Associate Professor researching computer security at the University of Illinois at Urbana-Champaign. All opinions are my own.

Joined July 2015
269 Photos and videos
Pinned Tweet
🚨CARBANAKv2 🚨EDR/XDR/Provenance dataset with dwell time, lateral movement, naturalistic background activity now available at bitbucket.org/sts-lab/carban… !! Try the @PrismNdss26 interactive tutorial colab notebook to explore the attack!

4
457
How can we reasonably expect AI researchers to read a canonical literature when they’re not expected to read (or write) their own papers?
New rule: if your insightful comment on AI was already in this super cool 1977 paper about "AI is becoming so powerful it will change the world as we know it," you lose. (1/10)
2
324
FYI threat detection/investigation community -- I was sleeping on this and know from @PrismNdss26 that some groups are redundantly developing this architecture r/n. Probably better to build on top of @Livermore_Lab's WinTap system: gdo-wintap.llnl.gov/
264
Adam Bates Yuile retweeted
497 ICML 2026 submissions got desk rejected because their authors served as a reviewer but violated the policy of the use of LLMs. #ICML2026
5
25
215
42,715
Sure is a lot of hoopla for a pico on a palmetto bug
šŸ‡©šŸ‡Ŗ JUST IN: Germany just unveiled real life ā€œcyborg insectsā€ built for the battlefield. Developed by SWARM Biotactics, the system fuses live insects with neural interfaces, AI, and onboard sensors, turning them into stealth micro recon units. Field tested within a year, these bio hybrids are quieter than drones, highly mobile, and capable of slipping into places machines can’t reach. The future of surveillance just got smaller.
1
265
ā€œThe PIDS Research Workflow is Painfulā€ I feel so seen! 😭 Tristan Bilot presenting PIDSMaker at @PrismNdss26
3
216
Woohoo! The inaugural @PrismNdss26 is underway.
1
4
652
If you want to drop in on @PrismNdss26 today we’re off the beaten path — by the deli just past the Ruth’s Chris’s’s’s steakhouse! šŸ˜‚
132
At @NDSSSymposium for the Monday workshops? I *can’t tell you* how excited I am for the inaugural @PrismNdss26. I’ve asked my poor students to engage in a lot of (largely thankless) work developing community resources the past few years. We’re bringing it all to PRISM. 🧵
1
4
256
This work joins a ton of other amazing talks about sophisticated threat analysis and how to conduct applied and rigorous research in the area. Tutorials on on push-button PIDS evaluations, threat intelligence extraction, and development of new attack engagements. 🧵
1
1
70
TL;DR -- @PrismNdss26 is basically a gift-wrapped starter kit for conducting effective systems research on real-world security operations, an area that frankly needs more attention and talent. Join us!
1
1
135
Excited to share that our lightning fast EDR alert triage system, Carbon Filter, has been (conditionally) accepted to appear at #RAID2025!
1
11
730
We demonstrate comparable alert triage rates to costly provenance analysis -- 84% global reduction in false alerts -- by examining an alert-triggering process' *instantaneous* context. By foregoing provenance, we are able to process thousands of alerts per sec.
1
3
191
Congrats to our student author @MuhammadAdilIn1 and collaborators at Broadcom Carbon Black. Preprint available here: arxiv.org/pdf/2405.04691

3
179
Don’t know where you’re sitting but Stefan complimented our research agenda. ; ) #JustSaying #ieeesp25 @IEEESSP
5
730
IEEE S&P 2027 will take place in Montreal, Canada 🤯
1
2
28
4,023