Kiavash Satvat

I am involved in a project that tries to automate security tasks. We are developing an application that can automatically detect and exploit traditional vulnerabilities in software and web applications. More specifically, we build a tool that identifies injection types vulnerabilities such as SQL Injection and XSS and using publicly available CVE reports and tries to extract useful information to automatically generate the exploits.

The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very important to effectively identify and quickly respond to cyber threats. However, this knowledge is often embedded in large amounts of text, and therefore difficult to use effectively. To address this challenge, we propose a novel approach and tool called EXTRACTOR that allows precise automatic extraction of concise attack behaviors from CTI reports. EXTRACTOR makes no strong assumptions about the text and is capable of extracting attack behaviors as provenance graphs from unstructured text. We evaluate EXTRACTOR using real-world incident reports from various sources as well as reports of DARPA adversarial engagements that involve several attack campaigns on various OS platforms of Windows, Linux, and FreeBSD. Our evaluation results show that EXTRACTOR can extract concise provenance graphs from CTI reports and show that these graphs can successfully be used by cyber-analytics tools in threat-hunting.

Kiavash Satvat, Rigel Gjomemo and V.N Venkatakrishnan. "Extractor: Extracting Attack Behavior from Threat Reports", 2021 IEEE European Symposium on Security and Privacy (EuroS&P) IEEE, 2021. [Paper]

Kiavash Satvat, Maliheh Shirvanian and Nitesh Saxena. "PASSAT: Single Password Authenticated Secret-Shared Intrusion-Tolerant Storage with Server Transparency." arXiv preprint arXiv:2102.13607, 2021. [Paper]

Kiavash Satvat, Maliheh Shirvanian, Mahshid Hosseini, and Nitesh Saxena. CREPE: A Privacy-Enhanced Crash Reporting System. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy(CODASPY) (pp. 295-306), 2020. [Paper]

Perkash Shrestha, Nitesh Saxena, Ajaya Neupane, and Kiavash Satvat. CATCHA: When Cats Track Your Movements Online. In International Conference on Information Security Practice and Experience (pp. 172-193). Springer, 2019. [Paper]

Ajaya Neupane, Kiavash Satvat , Nitesh Saxena, Despina Stavrinos and Haley J. Bishop, “Do Social Disorders Facilitate Social Engineering? A Case Study of Autism and Phishing Attacks”, Annual Computer Security Applications Conference (ACSAC), 2018. [Paper]

Kiavash Satvat and Nitesh Saxena, “Crashing Privacy: An Autopsy of a Web Browser’s Leaked Crash Reports”, arXiv preprint arXiv:1808.01718 (2018). [Paper]

Kiavash Satvat, Mahshid Hosseini and Maliheh Shirvanian, “Camouflaged with Size: A Case Study of Espionage Using Acquirable Single-Board Computers”, 10th International Conference on Networks and Communications, 2018. [Paper]

Kiavash Satvat, Matthew Forshaw, Feng Hao and Ehsan Toreini, "On the Privacy of Private Browsing - A Forensic Approach", 8th International Workshop on DPM'13, 2013. [Paper]

Kiavash Satvat, Matthew Forshaw, Feng Hao and Ehsan Toreini, "On the Privacy of Private Browsing - A Forensic Approach", Journal of Information Security and Applications, Elsevier, 2014. [Paper]

I have several years of experience in some leading companies, which I believe gave me valuable experience working in a highly challenging and dynamic operation environment.