Ph.D. May 2005
Computer Science, Columbia University, New York
Advisor: Alfred V. Aho
Thesis: "Defending Software Against Process-Subversion Attacks"
M.Phil. January 2003
Computer Science, Columbia University, New York
M.S. January 2001
Computer Science, Columbia University, New York
B.Eng. October 1999
Department of Computing, Imperial College, London
Personal Tutor: Susan Eisenbach
Undergraduate thesis: "Java: An Operational Semantics"
Research Interests
Security of software systems, Compilers, Program execution environments, Programming language implementations
Honors and Awards
ACM Travel Support Grant October 2003
10th ACM Conference on Computer and Communications Security
Extraordinary Teaching Assistant Award May 2003
for CS4115: Programming Languages and Translators Fall 2002. TA for Professor Alfred V. Aho
The Fu Foundation School of Engineering and Applied Science, Columbia University
Ph.D. Award for Excellence in TA'ing May 2002
for CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross
Computer Science Department, Columbia University
Extraordinary Teaching Assistant Award May 2002
for CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross
The Fu Foundation School of Engineering and Applied Science, Columbia University
Graduate Research Assistantship September 1999 - May 2005
Computer Science, Columbia University, New York
Associateship of the City and Guilds of London Institute October 1999
Award for Best Undergraduate group project January 1999
British Telecom, London
Merit-based College Scholarship and Stipend October 1996 - June 1999
Department for International Development, The British Council
Professional Activities
(IEEE S&P '06) External referee for the 2006 IEEE Symposium on Security and Privacy
(ICDCS '06) Reviewer for the 26th International Conference on Distributed Computing Systems
(NDSS '06) Reviewer for the 13th Annual Network and Distributed Security Symposium
(Security '05) External referee for the 14th USENIX Security Symposium
(ICDCS '05) Reviewer for the 25th International Conference on Distributed Computing Systems
(Security '04) External referee for the 13th USENIX Security Symposium
(NDSS '04) External referee for the 11th Annual Network and Distributed Security Symposium
Research Experience
Security of Software Systems September 2002 - May 2005
Professor Alfred V. Aho
Computer Science, Columbia University
Investigating various compiler- and kernel-based strategies to increase the resiliency of (open-source) software against malicious attacks, e.g., by Internet crackers or worms:
(Spring 2005 - May 2005) by defining a general-use framework for evaluating the efficacy of defence techniques at thwarting a variety of attacks.
(Fall 2003 - May 2005) use a kernel-based approach with libc support for continually monitoring all system-call requests issued by running programs. Malicious activity can be inferred from suspect and illegal invocations of system calls or functions in libc.
(Spring 2003) by reordering/encoding of bits within (blocks of) machine instructions in the executable sections of program binaries. A "modified" processor would then continually restore and decode/execute these instructions on the fly. This ensures that any attempt to execute injected code would result in the "restoration" of the (injected) valid machine code into a harmless code sequence that would fail to execute in the manner intended by the attacker.
(Fall 2002) by introducing variations in the binary signatures of executables and the memory layout of running processes (e.g., randomized sizes for activation records, and obfuscation of functions' return addresses during their execution)
Evaluating the Security and Privacy Considerations of Machine Readable Travel Documents July 2004 - September 2004
Elaine R. Palmer, JR Rao, Paul A. Karger
(Summer Internship) Internet Security Group, IBM Research
Analysed the security and privacy issues with the International Civil Aviation Organisation's (ICAO) specifications for the use of biometrics-enabled Machine Readable Travel Documents (MRTD). Determined how flaws in the current specifications can be exploited to create passport forgeries that can be used to foil electronic and biometric checks at border posts.
Covert Channel Analysis for a High-Assurance Operating System May 2004 - June 2004
Elaine R. Palmer, JR Rao, Paul A. Karger
(Summer Internship) Internet Security Group, IBM Research
Surveyed the field of covert channel analysis techniques to determine an approach suitable for a high-assurance operating system running on a smartcard microprocessor. Collaborated with static-analysis experts to create a proof-of-concept analysis system to detect potential covert channels in the operating system code.
Retargeting the GNU C Compiler to the Philips SmartXA embedded processor May 2003 - August 2003
Elaine R. Palmer, JR Rao, David C. Toll
(Summer Internship) Internet Security Group, IBM Research
Involved with porting the GNU Compiler Collection's C compiler to the Philips SmartXA-2 smartcard microprocessor. This optimising compiler will be used for the high-assurance, secure operating system being developed by the Internet Security Group, IBM.
Survivor-NG: Survivable Middleware July 2001 - April 2002
Professor Gail E. Kaiser
Computer Science, Columbia University
Extended an existing distributed workflow system by adding the ability to continue to completion even when faced with partial failure of various subcomponents. Adding survivability/dependability to the MLS Workflow System from NRL required the study of the internal process flow of the system, and replacing it with a Worklets-based alternative that had the ability to detect failure of nodes. Our enhancement then appropriately resumed execution, when possible, using previously logged and replicated states of the workflow using replacement nodes that could handle the failed sub-tasks.
Worklets: A Mobile Agent System June 2000 - December 2002
Professor Gail E. Kaiser
Computer Science, Columbia University
Implemented a mobile code system in the Java programming language. This was an application-level infrastructure in the sense that a mobile agent saves only application-level data and not its thread-state (which would have required major changes to the JVM, disallowing us from distributing our system without Sun's permission) when transporting itself to a different node on the network. I also supervised 4 projects based on Worklets for M.S. students.
Data Structures in Functional Languages September 1999 - May 2000
Professor Chris D. Okasaki
Computer Science, Columbia University
Experimented with implementations of advanced data structures like Patricia Tries, Lazy Binomial Heaps for functional languages, in addition to developing an implementation for (more) efficient array operations in a persistent setting.
Extension of an Operational Semantics for Java January 1999 - June 1999
Professors Sophia C. Drossopoulou, Susan Eisenbach
Department of Computing, Imperial College
Extended the operational semantics for Java by adding formal definitions and semantic rules for access modifiers and constructors. This was based on continuing work by Drossopoulou and Eisenbach at Imperial College.
An Interpreter for an Operational Semantics for Java July 1998 - September 1998
Professors Krysia Broda, Sophia C. Drossopoulou, Susan Eisenbach
Department of Computing, Imperial College
Studied the operational semantics for a subset of Java as defined by Drossopoulou and Eisenbach, and implemented an interpreter in prolog based on this semantics definition. This research was carried out as an Undergraduate Research Opportunities Program (UROP) project.
Employment
Google Inc., California August 2005 - present
Software Engineer.
IBM T.J. Watson Research Labs, New York May 2004 - September 2004
Evaluated the specifications for the next-generation (electronic) passports, and determined security and privacy vulnerabilities that can facilitate forgery.
IBM T.J. Watson Research Labs, New York May 2003 - August 2003
Worked in the Internet Security Group to retarget the GNU C compiler to produce code for the Philips SmartXA-2 smartcard microprocessor.
Linkshare Corporations, New York July 2000 - August 2000
Designed and built software to simulate click-through on online advertisements maintained by Linkshare. The product mimics behavior of web users who click on banner ads and then purchase services and merchandise
NetDecisions Ltd., London June 1999 - August 1999
Conducted feasibility studies for building a web-based package holiday reservation system that interacted with the Online Reservation System used by the Thomson Holidays travel agents.
Publications
e-NeXSh: Achieving an Effectively Non-Executable Stack and Heap via System-Call Policing
Gaurav S. Kc, Angelos D. Keromytis
In Proceedings of the 21st Annual Computer Security Applications Conference, December 2005
Countering Code-Injection Attacks With Instruction-Set Randomization
Gaurav S. Kc, Angelos D. Keromytis, Vassilis Prevelakis
In Proceedings of the 10th ACM Conference on Computer and Communications Security, October 2003
An Approach to Autonomizing Legacy Systems
Gail Kaiser, Phil Gross, Gaurav Kc, Janak Parekh, Giuseppe Valetto
In Proceedings of the Workshop on Self-Healing, Adaptive and self-MANaged Systems, June 2002
An Active Events Model for System Monitoring
Philip N. Gross, Suhit Gupta, Gail E. Kaiser, Gaurav S. Kc, Janak J. Parekh
In Working Conference on Complex and Dynamic Systems Architecture, December 2001
A Mobile Agent Approach to Process-based Dynamic Adaptation of Complex Software Systems
Giuseppe Valetto, Gail Kaiser, and Gaurav S. Kc
In Proceedings of the 8th European Workshop on Software Process Technology, June 2001
Technical Papers
Dissertation: Defending Software Against Process-Subversion Attacks
Gaurav S. Kc
Ph.D. Dissertation. Columbia University, April 2005
Security and Privacy Issues in Machine Readable Travel Documents (MRTDs)
Gaurav S. Kc, Paul A. Karger
IBM Technical Report (RC 23575), IBM T. J. Watson Research Labs, April 2005
Thesis Proposal: How to Create Secure Runtime Environments for Software Gaurav S. Kc
Ph.D. Thesis Proposal, Columbia University, New York, December 2003
Caller-ID: Caller Validation as a Technique to Detect Process Compromise
Alfred V. Aho, Gaurav S. Kc
Technical Report, Department of Computer Science, Columbia University, November 2003
Survivor: An Approach for Adding Dependability to Legacy Workflow Systems
Jean-Denis Greze, Gail E. Kaiser, Gaurav S. Kc
Technical Report CUCS-026-02, Department of Computer Science, Columbia University, December 2002
CASPER: Compiler-Assisted Securing of Programs at Runtime
Gaurav S. Kc, Stephen A. Edwards, Gail E. Kaiser, Angelos D. Keromytis
Technical Report CUCS-025-02, Department of Computer Science, Columbia University, November 2002
Java: Semantics and Type Soundness
Gaurav S. Kc
Undergraduate Thesis, Imperial College, London, June 1999
Teaching Experience
CS6125: Web-enHanced Information Management Summer 2003. Course Manager for Columbia Video Network (CVN)
Graded students' research survey papers and web-based, software engineering projects.
CS4117: Compilers and Interpreters Spring 2003. TA for Professor Alfred V. Aho
Taught a class on Software Security, and use of compilation tools to enhance security. Supervised and graded compiler projects.
CS6125: Web-enHanced Information Management Spring 2003. TA for Professor Gail E. Kaiser
Graded students' research survey papers and web-based, software engineering projects.
CS4115: Programming Languages and Translators Fall 2002. TA for Professor Alfred V. Aho
Conducted tutorials on Lex and Yacc. Graded final exam, and supervised student projects.
CS4117: Compilers and Interpreters Spring 2002. TA for Professor Alfred V. Aho
Gave a tutorial on using Lex and Yacc to construct the front-end of a compiler.
CS4444: Programming and Problem Solving Fall 2001. TA for Professor Ken A. Ross
Designed and developed game simulators for each of the 5 projects. Also organized tournaments for the students' players.
CS4115: Programming Languages and Translators Spring 2000. TA for Professor Chris D. Okasaki
Graded assignments, midterm and finals.
Technical Experience
Operating Systems Red Hat Linux, Solaris, Windows XP