{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/129924"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/129924","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Designing practical security systems via information flow analysis of log data","abstract":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2025-10-20 without embargo terms","abstract_html":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2025-10-20 without embargo terms","abstract_has_math":false,"creators":["Liu, Jason"],"institution":"University of Illinois Urbana-Champaign","degree_name":"Ph.D.","degree_level":"Dissertation","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Bates, Adam","Wang, Gang","Xu, Tianyin","Traynor, Patrick"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2025,"date_issued":"2025-07-08","date_published":"2025-07-08","updated_at":"2026-07-22T22:25:06Z","subjects":["Cybersecurity","Information Flow","Data Provenance"],"languages":["en","eng"],"rights":["Copyright 2025 Jason Liu"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/2142/129924","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Bates, Adam","Wang, Gang","Xu, Tianyin","Traynor, Patrick"]},{"key":"dc:creator","label":"Author","values":["Liu, Jason"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2025-07-08","2025-08"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Ph.D."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Cybersecurity","Information Flow","Data Provenance"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en","eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2025 Jason Liu"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://hdl.handle.net/2142/129924"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2025-10-20 without embargo terms","The student, Jason Liu, accepted the attached license on 2025-07-08 at 13:44.","The student, Jason Liu, submitted this Dissertation for approval on 2025-07-08 at 13:48.","This Dissertation was approved for publication on 2025-07-08 at 16:01.","DSpace SAF Submission Ingestion Package generated from Vireo submission #22440 on 2025-10-20 at 20:15:05","Security systems must fundamentally distinguish permissible behaviors from insecure, forbidden behaviors. At a system-wide level, this is achieved by defining allowable relationships between system subjects, such as users or services, and objects, such as files or sockets. However, security policies benefit greatly from knowledge of application-specific behaviors. For example, applications may define their own subjects, such as users in a web server, that are not visible at the system level. Processes can become compromised due to exploits, allowing attackers to execute code for their own purposes instead of the original program. Attacks may even involve processes that appear to be running the correct program on behalf of the correct user, but are nonetheless undesirable, such as compromises from phishing or other methods of credential theft. Overall, while security is often thought of in terms of application-specific behavior, program logic is not explicitly visible at the system level. In this dissertation, we make the key observation that although program logic is not visible at the system level, it is implicitly expressed through the information and control flows through processes that are visible. Therefore, by analyzing these information and control flows, we can design more accurate security systems that account for program-specific behavior. We explore three systems designed to leverage these flows. We design T-difc, an access control system that can transparently define application-specific policies at the system level without any additional instrumentation of programs. Next, using information and control flow analysis, we measure the variation and relationships between benign and attack program activity to contextualize the performance of state-of-the-art intrusion detection systems and explain why intrusion detection is still unsolved, contrary to their excellent evaluation results. Finally, we refine attack investigations to remove noise by heuristically using behaviors found through information and control flow analysis to ignore irrelevant flows. Our work demonstrates that information and control flow analysis is a viable method to infer program logic for practical security systems."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Designing practical security systems via information flow analysis of log data"]}]}],"canonical_facts":{"dc:contributor":["Bates, Adam","Wang, Gang","Xu, Tianyin","Traynor, Patrick"],"dc:creator":["Liu, Jason"],"dc:date":["2025-07-08","2025-08"],"dc:description":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2025-10-20 without embargo terms","The student, Jason Liu, accepted the attached license on 2025-07-08 at 13:44.","The student, Jason Liu, submitted this Dissertation for approval on 2025-07-08 at 13:48.","This Dissertation was approved for publication on 2025-07-08 at 16:01.","DSpace SAF Submission Ingestion Package generated from Vireo submission #22440 on 2025-10-20 at 20:15:05","Security systems must fundamentally distinguish permissible behaviors from insecure, forbidden behaviors. At a system-wide level, this is achieved by defining allowable relationships between system subjects, such as users or services, and objects, such as files or sockets. However, security policies benefit greatly from knowledge of application-specific behaviors. For example, applications may define their own subjects, such as users in a web server, that are not visible at the system level. Processes can become compromised due to exploits, allowing attackers to execute code for their own purposes instead of the original program. Attacks may even involve processes that appear to be running the correct program on behalf of the correct user, but are nonetheless undesirable, such as compromises from phishing or other methods of credential theft. Overall, while security is often thought of in terms of application-specific behavior, program logic is not explicitly visible at the system level. In this dissertation, we make the key observation that although program logic is not visible at the system level, it is implicitly expressed through the information and control flows through processes that are visible. Therefore, by analyzing these information and control flows, we can design more accurate security systems that account for program-specific behavior. We explore three systems designed to leverage these flows. We design T-difc, an access control system that can transparently define application-specific policies at the system level without any additional instrumentation of programs. Next, using information and control flow analysis, we measure the variation and relationships between benign and attack program activity to contextualize the performance of state-of-the-art intrusion detection systems and explain why intrusion detection is still unsolved, contrary to their excellent evaluation results. Finally, we refine attack investigations to remove noise by heuristically using behaviors found through information and control flow analysis to ignore irrelevant flows. Our work demonstrates that information and control flow analysis is a viable method to infer program logic for practical security systems."],"dc:format":["application/pdf"],"dc:identifier":["https://hdl.handle.net/2142/129924"],"dc:language":["en","eng"],"dc:rights":["Copyright 2025 Jason Liu"],"dc:subject":["Cybersecurity","Information Flow","Data Provenance"],"dc:title":["Designing practical security systems via information flow analysis of log data"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Ph.D."],"thesis:institution_name":["University of Illinois Urbana-Champaign"]},"updated_at":"2026-07-22T22:25:06Z"}