DART Lab

Aerial view of the University of Virginia Grounds

We are the DART (Detecting, Analyzing, and Responding to Cyber Threats) Lab at the University of Virginia, led by Wajih Ul Hassan.

We build systems that detect sophisticated attacks and reconstruct how they unfolded. Most of this work starts from system audit logs, which record enough to explain an entire intrusion but are too large, too noisy, and too easily tampered with to use as they are. We make that data practical to collect, trust, and act on.

Research Areas

Audit Log Collection and Management Audit logs are the raw material of every investigation, yet they are costly to store, noisy to analyze, and easy to tamper with. We shrink them, sharpen causality analysis, and make them tamper-evident. Threat Detection Advanced Persistent Threats hide inside ordinary activity for months, blending into the noise of a large enterprise. We build detection methods that surface these campaigns accurately and at scale. Forensic Analysis & SOC Efficiency Security teams receive far more alerts than they can investigate, so real threats stay buried under false alarms. We rank alerts by context and give analysts the evidence to close them quickly. Forensics in Emerging Technologies IoT and AR/VR platforms automate decisions across many connected devices, which makes faulty or malicious behavior hard to trace. We build forensics and detection for these platforms, with privacy designed in.

Funding

Contact

Wajih Ul Hassan

hassan@virginia.edu

Rice Hall 522, 85 Engineer's Way, Charlottesville, VA 22903