Guofei Gu

Rm 3110, Klaus Advanced Computing Building

266 Ferst Drive

Atlanta, GA 30332-0765

Email: guofei [AT] cc.gatech.edu

http://www.cc.gatech.edu/~guofei

I am a doctoral student in the College of Computing at Georgia Tech. My advisor is Prof. Wenke Lee. Before coming to Georgia Tech, I received a Master of Computer Science from Fudan University, China.

What's

I will be joining the Department of Computer Science at Texas A&M University as an Assistant Professor in the Fall. I am looking for highly motivated students who are interested in doing research in network/system security.
I have successfully defended my Ph.D. thesis, titled "Correlation-based Botnet Detection in Enterprise Networks."
Our work on BotMiner has been accepted to the 2008 USENIX Security Symposium.

Research Interests

I'm interested in all aspects of network and system security. To solve practical security problems, I use networking and system techniques, as well as applied cryptography, machine learning, probability and statistics, information theory, etc. My current specific research interests include
- Internet malware detection, defense and analysis
- Intrusion Detection System (IDS): model, design, evaluation and optimization
- Peer-to-Peer network security and reliability

Selected Recent Publications (a full list)

Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee. "BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection." To appear in Proceedings of the 17th USENIX Security Symposium (Security'08), San Jose, CA, 2008. (Acceptance ratio 15.9%=27/170) [pdf] [bib]
Guofei Gu, Junjie Zhang, and Wenke Lee. "BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic." In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), San Diego, CA, February 2008. (Acceptance ratio 17.8%=21/118) [pdf] [bib] [slides]
David Dagon, Guofei Gu, Chris Lee, and Wenke Lee. "A Taxonomy of Botnet Structures." In Proceedings of the 23 Annual Computer Security Applications Conference (ACSAC'07), Miami Beach, FL, December 2007. (Acceptance ratio 22%=42/191) [pdf] [bib]
Guofei Gu, Phillip Porras, Vinod Yegneswaran, Martin Fong, and Wenke Lee. "BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation." In Proceedings of the 16th USENIX Security Symposium (Security'07), Boston, MA, August 2007. (Acceptance ratio 12.3%=23/187) [pdf] [bib] [slides] [system]
BotHunter free Internet release now available!
Roberto Perdisci, Guofei Gu, and Wenke Lee. "Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems." In Proceedings of the IEEE International Conference on Data Mining (ICDM'06) (regular paper), Hong Kong, December 2006. (Acceptance ratio 9.4%=73(regular)/776) [pdf] [bib] [slides]
Guofei Gu, Prahlad Fogla, David Dagon, Wenke Lee, and Boris Skoric. "Towards an Information-Theoretic Framework for Analyzing Intrusion Detection Systems." In Proceedings of the 11th European Symposium on Research in Computer Security (ESORICS'06), Hamburg, Germany, September 2006. (Acceptance ratio 20%=32/160) [pdf] [bib] [slides]

Conferences in Focus

	Deadline	Notification
USENIX Security'08	Jan. 30	Apr. 7	7/28-8/1, San Jose, CA
Leet'08	Feb. 11	Mar. 24	4/15, San Francisco, CA
SecureComm'08	Mar. 24	June 6	9/22-25, İstanbul, Turkey
RAID'08	Apr. 4	June 6	9/15-17, Boston, MA
ESORICS'08	Mar. 31	June 16	10/6-8, Malaga, Spain
ACM CCS'08	Apr. 14	July 8	10/27-31, Alexandria, VA
ACSAC 2008	June 8	Aug. 18	12/8-12, Anaheim, California
NDSS'09	Sep. 12	Nov. 3	2/8-11, San Diego
IEEE S&P 2009	Nov.	Jan.	5/-, Oakland
DSN'09	Dec. 8/Dec. 15		6/29-7/2, Estoril, Lisbon, Portugal
More...

Other security conferences: ASIACCS , ACNS , DIMVA , CSF/CSFW, NSPW , WiSec , Crypto, Eurocrypt, Asiacrypt Conferences
Networking: ACM SIGCOMM , HotNets , IEEE INFOCOM , ICNP , SIGMETRICS , ICDCS , ACM MOBICOM , MOBIHOC , MOBISYS , SenSys
P2P: IPTPS , P2P
System: SOSP , OSDI , NSDI
I am maintaining a list of computer security conference ranking and statistic.

Professional Services

TPC member, 2009 IEEE Symposium on Security and Privacy (Oakland'09)

Misc

Some useful links

visits since Feb 23, 2004. Last Modified July 2008