Partner with Us
We work with companies that run security operations, build detection products, or deploy AI systems that need an audit trail. Our research uses data provenance, the causal record of how processes, files, and connections affect one another, to explain why something happened on a system.
Problems we work on
| Your problem | What we built | Evidence |
|---|---|---|
| Too many alerts for the SOC | Triage that ranks alerts by how rare their causal history is | NoDoze (NDSS 2019), deployed at NEC Labs America; U.S. patents 11,194,906 and 11,704,129; ongoing work with Sophos |
| Costly audit logs that attackers can edit | Tamper-evident eBPF logging with 10–25× lower overhead in stress tests | Nitro (ACM CCS 2025, Distinguished Paper Award), open source |
| Stealthy, persistent attackers | Detection on provenance graphs, across hosts and Active Directory | FLASH (IEEE S&P 2024, open source); HADES and CPD (IEEE TDSC) |
| Detection rules that attackers evade | Automated evasion testing; hunting rules built from public exploits | SPECTRA (IEEE S&P 2026): evaded 72.9% of the tested Windows Sigma process-creation rules, against 37.6% for AMIDES; Encore (arXiv 2026) |
| Scarce threat-hunting expertise | Small language models that write KQL hunting queries | RAID 2026, open source |
| Choosing an ML network detector | Independent re-evaluation of graph-based detectors | ACSAC 2025; ACM CCS 2026 |
Ways to work with us
- Sponsored research, contracted through UVA with agreed data and publication terms.
- Gifts that fund students and open-source releases.
- Data collaborations under a confidentiality agreement.
- Internships and recruiting. Our students intern at security companies and research labs; our graduates work in industry, government, and academia.
- SBIR and STTR proposals, with UVA as the research institution.
- Talks for security teams.
Contact
Email Wajih Ul Hassan at hassan@virginia.edu with the problem, your data, and your timeline.