Bound Encryption

• Erik-Oliver Blass, William Robertson
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2012
PDF

Preventing Input Validation Vulnerabilities in Web Applications through Automated Type Analysis

• Theodoor Scholte, William Robertson, Davide Balzarotti, Engin Kirda
• Proceedings of the IEEE Conferences on Computers, Software, and Applications (COMPSAC)
• July 2012
PDF

An Empirical Analysis of Input Validation Mechanisms in Web Applications and Languages

• Theodoor Scholte, William Robertson, Davide Balzarotti, Engin Kirda
• Proceedings of the ACM Symposium on Applied Computing (SAC)
• March 2012
PDF

An Experience in Testing the Security of a Real-World Electronic Voting System

• Davide Balzarotti, Marco Cova, Viktoria Felmetsger, Richard Kemmerer, William Robertson, Fredrik Valeur, Giovanni Vigna
• IEEE Transactions on Software Engineering 36 (4)
• July 2010
PDF

Effective Anomaly Detection with Scarce Training Data

• William Robertson, Federico Maggi, Christopher Kruegel, Giovanni Vigna
• Proceedings of ISOC Network and Distributed System Security Symposium (NDSS)
• February 2010
PDF

Protecting a Moving Target: Addressing Web Application Concept Drift

• Federico Maggi, William Robertson, Christopher Kruegel, Giovanni Vigna
• Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID)
• September 2009
PDF

Static Enforcement of Web Application Integrity Through Strong Typing

• William Robertson, Giovanni Vigna
• Proceedings of the USENIX Security Symposium
• August 2009
PDF

Detecting and Preventing Attacks Against Web Applications

• William Robertson
• UC Santa Barbara
• June 2009
PDF

Reducing Errors in the Anomaly-based Detection of Web-based Attacks Through the Combined Analysis of Web Requests and SQL Queries

• Giovanni Vigna, Fredrik Valeur, Davide Balzarotti, William Robertson, Christopher Kruegel
• Journal of Computer Security 17 (3)
• May 2009
PDF

Are Your Votes Really Counted? Testing the Security of Real-world Voting Systems

• Davide Balzarotti, Greg Banks, Marco Cova, Viktoria Felmetsger, William Robertson, Fredrik Valeur, Giovanni Vigna, Richard Kemmerer
• Proceedings of the International Symposium on Software Testing and Analysis (ISSTA)
• July 2008
PDF

Improving Signature Testing Through Dynamic Data Flow Analysis

• Davide Balzarotti, William Robertson, Christopher Kruegel, Giovanni Vigna
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2007
PDF

Exploiting Execution Context for the Detection of Anomalous System Calls

• Darren Mutz, William Robertson, Giovanni Vigna, Richard Kemmerer
• Proceedings of the International Symposium on Recent Advances on Intrusion Detection (RAID)
• September 2007
PDF

Using Generalization and Characterization Techniques in the Anomaly-based Detection of Web Attacks

• William Robertson, Giovanni Vigna, Christopher Kruegel, Richard Kemmerer
• Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS)
• February 2006
PDF

Polymorphic Worm Detection Using Structural Information of Executables

• Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, Giovanni Vigna
• Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID)
• September 2005
PDF

A Multi-Model Approach to the Detection of Web-based Attacks

• Christopher Kruegel, William Robertson, Giovanni Vigna
• Journal of Computers and Networks 48 (5)
• July 2005
PDF

Automating Mimicry Attacks Using Static Binary Analysis

• Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, Giovanni Vigna
• Proceedings of the USENIX Security Symposium
• July 2005
PDF

Reverse Engineering of Network Signatures

• Darren Mutz, Christopher Kruegel, William Robertson, Giovanni Vigna, Richard Kemmerer
• Proceedings of the AusCERT Conference
• May 2005
PDF

Detecting Kernel-Level Rootkits Through Binary Analysis

• Christopher Kruegel, William Robertson, Giovanni Vigna
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2004
PDF

Testing Network-based Intrusion Detection Signatures Using Mutant Exploits

• Giovanni Vigna, Davide Balzarotti, William Robertson
• Proceedings of the ACM Conference on Computer and Communications Security (CCS)
• October 2004
PDF

Static Disassembly of Obfuscated Binaries

• Christopher Kruegel, William Robertson, Fredrik Valuer, Giovanni Vigna
• Proceedings of the USENIX Security Symposium
• August 2004
PDF

Using Alert Verification to Identify Successful Intrusion Attempts

• Christopher Kruegel, Giovanni Vigna, William Robertson
• Journal of Practice in Information Processing and Communication 27 (4)
• August 2004
PDF

Alert Verification: Determining the Success of Intrusion Attempts

• Christopher Kruegel, William Robertson
• Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
• July 2004
PDF

A Stateful Intrusion Detection System for World-Wide Web Servers

• Giovanni Vigna, William Robertson, Vishal Kher, Richard Kemmerer
• Proceedings of the Annual Computer Security Applications Conference (ACSAC)
• December 2003
PDF

Run-time Detection of Heap-based Overflows

• William Robertson, Christopher Kruegel, Darren Mutz, Fredrik Valeur
• Proceedings of the USENIX Large Installation System Administration Conference (LISA)
• October 2003
PDF

Topology-based Detection of Anomalous BGP Messages

• Christopher Kruegel, Darren Mutz, William Robertson, Fredrik Valuer
• Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID)
• September 2003
PDF