Biography
I am currently a third-year Ph.D. candidate advised by Professor Nick Nikiforakis at the PragSec Lab in Stony Brook University. I investigate (the lack of) web integrity in various contexts (e.g., domain names and JavaScript) through large-scale experiments, and subsequently design and evaluate defenses that improve the integrity of the web.
Interests
- Web Security
- Distributed Systems
- Network Security
- Algorithms
Education
PhD in Computer Science, 2020 - Present
Stony Brook University
BSc in Computer Science, 2020
Stony Brook University
BSc in Applied Math and Statistics, 2020
Stony Brook University
Work
Research Assistant
Projects:
- Designing an application-agnostic link management system that prevents access to external dependencies of websites if such links violate customizable integrity policies
- Demonstrated that strict integrity verification of scripts cannot protect the web and provided insight for future methods through a large-scale, data-driven analysis (Things Change)
- Profiled the behavior of bots that monitor Certificate Transparency logs, analyzing how bots of various intentions and origins react to new certificates within seconds (Uninvited Guests)
- Illustrated the capability of adversaries to potentially affect millions of IP addresses in tens of thousands of autonomous systems by re-registering a few hundred domains (Domains Change)
- Proposed and evaluated deceptive web authentication mechanisms that remove the integrity of a web application from the attacker’s arsenal, and instead place the lack of it in the defender’s arsenal (Click This, Not That)
Software Engineering Intern
Analyzing API traffic to reduce attack surface, detect malicious bot activity, and identify anomalous server-side behavior
PhD Research Intern
Analyzing the integrity of Android applications through dynamic analysis (ongoing)
Software Development Engineer Intern
Created an intent recommendation service for third-party Alexa skills using short utterance text data
Software Engineer Intern
Built the prototype of a new state health exchange platform and established a preprocessing library used to build machine learning models
Teaching
WSE 380 Rotation: Honeypots and Intrusion Detection
WSE 380 Rotation: Honeypots and Intrusion Detection
CSE 331: Computer Security Fundamentals
CSE 214: Data Structures
Publications
Quickly discover relevant content by filtering publications.
(2023).
The More Things Change, the More They Stay the Same: Integrity of Modern JavaScript.
In Proceedings of the ACM Web Conference (WWW), 2023.
(2022).
Uninvited Guests: Analyzing the Identity and Behavior of Certificate Transparency Bots.
In Proceedings of the USENIX Security Symposium (USENIX Security), 2022.
(2021).
Domains Do Change Their Spots: Quantifying Potential Abuse of Residual Trust.
In Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), 2022.
(2021).
Click This, Not That: Extending Web Authentication with Deception.
In ACM Asia Conference on Computer and Communications Security (AsiaCCS), 2021.
Contact
- josso [at] cs [dot] stonybrook [dot] edu
- Computer Science Building, Engineering Dr, Stony Brook, NY 11794