Prithvi Bisht

I'm a postdoc at UIC working with Professor V.N. Venkatakrishnan. Systems and Internet Security Laboratory Department of Computer Science University of Illinois, Chicago pbisht_remove this part_ @ _remove this part_ cs.uic.edu

You can find my CV here.

Education

• Ph.D. in Computer Science and Engineering, 2011, University of Illinois, Chicago
  Advisor - Professor V.N. Venkatakrishnan
• M. Tech. in Computer Science and Engineering, 2002, IIT Kanpur
  Advisor - Professor Rajat Moona
• B. E. in Computer Science and Engineering, 2000, GBPEC Pauri
  Advisor - Professor Man Mohan Singh Rauthan

Research Interests

• Learning and enforcing security properties through dynamic and static analysis of the source code
• Exploring string analysis based on symbolic evaluation to enforce security properties
• Code Injection Attacks : SQL Code Injection, Cross Site Scripting

Publications

Refereed Journals

• CANDID: Dynamic Candidate Evaluations for Automatic Prevention of SQL Injection Attacks [PDF] [BIBTEX]
  ACM Transactions on Information and System Security (TISSEC) Volume 13, Issue 2, February 2010
  with P. Madhusudan and V.N. Venkatakrishnan
  

Refereed Conferences

• SWIPE: Eager Erasure of Sensitive Data in Large Scale Systems Software
  To appear in 2nd ACM Conference on Data and Application Security and Privacy (CODASPY'2012)
  San Antonio, TX, USA, Feb 2012. [Acceptance rate: 21 out of 113 submissions, 18%].
  with Kalpana Gondi, Praveen Venkatachari, A. Prasad Sistla and V.N. Venkatakrishnan
  


• WAPTEC: Whitebox Analysis of Web Applications for Parameter Tampering Exploit Construction [DEMO + DATA] [PDF] [PPT] [BIBTEX]
  18th ACM Conference on Computer and Communications Security (CCS'2011)
  Chicago, IL, USA, Oct 2011. [Acceptance rate: 60 out of 429 submissions, 14%].
  with Timothy Hinrichs, Nazari Skrupsky, and V.N. Venkatakrishnan
  


• Strengthening XSRF Defenses for Legacy Web Applications Using Whitebox Analysis and Transformation [PDF] [BIBTEX]
  6th International Conference on Information Systems Security (ICISS'2010)
  Gandhinagar, Gujarat, India, Dec 2010 [Acceptance rate: 14 out of 51 submissions, 27%]
  with Michelle Zhou and V.N. Venkatakrishnan
  


• NoTamper: Automatic Blackbox Detection of Parameter Tampering Opportunities in Web Applications [DATA] [PDF] [PPT] [BIBTEX]
  17th ACM Conference on Computer and Communications Security (CCS'2010)
  Chicago, IL, USA, Oct 2010. [Acceptance rate: 55 out of 320 submissions, 17%].
  with Timothy Hinrichs, Nazari Skrupsky, Radoslaw Bobrowicz and V.N. Venkatakrishnan
  Chosen among the 10 nationwide finalists for the 2010 ATT Award for Best Applied Security Research paper.


• Automatically Preparing Safe SQL Queries [TAPS TOOL DEMO] [PDF] [PPT] [BIBTEX]
  14th Financial Cryptography and Data Security Conference (FC'2010) Springer LNCS link
  Canary Islands, Spain, Jan 25-28, 2010. [Acceptance rate: 19 out of 130 submissions, 14.6%]
  with A. Prasad Sistla and V.N. Venkatakrishnan
  
  • Poster paper in 17th ACM Conference on Computer and Communications Security (CCS'2010) [PDF]
    Chicago, IL, USA, Oct 2010. [Acceptance rate: 44 out of 69 submissions, 64%].
    


• XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks [PDF] [PPT] [BIBTEX]
  5th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA'2008) Springer LNCS link
  Paris, France, Jul 10-11, 2008. [Acceptance rate: 13 out of 42 submissions, 31%]
  with V.N. Venkatakrishnan
  


• CANDID: Preventing SQL Injection Attacks using Dynamic Candidate Evaluations [PDF] [BIBTEX] [VIDEO]
  14th ACM Conference on Computer and Communications Security (CCS'2007)
  Alexandria, Virginia, November 2007. [Acceptance rate: 55 out of 302 submissions, 18%].
  with Sruthi Bandhakavi, P. Madhusudan, and V.N. Venkatakrishnan

Refereed Workshops

• Analysis of Hypertext Markup Isolation Techniques for XSS Prevention [PDF] [BIBTEX]
  Web 2.0 Security and Privacy Workshop (W2SP)
  Oakland, California, May 22, 2008. [Acceptance rate: 14 out of 45 submissions, 31%]
  with Mike Ter Louw and V.N. Venkatakrishnan
  

Invited

• WebAppArmor: A Framework for Preventing Web-based Attacks.
  6th International Conference on Information Systems Security, Gandhinagar, Gujarat, India, December 2010.
  with V.N. Venkatakrishnan, Mike Ter-Louw, Michelle Zhou, Kalpana Gondi and K.T. Ganesh.
  

Book Chapters

• Formal Methods in Web Application Security
  In Encyclopedia of Cryptography and Security, 2nd Ed., 2011. (springer)
  Editors: Henk C.A. van Tilborg and Sushil Jajodia.
  with V.N. Venkatakrishnan.
  

Thesis

• Ph.D. Thesis Dissertation: Improving Web Security by Automated Extraction of Web Application Intent
• M. Tech Thesis: Generic Disassembler Using Processor Models

Presentations/Talks

• WAPTEC: Whitebox Analysis of Web Applications for Parameter Tampering Exploit Construction
  Paper presentation, 18th ACM Conference on Computer and Communications Security (CCS'2011)
  Chicago, IL, USA, Oct 20 2011.
• Web Application Security: Trends and Mitigation through Source Code Analysis
  
  • Dasient, Sunnyvale, CA, Mar 9 2011.
  • AT&T Security Research Center, New York, NY, Feb 18 2011.
  • SRI International Computer Science Lab Seminar, Menlo Park, CA, Dec 17 2010.
• NoTamper: Automatic Blackbox Detection of Parameter Tampering Opportunities in Web Applications
  
  • Paper presentation, 17th ACM Conference on Computer and Communications Security (CCS'2010)
    Chicago, IL, USA, Oct 7 2010.
  • Rump session presentation, 19th Usenix Security Symposium (SECURITY'10)
    Washington, DC, Aug 13 2010.
• Preparing Safe SQL Queries
  
  • Paper presentation, 14th Financial Cryptography and Data Security Conference (FC'2010)
    Canary Islands, Spain, Jan 25 2010.
  • Poster presentation, 17th ACM Conference on Computer and Communications Security (CCS'2010)
    Chicago, USA, Oct 5 2010.
• XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks
  Paper presentation, 5th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA'2008)
  Paris, France, Jul 2008
• CANDID : Preventing SQL Code Injection Attacks
  
  • Work-in-progress 16th USENIX Security Symposium (SECURITY'2007)
    Boston, MA, USA, Aug 2007
    
  • Poster Presentation, 4th Midwest Security Workshop (MSW'2007)
    Chicago, IL, USA, Oct 2007
    

Professional Experience

• Student Associate, May 2010 - Aug 2010
  SRI International, California, USA
• Senior Software Engineer, Jul 2003 - Jul 2006
  Intel, Bangalore, India
• Senior Software Engineer, Mar 2002 - Jul 2003
  Novell, Bangalore, India

Teaching Experience

• Teaching Assistant, Aug 2006 - Dec 2006, University of Illinois, Chicago, USA
  Computer Algorithms - I, Introduction to Computing.
  
• Teaching Assistant, Jul 2000 - Dec 2001, Indian Institute of Technology, Kanpur, India
  Introduction to Computing.
• Guest Faculty, Jun 2000, Govind Ballabh Pant Engg College, Pauri, India
  Analysis and Design of Algorithms.

Patent/Articles

• Techniques to Automatically Construct Parameter Tampering Attacks (Applied USA Patent Office)
• Automatically Preparing Safe SQL Queries (Applied USA Patent Office)
• Ideas published at www.ip.com
• Designing a secure SDK abstract
• A greedy algorithm for optimization of queue based systems abstract
• Bluetooth based WiFi Access Point management abstract

Review Activities

• IEEE Security and Privacy (Oakland): 2010, 2011, 2012
• Network & Distributed System Security Symposium (NDSS): 2011
• Computer and Communications Security (CCS): 2009
• Recent Advances in Intrusion Detection (RAID) Symposium: 2008, 2010
• Annual Computer Security Applications Conference (ACSAC): 2008, 2009, 2010, 2011
• Computer Security Foundations Symposium (CSFW): 2009
• World Wide Web (WWW): 2012
• Journal of Computer Security (JCS): 2009
• Journal of Software - Practice and Experience (SPE): 2008
• IET Information Security Journal: 2011
• Web 2.0 Security and Privacy (W2SP): 2011
• International Conference on Information Systems Security (ICISS): 2011

Miscellaneous

• Awards/Grants : Student travel grant for 19th USENIX Security Symposium Aug 11 - 13, 2010, Washington, DC by USENIX.
• Awards/Grants : Student travel grant for 18th USENIX Security Symposium Aug 11 - 14, 2009, Canada by USENIX.
• Awards/Grants : Student travel grant for 16th USENIX Security Symposium Aug 6 - 10, 2007, Boston by USENIX.
• A list of attended conferences : here
• Courses undertaken : Fall 2006, Spring 2007, Fall 2007, Spring 2008, Fall 2008, Spring 2009
• CoAuthors