DART Lab

Aerial view of the University of Virginia Grounds
DART Lab

We are the DART (Detecting, Analyzing, and Responding to Cyber Threats) Lab at the University of Virginia, led by Wajih Ul Hassan. We find out why something happened on a computer system, and whether the record of it can be trusted. We build data provenance systems, which record how processes, files, users, and network connections affect one another, and use them to detect attacks, investigate alerts, and test whether the defenses that security teams and AI tools rely on hold up.

Research Areas

Trustworthy Evidence Can we trust the record? Attackers edit the logs that would expose them. We build audit logging that makes tampering detectable at low overhead. Attack Detection and Investigation What happened, and why? We find attacks hidden among millions of ordinary events and reconstruct how they unfolded. Adversarial Evaluation Does the defense hold up? We attack detection rules, machine-learning detectors, and AI triage tools to measure what they miss.

Lab Life

Eleven DART Lab members standing together in front of a storefront.
Wajih Ul Hassan and five students standing in front of a wood-paneled wall.
A student explains a research poster on AI model fingerprinting to visitors.
Muhammad Shoaib explains a research poster on detection-rule evasion to three visitors.

More photos, posters, and events →

Work with Us

Industry partners Sponsored research, data collaborations under NDA, internships and recruiting, and joint proposals. Prospective students PhD applicants, UVA undergraduates, and visiting students: how to join the lab and what we look for.

Funding

National Science Foundation Commonwealth Cyber Initiative 4VA OpenAI

Contact

Wajih Ul Hassan

hassan@virginia.edu

Rice Hall 522, 85 Engineer's Way, Charlottesville, VA 22903

Google Scholar · ORCID · GitHub