Nina Taft Intel Research Berkeley
2150 Shattuck Ave, Suite 1300
Berkeley, CA 94704-1347 USA
T +1-510-495-3082
F +1-510-495-3049
nina.taft@intel.com
Biography
Nina Taft is a senior research scientist at Intel Research Berkeley. Nina is interested in making the Internet a safer place, and thus works on security solutions both at the networking level and for end-hosts, such as laptops and desktops. She is interested in improving security through the smart use of measurement and inference technologies. In addition, she has worked in the areas of end-host profiling for reliability purposes, the application of diversity paradigms to security solutions, protection against data poisoning, overlay networks, and energy-aware proxies to reduce laptop energy consumption. Prior to joining Intel, Nina worked at Sprint Labs for 5 years. There, she worked on ISP traffic engineering problems such as traffic matrix estimation, routing, backbone traffic characterization and capacity planning. Prior to Sprint, she worked at SRI International in Menlo Park, CA, and conducted research on congestion control and QoS routing. Nina received her PhD from UC Berkeley.Research
I work on the PROTEUS project that aims to provide protection from botnets by tackling the problem from two vantage points: the end user and the centralized enterprise network control center. Some of the solutions we are developing are intended to live on laptops and desktops; while other solutions are targeted to help IT departments manage network security more effectively within their enterprise. PROTEUS' general approach to botnet mitigation is based upon collecting lots of data about the user and the network, and building underlying models of normal behavior from this data. Our approach often relies on the application of data mining techniques to detect anomalous activities.
- For end-host solutions, we build rich, user specific, location dependent behavioral profiles. These are composed by collecting a variety of data including network traffic patterns, location context, web browsing habits, user presence indicators, to name a few. Our behavioral-based detectors can successfully uncover covert botnet communication (when a PC communicates with the attack command and control center), and can identify attack activity in progress. A big focus in PROTEUS is that of reducing the number of false alarms that are generated, which are the bane of existing mitigation mechanisms in prevalence today.
- For enterprise IT solutions, we are designing techniques that can rapidly differentiate a piece of malware as truly new (never seen before) from those malwares that are polymorphic variants of existing malware. Because IT departments can observe a few thousands of new malwares each day, this greatly helps human operators to sort out which malware requires manual inspection and which ones don't. A tool based on our malware classifier thus speeds up the productivity and effectiveness that IT security operators can provide to their enterprises.
There are various barriers to adoption for the use of data mining techniques in the field of security. I work with many colleagues to tackle some of these problems. For example, our research addresses questions such as:
- 1) How can we protect anomaly detection algorithms from data poisoning? A key challenge in designing data driven mechanisms is protecting against adversaries that can inject erroneous data into the measurement infrastructure, which leads to an inaccurate estimation of the normal behavior. If an algorithm learns the wrong model, the corresponding detector will behave poorly. To provide protection from data poisoning, we design algorithms that draw on methods from robust statistics to guard against such adversaries.
- 2) How can we reduce the amount of data needed by anomaly detectors to make them more scalable? Some data mining algorithms collect 'too much' data to do their job; that is, too much either in terms of the bandwidth wasted moving the data around, or in terms of excessive computation time. We are researching methods to achieve data reduction for anomaly detection methods that allow downsizing of the data collected without sacrificing the detection capabilities. We have focused on PCA-based techniques and spectral clustering ones.
- 3) How can we mine user data for botnet protection without violating a user's privacy? We are studying privacy-preserving anomaly detection methods and evaluating the tradeoffs between privacy protection and detection accuracy.
Service
Executive Committees, Editorial
- ACM SIGCOMM PC co-chair 2007
- Internet Measurement Conference - Steering Committee; 2005 - 2008.
- Associate Editor for IEEE/ACM Transactions on Networking 2004-2007.
- IEEE ICNP 2005 - Tutorial Co-Chair
- First Internet Traffic Matrices Workshop 2003 - Steering Committee
- IEEE Infocom 2000 - Financial Chair
Program Committees
- ACM SIGCOMM 2009
- Sigcomm Workshop on Enterprise Networks (WREN) 2009
- 2nd International Workshop on Green Communications at Globecom 2009
- ACM SIGCOMM 2008
- Asian Internet Engineering Conference (AINTEC) 2008
- Hot Topics in Networks (Hot Nets) 2007
- ACM CoNeXt 2006
- ACM Sigmetrics 2006
- Passive and Active Measurement Conference (PAM) 2006
- ICNP Workshop on Secure Network Protocols (NPSec) 2005
- ACM Sigcomm 2004
- IEEE Infocom 2004
- ACM International Measurement Conference (IMC) 2003
- ACM Sigmetrics 2003
- IEEE Infocom 2002
- Hot Interconnects 2002
- IEEE Infocom 2001
- Hot Interconnects 2001
- IEEE International Workshop on Quality-of-Service (IWQoS) 1999
- IFIP Multimedia 1999