I am an Assistant Professor at the Security Group of the Eindhoven University of Technology, in the Netherlands. Together with Luca Allodi, I lead the Security Operations and Cyber Threat Intelligence research lines of the group, and I contribute to its network monitoring research. My research focuses on security operations, network intrusion detection and cyber threat intelligence, with a long-standing interest in the security of Industrial Control Systems (ICS). I study how Security Operations Centers (SOCs) detect and investigate attacks, looking both at the human analysts who triage alerts and at the detection rules that generate them, and I collaborate with commercial SOCs, including the Eindhoven Security Hub SOC.
I was one of the three founders of the spin-off SecurityMatters, with the goal of bringing to the market SilentDefense, a platform for network monitoring, asset inventory and network intrusion detection for Industrial Control Systems. At SecurityMatters I served as the CTO, and I was responsible for the company’s R&D.
PhD in Computer Science
2011
University of Twente
MSc in Computer Science
2005
Ca’ Foscari University of Venice
BSc in Computer Science
2002
Ca’ Foscari University of Venice
My research sits at the intersection of security operations, network intrusion detection and cyber threat intelligence, and is carried out in close collaboration with commercial Security Operations Centers (SOCs), including the Eindhoven Security Hub SOC.
Security operations. I study how SOCs detect and investigate attacks, focusing on the two components that most determine their effectiveness: the human analysts who investigate alerts, and the detection rules that generate those alerts. On the analyst side, I work on structured threat analysis processes and tooling that help Tier 1 analysts contextualize and correctly classify network security events, and on training approaches that prepare new analysts for operational work. On the detection side, I analyze how network intrusion detection rules are written, maintained and tuned in practice: from measuring rule noise over large real-world rulesets and deriving design principles for effective, low-noise rules (implemented in the open-source tool suricata-check), to studying the detection engineering process itself through measurement platforms such as SuriCap.
Cyber threat intelligence. I investigate the cybercriminal ecosystem as a source of threat intelligence. This work asks which underground communities matter for the threat landscape, what attackers actually buy once a criminal market works, and how researchers can discover and collect data from these communities at scale, across forums and Telegram. Economic theory, and in particular information asymmetry and signalling, provides a lens to explain why some criminal markets function and others do not. The ultimate goal is to turn these observations into intelligence that can inform security operations decisions.
Industrial Control System security. Building on my background as co-founder and CTO of SecurityMatters, I continue to work on the monitoring and protection of Operational Technology networks: characterizing real-world ICS and SCADA networks across critical infrastructures, designing network intrusion detection approaches tailored to industrial protocols and processes, analyzing ICS-specific malware, and studying ICS honeypots and the threat actors that target industrial environments, for example by fingerprinting the ICS tools that attackers use to interact with honeypots (ICtoolS).
In this paper, we characterize the rules in use at a collaborating commercial (managed) SOC serving customers in sectors including education and IT management. During this process, we discover six relevant design principles, which we consolidate through interviews with experienced rule designers at the SOC.We then …
We collaborate with a commercial SOC and employ two think-aloud experiments: the first evaluates the alert investigation process followed by professional T1 analysts, the second evaluates an alert investigation support system (AISS) integrated into the SOC environment. The AISS aids the analyst in gathering more …
In this work, we collaborate with a commercial SOC to develop an alert investigation support tool to help inexperienced analysts identify and collect all the information relevant to the investigation of an alert. We evaluate the prototype tool with two qualitative studies. Our findings suggest that employing the tool …
In this paper, we study two pieces of malware that attempted to create blackouts in Ukraine. Our findings include new malware behavior not previously documented (such as the detailed algorithm for the MMS protocol payload) and an illustration of how attacking different targets will produce different effects.
In this work we collaborate with a commercial SOC to devise a 4-stage (network) process to support the collection and analysis of relevant information for threat analysis. We conduct an experiment with ten T1 analysts employed in the SOC and show that analysts following the proposed process are 2.5 times more likely to …
In this paper, we introduce a novel, PLC-compatible control-flow integrity (CFI) mechanism named ECFI to protect such devices from control-flow hijacking attacks. Our CFI approach is the first system for real-time PLCs and considers the runtime operation of the PLC as the highest priority.
This paper discusses a novel approach to specification-based intrusion detection in the field of networked control systems. Our approach reduces the substantial human effort required to deploy a specification-based intrusion detection system by automating the development of its specification rules.
Off-the-shelf intrusion detection systems prove an ill fit for protecting industrial control systems. Specifically, current systems fail to detect recent process control attacks. In this work we present a detector that continuously tracks updates to corresponding process variables to then derive variable-specific …
In this paper we investigate and test the actual effectiveness of emulation-based detection and show that the detection can be circumvented by employing a wide range of evasion techniques, exploiting weakness that are present at all three levels in the detection process. We draw the conclusion that current …
In this paper we investigate the effectiveness of a widely studied category of network intrusion detection systems: anomaly-based algorithms using n-gram analysis for payload inspection. Our tests show that the analyzed systems, in presence of data with high variability, cannot deliver high detection and low false …
The goal of this course is to provide students with a platform to get in-depth, hands-on experience on all three of the building blocks of cyber security monitoring: network-based, host-based and log-based intrusion detection.
To do so, the course adopts a reverse classroom setup: the course starts by providing students with material covering practical and theoretical elements of security monitoring and additional material and pointers covering all three pillars, and their relationship. The students then form groups, and are able to choose one of the building blocks to explore in depth by developing a fully-fledged laboratory activity for the other students of the course to attend. The lab activities require the analysis of realistic threat scenarios and systems, with the goal of developing effective detection techniques accounting for the specificities of the proposed scenario.
The lab activities are run and coordinated, in class, by the very students that developed them. The development and delivery of these lab sessions in class is also the final examination of the course for the group of students handling it.
Download the syllabus.
For details contact me.
Detect Fraudulent Activities in dark web and clear web to protect your business
Eindhoven University of Technology
MetaForum (MF) building, 6th floor, office 6.067
P.O. Box 513
5600 MB Eindhoven
The Netherlands
Tuesday 10:00 to 17:00
Thursday 10:00 to 17:00
