Stefan Savage

Orcid: 0000-0001-6617-8029

Affiliations:
  • University of California, San Diego, USA


According to our database1, Stefan Savage authored at least 168 papers between 1993 and 2024.

Collaborative distances:
  • Dijkstra number2 of three.
  • Erdős number3 of two.

Awards

ACM Fellow

ACM Fellow 2010, "For contributions to large scale systems and network security.".

Timeline

Legend:

Book 
In proceedings 
Article 
PhD thesis 
Dataset
Other 

Links

Online presence:

On csauthors.net:

Bibliography

2024
An Empirical Analysis on the Use and Reporting of National Security Letters.
CoRR, 2024

2023
No Privacy Among Spies: Assessing the Functionality and Insecurity of Consumer Android Spyware Apps.
Proc. Priv. Enhancing Technol., January, 2023

Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild.
CoRR, 2023

In the Line of Fire: Risks of DPI-triggered Data Collection.
Proceedings of the 2023 Cyber Security Experimentation and Test Workshop, 2023

WaVe: a verifiably secure WebAssembly sandboxing runtime.
Proceedings of the 44th IEEE Symposium on Security and Privacy, 2023

Understanding the Viability of Gmail's Origin Indicator for Identifying the Sender.
Proceedings of the Nineteenth Symposium on Usable Privacy and Security, 2023

Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy.
Proceedings of the 8th IEEE European Symposium on Security and Privacy, 2023

An Empirical Analysis of Enterprise-Wide Mandatory Password Updates.
Proceedings of the Annual Computer Security Applications Conference, 2023

2022
Trackers Bounce Back: Measuring Evasion of Partitioned Storage in the Wild.
CoRR, 2022

Measuring security practices.
Commun. ACM, 2022

Domain Name Lifetimes: Baseline and Threats.
Proceedings of the 6th Network Traffic Measurement and Analysis Conference, 2022

Measuring UID smuggling in the wild.
Proceedings of the 22nd ACM Internet Measurement Conference, 2022

Where .ru?: assessing the impact of conflict on russian domain infrastructure.
Proceedings of the 22nd ACM Internet Measurement Conference, 2022

Retroactive identification of targeted DNS infrastructure hijacking.
Proceedings of the 22nd ACM Internet Measurement Conference, 2022

The Challenges of Blockchain-Based Naming Systems for Malware Defenders.
Proceedings of the APWG Symposium on Electronic Crime Research, 2022

2021
Hopper: Modeling and Detecting Lateral Movement (Extended Report).
CoRR, 2021

CoResident Evil: Covert Communication In The Cloud With Lambdas.
Proceedings of the WWW '21: The Web Conference 2021, 2021

Jetset: Targeted Firmware Rehosting for Embedded Systems.
Proceedings of the 30th USENIX Security Symposium, 2021

Hopper: Modeling and Detecting Lateral Movement.
Proceedings of the 30th USENIX Security Symposium, 2021

Characterization of Anycast Adoption in the DNS Authoritative Infrastructure.
Proceedings of the 5th Network Traffic Measurement and Analysis Conference, 2021

Clairvoyance: Inferring Blocklist Use on the Internet.
Proceedings of the Passive and Active Measurement - 22nd International Conference, 2021

Доверя'й, но проверя'й: SFI safety for native-compiled Wasm.
Proceedings of the 28th Annual Network and Distributed System Security Symposium, 2021

Home is where the hijacking is: understanding DNS interception by residential routers.
Proceedings of the IMC '21: ACM Internet Measurement Conference, 2021

Who's got your mail?: characterizing mail service provider usage.
Proceedings of the IMC '21: ACM Internet Measurement Conference, 2021

Risky BIZness: risks derived from registrar name management.
Proceedings of the IMC '21: ACM Internet Measurement Conference, 2021

2020
Trufflehunter: Cache Snooping Rare Domains at Large Public DNS Resolvers.
Proceedings of the IMC '20: ACM Internet Measurement Conference, 2020

Unresolved Issues: Prevalence, Persistence, and Perils of Lame Delegations.
Proceedings of the IMC '20: ACM Internet Measurement Conference, 2020

2019
Hack for Hire: Exploring the Emerging Market for Account Hijacking.
Proceedings of the World Wide Web Conference, 2019

Reading the Tea leaves: A Comparative Analysis of Threat Intelligence.
Proceedings of the 28th USENIX Security Symposium, 2019

Detecting and Characterizing Lateral Phishing at Scale.
Proceedings of the 28th USENIX Security Symposium, 2019

Triton: A Software-Reconfigurable Federated Avionics Testbed.
Proceedings of the 12th USENIX Workshop on Cyber Security Experimentation and Test, 2019

Measuring Security Practices and How They Impact Security.
Proceedings of the Internet Measurement Conference, 2019

Web feature deprecation: a case study for chrome.
Proceedings of the 41st International Conference on Software Engineering: Software Engineering in Practice, 2019

Surveillance and privacy in the public and private sectors: panel.
Proceedings of the Symposium on Computer Science and Law, 2019

2018
Following Their Footsteps: Characterizing Account Automation Abuse and Defenses.
Proceedings of the Internet Measurement Conference 2018, 2018

Lawful Device Access without Mass Surveillance Risk: A Technical Design Discussion.
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, 2018

2017
Malicious Browser Extensions at Scale: Bridging the Observability Gap between Web Site and Browser.
Proceedings of the 10th USENIX Workshop on Cyber Security Experimentation and Test, 2017

How They Did It: An Analysis of Emission Defeat Devices in Modern Automobiles.
Proceedings of the 2017 IEEE Symposium on Security and Privacy, 2017

A Call to ARMs: Understanding the Costs and Benefits of JIT Spraying Mitigations.
Proceedings of the 24th Annual Network and Distributed System Security Symposium, 2017

Tripwire: inferring internet site compromise.
Proceedings of the 2017 Internet Measurement Conference, 2017

Quantifying the Pressure of Legal Risks on Third-party Vulnerability Research.
Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017

2016
You've Got Vulnerability: Exploring Effective Vulnerability Notifications.
Proceedings of the 25th USENIX Security Symposium, 2016

2015
Fast and Vulnerable: A Story of Telematic Failures.
Proceedings of the 9th USENIX Workshop on Offensive Technologies, 2015

Framing Dependencies Introduced by Underground Commoditization.
Proceedings of the 14th Annual Workshop on the Economics of Information Security, 2015

Too LeJIT to Quit: Extending JIT Spraying to ARM.
Proceedings of the 22nd Annual Network and Distributed System Security Symposium, 2015

Who is .com?: Learning to Parse WHOIS Records.
Proceedings of the 2015 ACM Internet Measurement Conference, 2015

From .academy to .zone: An Analysis of the New TLD Land Rush.
Proceedings of the 2015 ACM Internet Measurement Conference, 2015

Affiliate Crookies: Characterizing Affiliate Marketing Abuse.
Proceedings of the 2015 ACM Internet Measurement Conference, 2015

Scheduling techniques for hybrid circuit/packet networks.
Proceedings of the 11th ACM Conference on Emerging Networking Experiments and Technologies, 2015

Security by Any Other Name: On the Effectiveness of Provider Based Email Security.
Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, 2015

2014
XXXtortion?: inferring registration intent in the .XXX TLD.
Proceedings of the 23rd International World Wide Web Conference, 2014

Botcoin: Monetizing Stolen Cycles.
Proceedings of the 21st Annual Network and Distributed System Security Symposium, 2014

Knock it off: profiling the online storefronts of counterfeit merchandise.
Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2014

Search + Seizure: The Effectiveness of Interventions on SEO Campaigns.
Proceedings of the 2014 Internet Measurement Conference, 2014

Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild.
Proceedings of the 2014 Internet Measurement Conference, 2014

Characterizing Large-Scale Click Fraud in ZeroAccess.
Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014

On The Security of Mobile Cockpit Information Systems.
Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014

2013
A Fistful of Bitcoins: Characterizing Payments Among Men with No Names.
login Usenix Mag., 2013

Measuring the Practical Impact of DNSSEC Deployment.
Proceedings of the 22th USENIX Security Symposium, Washington, DC, USA, August 14-16, 2013, 2013

Juice: A Longitudinal Study of an SEO Botnet.
Proceedings of the 20th Annual Network and Distributed System Security Symposium, 2013

A comparison of syslog and IS-IS for network failure analysis.
Proceedings of the 2013 Internet Measurement Conference, 2013

Measuring the Cost of Cybercrime.
Proceedings of the Economics of Information Security and Privacy, 2013

2012
scc: Informed Provisioning of Storage for Cluster Applications.
login Usenix Mag., 2012

Improving Software Diagnosability via Log Enhancement.
ACM Trans. Comput. Syst., 2012

Return-Oriented Programming: Systems, Languages, and Applications.
ACM Trans. Inf. Syst. Secur., 2012

Measuring the Cost of Cybercrime.
Proceedings of the 11th Annual Workshop on the Economics of Information Security, 2012

PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs.
Proceedings of the 21th USENIX Security Symposium, Bellevue, WA, USA, August 8-10, 2012, 2012

When Good Services Go Wild: Reassembling Web Services for Unintended Purposes.
Proceedings of the 7th USENIX Workshop on Hot Topics in Security, 2012

Be Conservative: Enhancing Failure Diagnosis with Proactive Logging.
Proceedings of the 10th USENIX Symposium on Operating Systems Design and Implementation, 2012

Taster's choice: a comparative analysis of spam feeds.
Proceedings of the 12th ACM SIGCOMM Internet Measurement Conference, 2012

BlueSky: a cloud-backed file system for the enterprise.
Proceedings of the 10th USENIX conference on File and Storage Technologies, 2012

scc: cluster storage provisioning informed by application characteristics and SLAs.
Proceedings of the 10th USENIX conference on File and Storage Technologies, 2012

Priceless: the role of payments in abuse-advertised goods.
Proceedings of the ACM Conference on Computer and Communications Security, 2012


2011
Learning to detect malicious URLs.
ACM Trans. Intell. Syst. Technol., 2011

Privacy-preserving network forensics.
Commun. ACM, 2011

Got traffic?: an evaluation of click traffic providers.
Proceedings of the 2011 Joint WICOW/AIRWeb Workshop on Web Quality, 2011

Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks.
Proceedings of the 5th USENIX Workshop on Offensive Technologies, 2011

Dirty Jobs: The Role of Freelance Labor in Web Service Abuse.
Proceedings of the 20th USENIX Security Symposium, 2011

Show Me the Money: Characterizing Spam-advertised Revenue.
Proceedings of the 20th USENIX Security Symposium, 2011

No Plan Survives Contact: Experience with Cybercrime Measurement.
Proceedings of the 4th Workshop on Cyber Security Experimentation and Test, 2011

Comprehensive Experimental Analyses of Automotive Attack Surfaces.
Proceedings of the 20th USENIX Security Symposium, 2011

Click Trajectories: End-to-End Analysis of the Spam Value Chain.
Proceedings of the 32nd IEEE Symposium on Security and Privacy, 2011

DefenestraTor: Throwing Out Windows in Tor.
Proceedings of the Privacy Enhancing Technologies - 11th International Symposium, 2011

On the empirical performance of self-calibrating WiFi location systems.
Proceedings of the IEEE 36th Conference on Local Computer Networks, 2011

An analysis of underground forums.
Proceedings of the 11th ACM SIGCOMM Internet Measurement Conference, 2011

Cloak and dagger: dynamics of web search cloaking.
Proceedings of the 18th ACM Conference on Computer and Communications Security, 2011

Judging a site by its content: learning the textual, structural, and visual features of malicious web pages.
Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, 2011

2010
Difference engine: harnessing memory redundancy in virtual machines.
Commun. ACM, 2010

Measuring Online Service Availability Using Twitter.
Proceedings of the 3rd Workshop on Online Social Networks, 2010

Neon: system support for derived data management.
Proceedings of the 6th International Conference on Virtual Execution Environments, 2010

Re: CAPTCHAs-Understanding CAPTCHA-Solving Services in an Economic Context.
Proceedings of the 19th USENIX Security Symposium, 2010

SleepServer: A Software-Only Approach for Reducing the Energy Consumption of PCs within Enterprise Environments.
Proceedings of the 2010 USENIX Annual Technical Conference, 2010

Experimental Security Analysis of a Modern Automobile.
Proceedings of the 31st IEEE Symposium on Security and Privacy, 2010

California fault lines: understanding the causes and impact of network failures.
Proceedings of the ACM SIGCOMM 2010 Conference on Applications, 2010

Botnet Judo: Fighting Spam with Itself.
Proceedings of the Network and Distributed System Security Symposium, 2010

Beyond heuristics: learning to classify vulnerabilities and predict exploits.
Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2010

How to tell an airport from a home: techniques and applications.
Proceedings of the 9th ACM Workshop on Hot Topics in Networks. HotNets 2010, Monterey, CA, USA - October 20, 2010

2009
URL Reputation.
Dataset, October, 2009

Cumulus: Filesystem Backup to the Cloud.
login Usenix Mag., 2009

Difference Engine.
login Usenix Mag., 2009

Detecting Malicious Packet Losses.
IEEE Trans. Parallel Distributed Syst., 2009

Spamalytics: an empirical analysis of spam marketing conversion.
Commun. ACM, 2009

Spamcraft: An Inside Look At Spam Campaign Orchestration.
Proceedings of the 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2009

Beyond blacklists: learning to detect malicious web sites from suspicious URLs.
Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France, June 28, 2009

When private keys are public: results from the 2008 Debian OpenSSL vulnerability.
Proceedings of the 9th ACM SIGCOMM Internet Measurement Conference, IMC 2009, Chicago, 2009

Identifying suspicious URLs: an application of large-scale online learning.
Proceedings of the 26th Annual International Conference on Machine Learning, 2009

Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds.
Proceedings of the 2009 ACM Conference on Computer and Communications Security, 2009

2008
Storm: When Researchers Collide.
login Usenix Mag., 2008

Detecting compromised routers via packet forwarding behavior.
IEEE Netw., 2008

Xl: an efficient network routing algorithm.
Proceedings of the ACM SIGCOMM 2008 Conference on Applications, 2008

On the Spam Campaign Trail.
Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008

The Heisenbot Uncertainty Problem: Challenges in Separating Bots from Chaff.
Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008

Reconsidering physical key secrecy: teleduplication via optical decoding.
Proceedings of the 2008 ACM Conference on Computer and Communications Security, 2008

When good instructions go bad: generalizing return-oriented programming to RISC.
Proceedings of the 2008 ACM Conference on Computer and Communications Security, 2008

2007
Spamscatter: Characterizing Internet Scam Hosting Infrastructure.
Proceedings of the 16th USENIX Security Symposium, Boston, MA, USA, August 6-10, 2007, 2007

Automating cross-layer diagnosis of enterprise wireless networks.
Proceedings of the ACM SIGCOMM 2007 Conference on Applications, 2007

Slicing Spam with Occam's Razor.
Proceedings of the CEAS 2007, 2007

An inquiry into the nature and causes of the wealth of internet miscreants.
Proceedings of the 2007 ACM Conference on Computer and Communications Security, 2007

2006
Inferring Internet denial-of-service activity.
ACM Trans. Comput. Syst., 2006

Detecting and Isolating Malicious Routers.
IEEE Trans. Dependable Secur. Comput., 2006

Maximizing data locality in distributed systems.
J. Comput. Syst. Sci., 2006

Jigsaw: solving the puzzle of enterprise 802.11 analysis.
Proceedings of the ACM SIGCOMM 2006 Conference on Applications, 2006

Unexpected means of protocol inference.
Proceedings of the 6th ACM SIGCOMM Internet Measurement Conference, 2006

Finding diversity in remote code injection exploits.
Proceedings of the 6th ACM SIGCOMM Internet Measurement Conference, 2006

2005
Scalable internet threat monitoring.
Proceedings of the 2005 ACM Workshop on Rapid Malcode, 2005

Self-stopping worms.
Proceedings of the 2005 ACM Workshop on Rapid Malcode, 2005

Scalability, fidelity, and containment in the potemkin virtual honeyfarm.
Proceedings of the 20th ACM Symposium on Operating Systems Principles 2005, 2005

SyncScan: practical fast handoff for 802.11 infrastructure networks.
Proceedings of the INFOCOM 2005. 24th Annual Joint Conference of the IEEE Computer and Communications Societies, 2005

Fatih: Detecting and Isolating Malicious Routers.
Proceedings of the 2005 International Conference on Dependable Systems and Networks (DSN 2005), 28 June, 2005

2004
Monkey See, Monkey Do: A Tool for TCP Tracing and Replaying.
Proceedings of the General Track: 2004 USENIX Annual Technical Conference, June 27, 2004

Brief announcement: detecting malicious routers.
Proceedings of the Twenty-Third Annual ACM Symposium on Principles of Distributed Computing, 2004

Automated Worm Fingerprinting.
Proceedings of the 6th Symposium on Operating System Design and Implementation (OSDI 2004), 2004

Total Recall: System Support for Automated Availability Management.
Proceedings of the 1st Symposium on Networked Systems Design and Implementation (NSDI 2004), 2004

2003
Inside the Slammer Worm.
IEEE Secur. Priv., 2003

802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions.
Proceedings of the 12th USENIX Security Symposium, Washington, D.C., USA, August 4-8, 2003, 2003

Characterizing and measuring path diversity of internet topologies.
Proceedings of the International Conference on Measurements and Modeling of Computer Systems, 2003

Automatically inferring patterns of resource consumption in network traffic.
Proceedings of the ACM SIGCOMM 2003 Conference on Applications, 2003

Understanding Availability.
Proceedings of the Peer-to-Peer Systems II, Second International Workshop, 2003

Internet Quarantine: Requirements for Containing Self-Propagating Code.
Proceedings of the Proceedings IEEE INFOCOM 2003, The 22nd Annual Joint Conference of the IEEE Computer and Communications Societies, San Franciso, CA, USA, March 30, 2003

In search of path diversity in ISP networks.
Proceedings of the 3rd ACM SIGCOMM Internet Measurement Conference, 2003

The Phoenix Recovery System: Rebuilding from the Ashes of an Internet Catastrophe.
Proceedings of HotOS'03: 9th Workshop on Hot Topics in Operating Systems, 2003

Replication Strategies for Highly Available Peer-to-Peer Storage.
Proceedings of the Future Directions in Distributed Computing, 2003

2002
A quantitative evaluation of traffic-aware routing strategies.
Comput. Commun. Rev., 2002

Automated measurement of high volume traffic clusters.
Proceedings of the 2nd ACM SIGCOMM Internet Measurement Workshop, 2002

Measuring packet reordering.
Proceedings of the 2nd ACM SIGCOMM Internet Measurement Workshop, 2002

2001
Network support for IP traceback.
IEEE/ACM Trans. Netw., 2001

Inferring Internet Denial-of-Service Activity.
Proceedings of the 10th USENIX Security Symposium, 2001

Alpine: A User-Level Infrastructure for Network Protocol Development.
Proceedings of the 3rd USENIX Symposium on Internet Technologies and Systems, 2001

Robust Congestion Signaling.
Proceedings of the 9th International Conference on Network Protocols (ICNP 2001), 2001

2000
Practical network support for IP traceback.
Proceedings of the ACM SIGCOMM 2000 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, August 28, 2000

Modeling TCP Latency.
Proceedings of the Proceedings IEEE INFOCOM 2000, 2000

Understanding the Performance of TCP Pacing.
Proceedings of the Proceedings IEEE INFOCOM 2000, 2000

1999
Detour: informed Internet routing and transport.
IEEE Micro, 1999

TCP congestion control with a misbehaving receiver.
Comput. Commun. Rev., 1999

Sting: A TCP-based Network Measurement Tool.
Proceedings of the 2nd USENIX Symposium on Internet Technologies and Systems, 1999

The End-to-End Effects of Internet Path Selection.
Proceedings of the ACM SIGCOMM 1999 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, August 30, 1999

The Case for Informed Transport Protocols.
Proceedings of The Seventh Workshop on Hot Topics in Operating Systems, 1999

1997
Eraser: A Dynamic Data Race Detector for Multithreaded Programs.
ACM Trans. Comput. Syst., 1997

Eraser: A Dynamic Data Race Detector for Multi-Threaded Programs.
Proceedings of the Sixteenth ACM Symposium on Operating System Principles, 1997

1996
AFRAID - A Frequently Redundant Array of Independent Disks.
Proceedings of the USENIX Annual Technical Conference, 1996

1995
SPIN - An Extensible Microkernel for Application-specific Operating System Services.
ACM SIGOPS Oper. Syst. Rev., 1995

Extensibility, Safety and Performance in the SPIN Operating System.
Proceedings of the Fifteenth ACM Symposium on Operating System Principles, 1995

Protection is a software issue.
Proceedings of the Fifth Workshop on Hot Topics in Operating Systems, 1995

1994
Some Issues in the Design of an Extensible Operating System (Panel Statement).
Proceedings of the First USENIX Symposium on Operating Systems Design and Implementation (OSDI), 1994

Processor Capacity Reserves: Operating System Support for Multimedia Applications.
Proceedings of the International Conference on Multimedia Computing and Systems, 1994

1993
Real Time - Mach Timers: Exporting Time to the User.
Proceedings of the USENIX MACH III Symposium, Santa Fe, New Mexico, USA, April 19-21, 1993, 1993

Processor Capacity Reserves: An Abstraction for Managing Processor Usage.
Proceedings of the Proceedings Fourth Workshop on Workstation Operating Systems, 1993


  Loading...