Yuval Elovici

Although surfing the World Wide Web (hereafter: the Web) feels as if it is a bilateral private interaction, this impression is far from being accurate, as users leave identifiable digital tracks at every website they visit, and Elovici's research aims to address this. Elovici has demonstrated how a collaborative attack on the anonymity of Web users can be performed by analyzing only a small number of Internet routers.[12] The computer security community has concentrated on improving users’ privacy by concealing their identities on the Web. However, users may want or need to identify themselves on the Web in order to receive certain services, while retaining the privacy of their interests, needs, and intentions. PRAW, the privacy model developed by Elovici,[13] is aimed at hiding users’ navigation tracks, in an attempt to prevent eavesdroppers from inferring their profiles, while still allowing them to be identified. Securing data at rest stored in a database is a very challenging privacy-related task, and Elovici has developed a new database encryption scheme, SPDE,[14] which preserves the structure of the database and encrypts its content, such that even the DBA cannot view or modify the database cells’ content.

Air-gapped networks in which the computer network is separated physically from other networks, specifically those that are less secure, are widely used to protect the networks of military defense systems and critical infrastructure. The air-gap isolation was once thought to be a means of successfully preventing sensitive data from leaking from critical networks; however, some of Elovici's recent research[15][16][17][18][19][20][21][22][23][24][25][26] has challenged this, exposing techniques that enable attackers to leak data from these networks via covert channels, including electromagnetic, ultrasonic, thermal, optical channels. In each case, new types of attacks that can bridge the air-gap have been demonstrated.

Malware detection is a central component of cyber security and the focus of the Telekom Innovation Laboratories at Ben-Gurion University's flagship project: Net Centric Security, which is aimed at purifying NSP networks of malware.[27] As Director of the laboratories, Elovici developed methods based on machine learning techniques for detecting whether a suspected file is malicious or benign. The methods were based on static code analysis[28] and dynamic code analysis, where the suspected file activity was monitored in a sandbox.[29] One of the challenges associated with this research was the synthesis of powerful malware signatures yielding a low false positive detection rate.[30] The issues of detection scalability and performance were addressed in[31] by employing the complex network theory to pinpoint the most influential set of routers for employing monitoring and filtering devices. This research was extended (including a simulator), to find the optimal places for deploying a scribing center for mitigating the denial of service attack launched via botnets.[32]

Before Android-based mobile devices were introduced into the market for the first time by T-Mobile USA, Elovici was asked to study Android vulnerabilities, threats, and security mechanisms. The findings were summarized in several publications.[33] Following this analysis, he developed several security mechanisms for the Android platform, demonstrating how to secure Android mobile devices using SELinux[34] and developing several prototypes of an intrusion detection system (IDS) for strengthening Android-based devices based on various techniques, such as temporal reasoning and anomaly detection.[35][36] In addition, an efficient, collaborative application-monitoring scheme was developed for mobile devices that allow the devices to detect malicious applications without relying on a central authority.

Terrorist groups use the Web as their infrastructure for various purposes. Elovici designed the advanced terrorist detection system (ATDS) which analyzes the content of information accessed by Web users in order to track down online access to abnormal content, including terrorist-generated sites; ATDS was developed and evaluated using real users and terror-related data.[37][38] In other research, he hypothesized that a new type of information security threat may involve a class of malware that does not have the goal of corrupting and taking control of the machines it infects or stealing specific information stored on them. This research focused on malware aimed at stealing social network and behavioral information through data collection and network science inference techniques. Elovici referred to this type of attack as the stealing-reality attack, and he demonstrated how such an attack can propagate in real social networks.[39] Link prediction in social networks is one of the key tools in Web intelligence, and Elovici developed a very accurate link prediction algorithm to detect fake profiles in social networks which was evaluated on several large social networks.[40] Fake profiles which proliferate on social networks may be used for good as well as malicious purposes, and the link prediction algorithm may allow identifying a connection between terrorists that does not exist in a social graph. Elovici also developed the Social Network Protector, software based on advanced detection mechanisms that can help teenagers identify suspicious members in their social network. The Social Network Protector Facebook app was installed by more than 3000 users.[41][42]