Martim Carbone's Research Projects and Interests

Brief Research and Academic Biography

I started my undergraduate course in Computer Science in Feb. 2000 and finished it in Jan. 2004 at the Institute of Computing, a research/teaching unit of the State University of Campi nas (UNICAMP). I have been involved in Information Security research since my third year as an undergraduate student at UNICAMP, at which time I worked with Professor Paulo Lício de Geus at the Systems Security and Administration Laboratory (LAS). During my fourth undergraduate year I worked on a scientific initiation research project and many other non-research security-related activities such as secure system administration and forensic analysis. After finishing my undergraduate course in 2004 I started a Master's in computer science, also at the Institute of Computing and also under the supervision of Professor Paulo Lício. I completed my Master's in June 2006.

After six and a half years at UNICAMP, I left my home country of Brazil in Aug. 2006 and moved to Atlanta, to start the Ph.D program in Computer Science at Georgia Tech.

Research Interests

My research interests are mostly concentrated in solving system's security problems related to intrusion detection, intrusion tolerance, digital forensics and incident response at the host/operating system level. I find particularly interesting the task o f automating security mechanism belonging to the categories mentioned before, so as to create autonomous, adaptable, real-time security systems. As a corollary, I am also interested in OS design and implementation, particularly the Linux kernel.

Research Projects

Currently I am a member of the College of Computing's Information Security Lab, a part of GTISC (Georgia Tech Information Security Center). I am working as a research assistant with professor Wenke Lee on techniqu es for leveraging the Xen hypervisor for security purposes, such as auditing and intrusion detection through safe (isolated) introspection/interposition. My part research projects are listed below:

Kernel Framework for an Immunological Security System (01/2004 - 06/2006): Master's project, sponsored by a CNPq Master's fellowship, which aimed to develop a kernel framework to accomodate an immunological security system. This framewor k was successfully implemented, and provided kernel-level capabilities for prevention, detection and response mechanisms, that can be used by a variety of security tools. The focus was the development of a new hook architecture built on top of the LSM fra mework, that allowed for dynamic, real-time exchange of information between kernel and userspace with dynamic code injection capabilities, providing great flexibility and control for userspace security applications.

HECK - Honeypots Automatic Evidence Collection (11/2002 - 11/2003): Scientific initiation research project, sponsored by a FAPESP fellowship, which aimed to study evidence collection in high-interaction honeypots. The project resulted in HECK (Honeypot Evidence Collection Kit), a tool based on Sebek that was able to perform automatic and covert filesystem evidence collection from honeypots and automatic reconstruction of the intrusion evidence tree.