Salvatore J. Stolfo

Orcid: 0000-0003-1611-0100

Affiliations:
  • Columbia University, New York City, USA


According to our database1, Salvatore J. Stolfo authored at least 174 papers between 1979 and 2022.

Collaborative distances:

Awards

ACM Fellow

ACM Fellow 2019, "For contributions to machine-learning-based cybersecurity and parallel hardware for database inference systems".

IEEE Fellow

IEEE Fellow 2018, "For contributions to machine learning-based computer security".

Timeline

Legend:

Book 
In proceedings 
Article 
PhD thesis 
Dataset
Other 

Links

Online presence:

On csauthors.net:

Bibliography

2022
Discovering Organizational Hierarchy through a Corporate Ranking Algorithm: The Enron Case.
Complex., 2022

2019
Active authentication using file system decoys and user behavior modeling: results of a large scale study.
Comput. Secur., 2019

2018
Motivating Security-Aware Energy Management.
IEEE Micro, 2018

Simulated User Bots: Real Time Testing of Insider Threat Detection Systems.
Proceedings of the 2018 IEEE Security and Privacy Workshops, 2018

2017
Anomaly Detection as a Service: Challenges, Advances, and Opportunities
Synthesis Lectures on Information Security, Privacy, and Trust, Morgan & Claypool Publishers, ISBN: 978-3-031-02354-5, 2017

Tug-of-War: Observations on Unified Content Handling.
CoRR, 2017

CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management.
Proceedings of the 26th USENIX Security Symposium, 2017

NEZHA: Efficient Domain-Independent Differential Testing.
Proceedings of the 2017 IEEE Symposium on Security and Privacy, 2017

2016
You Are What You Use: An Initial Study of Authenticating Mobile Users via Application Usage.
Proceedings of the 8th EAI International Conference on Mobile Computing, 2016

Using Diversity to Harden Multithreaded Programs Against Exploitation.
Proceedings of the 2nd IEEE International Conference on Big Data Security on Cloud, 2016

2015
Scalability of Machine to Machine systems and the Internet of Things on LTE mobile networks.
Proceedings of the 16th IEEE International Symposium on A World of Wireless, 2015

A silicon anti-virus engine.
Proceedings of the 2015 IEEE Hot Chips 27 Symposium (HCS), 2015

Fox in the trap: thwarting masqueraders via automated decoy document deployment.
Proceedings of the Eighth European Workshop on System Security, 2015

Heisenbyte: Thwarting Memory Disclosure Attacks using Destructive Code Reads.
Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015

2014
Unsupervised Anomaly-Based Malware Detection Using Hardware Features.
Proceedings of the Research in Attacks, Intrusions and Defenses, 2014

Synthetic Data Generation and Defense in Depth Measurement of Web Applications.
Proceedings of the Research in Attacks, Intrusions and Defenses, 2014

Measuring Drive-by Download Defense in Depth.
Proceedings of the Research in Attacks, Intrusions and Defenses, 2014

Improving readiness for enterprise migration to the cloud.
Proceedings of the Middleware Industry Track, Bordeaux, France, December 8-12, 2014, 2014

Model Aggregation for Distributed Content Anomaly Detection.
Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, 2014

2013
Revisiting the myth of Cisco IOS diversity: recent advances in reliable shellcode design.
Inf. Manag. Comput. Secur., 2013

System Level User Behavior Biometrics using Fisher Features and Gaussian Mixture Models.
Proceedings of the 2013 IEEE Symposium on Security and Privacy Workshops, 2013

When Firmware Modifications Attack: A Case Study of Embedded Exploitation.
Proceedings of the 20th Annual Network and Distributed System Security Symposium, 2013

On the feasibility of online malware detection with performance counters.
Proceedings of the 40th Annual International Symposium on Computer Architecture, 2013

2012
A comparison of one-class bag-of-words user behavior modeling techniques for masquerade detection.
Secur. Commun. Networks, 2012

Combining Baiting and User Search Profiling Techniques for Masquerade Detection.
J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 2012

A system for generating and injecting indistinguishable network decoys.
J. Comput. Secur., 2012

Does Profiling Make Us More Secure?
IEEE Secur. Priv., 2012

Usable, Secure, Private Search.
IEEE Secur. Priv., 2012

Lost in Translation: Improving Decoy Documents via Automated Translation.
Proceedings of the 2012 IEEE Symposium on Security and Privacy Workshops, 2012

Fog Computing: Mitigating Insider Data Theft Attacks in the Cloud.
Proceedings of the 2012 IEEE Symposium on Security and Privacy Workshops, 2012

The MEERKATS Cloud Security Architecture.
Proceedings of the 32nd International Conference on Distributed Computing Systems Workshops (ICDCS 2012 Workshops), 2012

Concurrency Attacks.
Proceedings of the 4th USENIX Workshop on Hot Topics in Parallelism, 2012

Software decoys for insider threat.
Proceedings of the 7th ACM Symposium on Information, Compuer and Communications Security, 2012

2011
Symbiotes and defensive Mutualism: Moving Target Defense.
Proceedings of the Moving Target Defense, 2011

Insider Threat Defense.
Proceedings of the Encyclopedia of Cryptography and Security, 2nd Ed., 2011

Measuring Security.
IEEE Secur. Priv., 2011

Guest Editors' Introduction: The Science of Security.
IEEE Secur. Priv., 2011

On the Design and Execution of Cyber-Security User Studies: Methodology, Challenges, and Lessons Learned.
Proceedings of the 4th Workshop on Cyber Security Experimentation and Test, 2011

Killing the Myth of Cisco IOS Diversity: Recent Advances in Reliable Shellcode Design.
Proceedings of the 5th USENIX Workshop on Offensive Technologies, 2011

Modeling User Search Behavior for Masquerade Detection.
Proceedings of the Recent Advances in Intrusion Detection - 14th International Symposium, 2011

Defending Embedded Systems with Software Symbiotes.
Proceedings of the Recent Advances in Intrusion Detection - 14th International Symposium, 2011

Cross-Domain Collaborative Anomaly Detection: So Far Yet So Close.
Proceedings of the Recent Advances in Intrusion Detection - 14th International Symposium, 2011

The SPARCHS Project: Hardware Support for Software Security.
Proceedings of the First SysSec Workshop 2011, 2011

Decoy Document Deployment for Effective Masquerade Attack Detection.
Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment, 2011

The MINESTRONE Architecture Combining Static and Dynamic Analysis Techniques for Software Security.
Proceedings of the First SysSec Workshop 2011, 2011

Reflections on the engineering and operation of a large-scale embedded device vulnerability scanner.
Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, 2011

From prey to hunter: transforming legacy embedded devices into exploitation sensor grids.
Proceedings of the Twenty-Seventh Annual Computer Security Applications Conference, 2011

2010
Monitoring Technologies for Mitigating Insider Threats.
Proceedings of the Insider Threats in Cyber Security, 2010

On the infeasibility of modeling polymorphic shellcode - Re-thinking the role of learning in intrusion detection systems.
Mach. Learn., 2010

Detecting Masqueraders: A Comparison of One-Class Bag-of-Words User Behavior Modeling Techniques.
J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 2010

Privacy-Preserving Sharing of Sensitive Information.
IEEE Secur. Priv., 2010

Ethics in Security Vulnerability Research.
IEEE Secur. Priv., 2010

Erratum to: A link mining algorithm for earnings forecast and trading.
Data Min. Knowl. Discov., 2010

Automating the injection of believable decoys to detect snooping.
Proceedings of the Third ACM Conference on Wireless Network Security, 2010

BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection.
Proceedings of the Recent Advances in Intrusion Detection, 13th International Symposium, 2010

A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan.
Proceedings of the Twenty-Sixth Annual Computer Security Applications Conference, 2010

2009
Addressing the Insider Threat.
IEEE Secur. Priv., 2009

Designing Host and Network Sensors to Mitigate the Insider Threat.
IEEE Secur. Priv., 2009

A link mining algorithm for earnings forecast and trading.
Data Min. Knowl. Discov., 2009

Baiting Inside Attackers Using Decoy Documents.
Proceedings of the Security and Privacy in Communication Networks, 2009

Brave New World: Pervasive Insecurity of Embedded Network Devices.
Proceedings of the Recent Advances in Intrusion Detection, 12th International Symposium, 2009

Adaptive Anomaly Detection via Self-calibration and Dynamic Updating.
Proceedings of the Recent Advances in Intrusion Detection, 12th International Symposium, 2009

Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic.
Proceedings of the Network and Distributed System Security Symposium, 2009

BARTER: Behavior Profile Exchange for Behavior-Based Admission and Access Control in MANETs.
Proceedings of the Information Systems Security, 5th International Conference, 2009

Polymorphic shellcode: the demise of signature-based detection.
Proceedings of the Fifth Cyber Security and Information Intelligence Research Workshop, 2009

Keynote panel.
Proceedings of the Fifth Cyber Security and Information Intelligence Research Workshop, 2009

Keep your friends close: the necessity for updating an anomaly sensor with legitimate environment changes.
Proceedings of the 2nd ACM Workshop on Security and Artificial Intelligence, 2009

A Network Access Control Mechanism Based on Behavior Profiles.
Proceedings of the Twenty-Fifth Annual Computer Security Applications Conference, 2009

2008
A Survey of Insider Attack Detection Research.
Proceedings of the Insider Attack and Cyber Security - Beyond the Hacker, 2008

Casting out Demons: Sanitizing Training Data for Anomaly Sensors.
Proceedings of the 2008 IEEE Symposium on Security and Privacy (SP 2008), 2008

Return Value Predictability Profiles for Self-healing.
Proceedings of the Advances in Information and Computer Security, 2008

Behavior-Based Network Access Control: A Proof-of-Concept.
Proceedings of the Information Security, 11th International Conference, 2008

Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors.
Proceedings of the Twenty-Fourth Annual Computer Security Applications Conference, 2008

2007
Towards Stealthy Malware Detection.
Proceedings of the Malware Detection, 2007

Segmentation and Automated Social Hierarchy Detection through Email Network Analysis.
Proceedings of the Advances in Web Mining and Web Usage Analysis, 2007

A Study of Malcode-Bearing Documents.
Proceedings of the Detection of Intrusions and Malware, 2007

On the infeasibility of modeling polymorphic shellcode.
Proceedings of the 2007 ACM Conference on Computer and Communications Security, 2007

2006
Behavior-based modeling and its application to Email analysis.
ACM Trans. Internet Techn., 2006

Verifying genre-based clustering approach to content extraction.
Proceedings of the 15th international conference on World Wide Web, 2006

Privacy-preserving payload-based correlation for accurate malicious traffic detection.
Proceedings of the 2006 SIGCOMM Workshop on Large-Scale Attack Defense, 2006

Anagram: A Content Anomaly Detector Resistant to Mimicry Attack.
Proceedings of the Recent Advances in Intrusion Detection, 9th International Symposium, 2006

A temporal based forensic analysis of electronic communication.
Proceedings of the 7th Annual International Conference on Digital Government Research, 2006

Intrusion and anomaly detection model exchange for mobile ad-hoc networks.
Proceedings of the 3rd IEEE Consumer Communications and Networking Conference, 2006

2005
A comparative evaluation of two algorithms for Windows Registry Anomaly Detection.
J. Comput. Secur., 2005

Extracting context to improve accuracy for HTML content extraction.
Proceedings of the 14th international conference on World Wide Web, 2005

Anomalous Payload-Based Worm Detection and Signature Generation.
Proceedings of the Recent Advances in Intrusion Detection, 8th International Symposium, 2005

FLIPS: Hybrid Adaptive Intrusion Prevention.
Proceedings of the Recent Advances in Intrusion Detection, 8th International Symposium, 2005

Combining email models for false positive reduction.
Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2005

An Email Worm Vaccine Architecture.
Proceedings of the Information Security Practice and Experience, 2005

Anomaly Detection in Computer Security and an Application to File System Accesses.
Proceedings of the Foundations of Intelligent Systems, 15th International Symposium, 2005

Email mining toolkit supporting law enforcement forensic analyses.
Proceedings of the 2005 National Conference on Digital Government Research, 2005

2004
Using artificial anomalies to detect unknown and known network intrusions.
Knowl. Inf. Syst., 2004

Worm and Attack Early Warning.
IEEE Secur. Priv., 2004

Identifying spam without peeking at the contents.
ACM Crossroads, 2004

Email archive analysis through graphical visualization.
Proceedings of the 1st ACM Workshop on Visualization and Data Mining for Computer Security, 2004

Anomalous Payload-Based Network Intrusion Detection.
Proceedings of the Recent Advances in Intrusion Detection: 7th International Symposium, 2004

2003
A Behavior-Based Approach to Securing Email Systems.
Proceedings of the Computer Network Security, 2003

Behavior Profiling of Email.
Proceedings of the Intelligence and Security Informatics, First NSF/NIJ Symposium, 2003

EMT/MET: Systems for Modeling and Detecting Errant Email.
Proceedings of the 3rd DARPA Information Survivability Conference and Exposition (DISCEX-III 2003), 2003

Surveillance Detection in High Bandwidth Environments.
Proceedings of the 3rd DARPA Information Survivability Conference and Exposition (DISCEX-III 2003), 2003

Citizen's Attitudes about Privacy While Accessing Government and Private Websites: Results of an Online Study.
Proceedings of the 2003 Annual National Conference on Digital Government Research, 2003

A holistic approach to service survivability.
Proceedings of the 2003 ACM Workshop on Survivable and Self-Regenerative Systems, 2003

2002
Toward Cost-Sensitive Modeling for Intrusion Detection and Response.
J. Comput. Secur., 2002

A Framework for Scalable Cost-sensitive Learning Based on Combing Probabilities and Benefits.
Proceedings of the Second SIAM International Conference on Data Mining, 2002

Ensemble-based Adaptive Intrusion Detection.
Proceedings of the Second SIAM International Conference on Data Mining, 2002

Detecting Malicious Software by Monitoring Anomalous Windows Registry Accesses.
Proceedings of the Recent Advances in Intrusion Detection, 5th International Symposium, 2002

Progressive Modeling.
Proceedings of the 2002 IEEE International Conference on Data Mining (ICDM 2002), 2002

A Fully Distributed Framework for Cost-Sensitive Data Mining.
Proceedings of the 22nd International Conference on Distributed Computing Systems (ICDCS'02), 2002

Towards the Digital Government of the 21st Century.
Proceedings of the 2002 Annual National Conference on Digital Government Research, 2002

Adaptive Model Generation.
Proceedings of the Applications of Data Mining in Computer Security, 2002

A Geometric Framework for Unsupervised Anomaly Detection.
Proceedings of the Applications of Data Mining in Computer Security, 2002

2001
Data Mining-based Intrusion Detectors: An Overview of the Columbia IDS Project.
SIGMOD Rec., 2001

Cost Complexity-Based Pruning of Ensemble Classifiers.
Knowl. Inf. Syst., 2001

MEF: Malicious Email Filter - A UNIX Mail Filter That Detects Malicious Windows Executables.
Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, 2001

Data Mining Methods for Detection of New Malicious Executables.
Proceedings of the 2001 IEEE Symposium on Security and Privacy, 2001

2000
A framework for constructing features and models for intrusion detection systems.
ACM Trans. Inf. Syst. Secur., 2000

Adaptive Intrusion Detection: A Data Mining Approach.
Artif. Intell. Rev., 2000

A Data Mining and CIDF Based Approach for Detecting Novel and Distributed Intrusions.
Proceedings of the Recent Advances in Intrusion Detection, Third International Workshop, 2000

A Multiple Model Cost-Sensitive Approach for Intrusion Detection.
Proceedings of the Machine Learning: ECML 2000, 11th European Conference on Machine Learning, Barcelona, Catalonia, Spain, May 31, 2000

Towards the digital government of the 21<sup>st</sup> century: a report from the workshop on research and development opportunities in federal information services.
Proceedings of the 2000 National Conference on Digital Government Research, 2000

1999
Guest Editors' Introduction.
Mach. Learn., 1999

Distributed data mining in credit card fraud detection.
IEEE Intell. Syst., 1999

A Data Mining Framework for Building Intrusion Detection Models.
Proceedings of the 1999 IEEE Symposium on Security and Privacy, 1999

Combining Knowledge Discovery and Knowledge Engineering to Build IDSs.
Proceedings of the Recent Advances in Intrusion Detection, Second International Workshop, 1999

Mining in a Data-Flow Environment: Experience in Network Intrusion Detection.
Proceedings of the Fifth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 1999

The Application of AdaBoost for Distributed, Scalable and On-Line Learning.
Proceedings of the Fifth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 1999

Automated Intrusion Detection Using NFR: Methods and Experiences.
Proceedings of the Workshop on Intrusion Detection and Network Monitoring, 1999

AdaCost: Misclassification Cost-Sensitive Boosting.
Proceedings of the Sixteenth International Conference on Machine Learning (ICML 1999), Bled, Slovenia, June 27, 1999

Minimal Cost Complexity Pruning of Meta-Classifiers.
Proceedings of the Sixteenth National Conference on Artificial Intelligence and Eleventh Conference on Innovative Applications of Artificial Intelligence, 1999

1998
KDD Cup 1999 Data.
Dataset, December, 1998

Database Research at Columbia University.
SIGMOD Rec., 1998

Real-world Data is Dirty: Data Cleansing and The Merge/Purge Problem.
Data Min. Knowl. Discov., 1998

A Digital Government for the 21st Century.
Commun. ACM, 1998

AI Approaches to Fraud Detection and Risk Management.
AI Mag., 1998

Data Mining Approaches for Intrusion Detection.
Proceedings of the 7th USENIX Security Symposium, 1998

Mining Databases with Different Schemas: Integrating Incompatible Classifiers.
Proceedings of the Fourth International Conference on Knowledge Discovery and Data Mining (KDD-98), 1998

Mining Audit Data to Build Intrusion Detection Models.
Proceedings of the Fourth International Conference on Knowledge Discovery and Data Mining (KDD-98), 1998

Toward Scalable Learning with Non-Uniform Class and Cost Distributions: A Case Study in Credit Card Fraud Detection.
Proceedings of the Fourth International Conference on Knowledge Discovery and Data Mining (KDD-98), 1998

1997
On the Accuracy of Meta-Learning for Scalable Data Mining.
J. Intell. Inf. Syst., 1997

JAM: Java Agents for Meta-Learning over Distributed Databases.
Proceedings of the Third International Conference on Knowledge Discovery and Data Mining (KDD-97), 1997

1996
Sharing Learned Models among Remote Database Partitions by Local Meta-Learning.
Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD-96), 1996

1995
The Merge/Purge Problem for Large Databases.
Proceedings of the 1995 ACM SIGMOD International Conference on Management of Data, 1995

Learning Arbiter and Combiner Trees from Partitioned Data for Scaling Machine Learning.
Proceedings of the First International Conference on Knowledge Discovery and Data Mining (KDD-95), 1995

A coding approach to event correlation.
Proceedings of the Integrated Network Management IV, 1995

A Comparative Evaluation of Voting and Meta-learning on Partitioned Data.
Proceedings of the Machine Learning, 1995

1994
Scalable Parallel and Distributed Expert Database Systems with Predictive Load Balancing.
J. Parallel Distributed Comput., 1994

Predictive Dynamic Load Balancing of Parallel and Distributed Rule and Query Processing.
Proceedings of the 1994 ACM SIGMOD International Conference on Management of Data, 1994

Performance of Incremental Update in Database Rule Processing.
Proceedings of the Fourth International Workshop on Research Issues in Data Engineering: Active Database Systems, 1994

Meta-level Control of Rule Execution in a Parallel and Distributed Expert Database System.
Proceedings of the Fourth International Workshop on Research Issues in Data Engineering: Active Database Systems, 1994

Predictive Dynamic Load Balancing of Parallel Hash-Joins Over Heterogeneous Processors in the Presence of Data Skew.
Proceedings of the Third International Conference on Parallel and Distributed Information Systems (PDIS 94), 1994

1993
Report on Workshop on High Performance Computing and Communications for Grand Challenge Applications: Computer Vision, Speech and Natural Language Processing, and Artificial Intelligence.
IEEE Trans. Knowl. Data Eng., 1993

Dynamic neighborhood bounding for Monte Carlo simulation.
Proceedings of the 25th Winter Simulation Conference, 1993

System Reorganization and Load Balancing of Parallel Database Rule Processing.
Proceedings of the Methodologies for Intelligent Systems, 7th International Symposium, 1993

Toward Multi-Strategy Parallel & Distributed Learning in Sequence Analysis.
Proceedings of the 1st International Conference on Intelligent Systems for Molecular Biology, 1993

Experiments on Multi-Strategy Learning by Meta-Learning.
Proceedings of the CIKM 93, 1993

1992
Incremental Database Rule Processing In PARADISER.
J. Intell. Inf. Syst., 1992

Is Production System Match Interesting?
Proceedings of the Fourth International Conference on Tools with Artificial Intelligence, 1992

1991
PARULE: Parallel Rule Processing Using Meta-rules for Redaction.
J. Parallel Distributed Comput., 1991

Incremental Evaluation of Rules and its Relationship to Parallelism.
Proceedings of the 1991 ACM SIGMOD International Conference on Management of Data, 1991

The PARULEL Parallel Rule Language.
Proceedings of the International Conference on Parallel Processing, 1991

1989
Speech Recognition in Parallel.
Proceedings of the Speech and Natural Language: Proceedings of a Workshop Held at Cape Cod, 1989

1987
Initial Performance of the DADO2 Prototype.
Computer, 1987

1986
The DADO Production System Machine.
J. Parallel Distributed Comput., 1986

The Do-loop Considered Harmful in Production System Programming.
Proceedings of the Expert Database Systems, 1986

1985
Towards the Parallel Execution of Rules in Production System Programs.
Proceedings of the International Conference on Parallel Processing, 1985

1984
Logic Programming Using Parallel Associative Operations.
Proceedings of the 1984 International Symposium on Logic Programming, 1984

LPS Algorithms.
Proceedings of the International Conference on Fifth Generation Computer Systems, 1984

Five Parallel Algorithms for Production System Execution on the DADO Machine.
Proceedings of the National Conference on Artificial Intelligence. Austin, 1984

1983
ACE: An Expert System for Telephone Cable Maintenance.
Proceedings of the 8th International Joint Conference on Artificial Intelligence. Karlsruhe, 1983

Architecture and Applications of DADO: A Large-Scale Parallel Computer for Artificial Intelligence.
Proceedings of the 8th International Joint Conference on Artificial Intelligence. Karlsruhe, 1983

1982
DADO: A Tree-Structured Machine Architecture for Production Systems.
Proceedings of the National Conference on Artificial Intelligence, 1982

1981
The NON-VON Database Machine: A Brief Overview.
IEEE Database Eng. Bull., 1981

1979
Automatic Discovery of Heuristics for Nondeterministic Programs from Sample Execution Traces.
PhD thesis, 1979

Automatic Discovery of Heuristics for Nondeterministic Programs.
Proceedings of the Sixth International Joint Conference on Artificial Intelligence, 1979


  Loading...