Grant: Canada Research Chairs

Dr. Paria Shirani's Canada Research Chair (CRC) program in cybersecurity addresses security vulnerabilities in Internet of things (IoT), which are the main reasons for severe cyberthreats to IoT-enabled large-scale critical sectors, such as healthcare and industrial control systems. Security, however, has lagged behind in the design and implementation of IoT devices, as evidenced by the increasing rate of cyberattacks. To mitigate such attacks, vulnerability detection through binary code analysis has a unique benefit to enable security analysis of software/firmware without the availability of source code, which is the case for many proprietary IoT systems. However, there is a large gap between existing binary analysis solutions and real-world IoT applications. This program aims at developing practical security solutions with technologies, methodologies, and tools for hunting vulnerabilities that are resilient to imminent threats and adaptive to emerging technologies in various critical infrastructures to guarantee the secure operation and deployment of cyber-physical systems. The effectiveness of the solutions will be demonstrated by applying them to a specific IoT application, such as smart buildings, an essential part of smart cities. This program will address the following objectives while considering IoT-specific challenges in vulnerability hunting through machine learning-based binary code analysis: i) identify and mitigate vulnerabilities in IoT devices; ii) validate identified vulnerabilities and mitigations for better accuracy; and iii) detect more complex vulnerabilities involving multiple binaries and generate IoT-specific threat intelligence. This program will provide novel practical solutions to manufacturers and utilities to examine IoT device security before and after deployment. It will build the first large-scale vulnerability and firmware databases specific to IoT vulnerability detection in binary codes, as well as IoT-relevant empirical data and cyberthreat intelligence, which potentially can benefit researchers, security practitioners, and various stakeholders (e.g., designers, operators, researchers). This program will train highly qualified personnel with research, professional and technical skills in the demanding field of cybersecurity. In summary, this CRC program will play a vital role in leading vulnerability research efforts and preparing the next generation of cybersecurity professionals for Canada.