S3 Lab - Software & Systems Security Laboratory
CLUE logo

CLUE

The CLUE project develops an infrastructure to detect and diagnose system anomalies in enterprise systems. These anomalies include stealthy malware and other types of hidden system anomalies. CLUE provides a diverse set of tools to find and understand such anomalies with minimal disruption to the target system.

Recent News

Available Work

  • FMS: an enterprise analysis tool to find outdated programs and computers (paper) 
  • PDNS: a malware detection agent based on program DNS behaviors (paper)
  • TBQL: a domain-specific language for system-behavioral queries (stream-processing paper, progressive-processing paper)
  • IntroSec: a low-overhead security audit logging tool for Windows (paper) 
  • PerfGuard: a binary instrumentation tool for self-triggered performance diagnosis (paper)
  • IntroPerf: a performance diagnosis tool using system event logs (paper)

people

Chung Hwan Kim
Chung Hwan Kim
Faculty
Junghwan (John) Rhee
Junghwan (John) Rhee
External collaborator

publications

2021
Find My Sloths: Automated Comparative Analysis of How Real Enterprise Computers Keep Up with the Software Update Races
Omid Setayeshfar, Junghwan (John) Rhee, Chung Hwan Kim, and Kyu Hyung Lee
In DIMVA 2021 [ pdf :: slides :: bibtex ]
2020
Detecting Malware Injection with Program-DNS Behavior
Yixin Sun, Kangkook Jee, Suphannee Sivakorn, Zhichun Li, Cristian Lumezanu, Lauri Korts-Pàˆrn, Zhenyu Wu, Junghwan (John) Rhee, Chung Hwan Kim, Mung Chiang, and Prateek Mittal
In EuroS&P 2020 [ pdf :: bibtex ]
2019
Progressive Processing of System Behavioral Query
Jiaping Gui, Xusheng Xiao, Ding Li, Chung Hwan Kim, and Haifeng Chen
In ACSAC 2019 [ pdf :: slides :: bibtex ]
2018
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
Peng Gao, Xusheng Xiao, Ding Li, Zhichun Li, Kangkook Jee, Zhenyu Wu, Chung Hwan Kim, Sanjeev R. Kulkarni, and Prateek Mittal
In Security 2018 (award paper) [ pdf :: slides :: bibtex ]
2016
PerfGuard: Binary-Centric Application Performance Monitoring in Production Environments
Chung Hwan Kim, Junghwan (John) Rhee, Kyu Hyung Lee, Xiangyu Zhang, and Dongyan Xu
In FSE 2016 [ pdf :: slides :: bibtex ]
2015
Accurate, Low Cost and Instrumentation-Free Security Audit Logging for Windows
Shiqing Ma, Kyu Hyung Lee, Chung Hwan Kim, Junghwan (John) Rhee, Xiangyu Zhang, and Dongyan Xu
In ACSAC 2015 [ pdf :: slides :: bibtex ]
2014
IntroPerf: Transparent Context-Sensitive Multi-Layer Performance Inference using System Stack Traces
Chung Hwan Kim, Junghwan (John) Rhee, Hui Zhang, Nipun Arora, Guofei Jiang, Xiangyu Zhang, and Dongyan Xu
In SIGMETRICS 2014 [ pdf :: slides :: bibtex ]