DART Lab

Aerial view of the University of Virginia Grounds

We are the DART (Detecting, Analyzing, and Responding to Cyber Threats) Lab at the University of Virginia, led by Wajih Ul Hassan. Our research develops techniques for detecting sophisticated attacks on enterprise systems and for investigating them after the fact. Much of this work builds on system audit logs, which are rich enough to reveal how an intrusion unfolded but too large, too noisy, and too easily tampered with to use directly. We study how to make this data practical to collect and trust, how to detect stealthy and persistent threats within it, and how to help security teams investigate the alerts it produces. We also extend forensic analysis to emerging platforms such as IoT and AR/VR.

Current Research Projects

Audit Log Collection and Management System audit logs are the raw material of every investigation, yet they are expensive to store, noisy to analyze, and easy to tamper with. We build techniques that shrink audit data, sharpen causality analysis, and make stored logs tamper-evident. Threat Detection Advanced Persistent Threats hide inside ordinary activity for months, blending into the noise of a large enterprise. We develop detection methods that surface these stealthy campaigns accurately and at scale, on conventional hosts and beyond. Forensic Analysis & SOC Efficiency Security teams receive far more alerts than they can investigate, so genuine threats get buried under false alarms. We design techniques that rank alerts by context and give analysts the evidence to resolve them quickly. Forensics in Emerging Technologies IoT and AR/VR platforms automate decisions across many connected devices, which makes faulty or malicious behavior hard to diagnose. We are building forensic and detection methods for these systems, with privacy considered from the start.

Our Research is Supported By

Contact

hassan@virginia.edu

Rice Hall 522, 85 Engineer's Way, Charlottesville, VA 22903