Contact Details

Herbert Bos is full professor at the Vrije  Universiteit Amsterdam  and leads the VUSec Systems Security research group.

He obtained an ERC Starting Grant to work on reverse engineering and an NWO VICI grant to work on vulnerability detection. These and other systems security topics are still close to his heart. Other research interests include OS design, networking, and dependable systems.

Herbert moved to The Netherlands after approximately four years at the Universiteit Leiden. Before that he obtained his Ph.D. from the Cambridge University Computer Laboratory, followed by a brief stint at KPN Research (now TNO Telecom).

Publications

Selected Publications

2016

2015

2014

2013
1	Dowsing for overflows: A guided fuzzer to find buffer boundary violations   USENIX Security 2013, Washington, DC, August 2013. [Bibtex]
2	When Slower is Faster: On Heterogeneous Multicores for Reliable Systems   USENIX 2013, San Jose, CA, USA, June 2013. [Bibtex]
3	P2PWNED — Modeling and Evaluating the Resilience of Peer-to-Peer Botnets   Security & Privacy (Oakland), San Francisco, California, May 2013 [Bibtex]
4	Techniques for Efficient In-Memory Checkpointing   Topics in Dependable Systems (HotDep), Farmington, PA, Novermber 2013 [Bibtex]
5	MemPick: data structure detection in C/C++ binaries   Working Conference on Reverse Engineering (WCRE), Koblenz, Germany, October 2013 [Bibtex]
6	Who allocated my memory? Detecting custom memory allocators in C binaries   Working Conference on Reverse Engineering (WCRE), Koblenz, Germany, October 2013 →Best Paper! [Bibtex]
7	Highly Resilient Peer-to-Peer Botnets Are Here: An Analysis of Gameover Zeus   8th International Conference on Malicious and Unwanted Software (MALWARE’2013), Fajardo, Puerto Rico, October 2013. [Bibtex]
	2012
1	Prudent Practices for Designing Malware Experiments: Status Quo and Outlook   Security & Privacy (Oakland), San Francisco, California, May 2012 [Bibtex]
2	Memory Errors: The Past, the Present, and the Future   RAID 2012, Amsterdam, Netherlands, September 2012 [Bibtex]
3	Body Armor for Binaries: preventing buffer overflows without recompilation   USENIX ATC 2012, Boston, MA, June 2012 [Bibtex]
4	Keep Net Working – On a Dependable and Fast Networking Stack   Dependable Systems and Networks (DSN), Boston, MA, June 2012 [Bibtex]
5	Large-Scale Analysis of Malware Downloaders   DIMVA 2012, Heraklion, GR, July 2012 [Bibtex]
6	System-level Support for Intrusion Recovery   DIMVA 2012, Heraklion, GR, July 2012 [Bibtex]
	2011
1	Minemu: The World’s Fastest Taint Tracker   RAID’11, Menlo Park, California, September 2011 [Bibtex]
2	Howard: a dynamic excavator for reverse engineering data structures   NDSS’11, San Diego, California, February 2011 [Bibtex]
3	On Botnets that use DNS for Command and Control   EC2ND’11, Gothenburg, Sweden, September 2011 [Bibtex]
4	5andnet: Network Traffic Analysis of Malicious Software   Proceedings of the 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS) April 10, 2011, Salzburg, Austria [Bibtex]
5	System Security Research at VU University Amsterdam   SYSSEC Workshop, Amsterdam, July 2011 [Bibtex]
6	Application-tailored I/O with Streamline  (also available here) ACM Transactions on Computer Systems (TOCS’11), May 2011. [Bibtex]
	2010
1	Paranoid Android: Versatile Protection For Smartphones   Annual Computer Security Applications Conference (ACSAC’10), Austin, Texas, December 2010 [Bibtex]
2	DDE: Dynamic Data Structure Excavation   ACM APSYS’10, New Delhi, India, August 2010 [Bibtex]
3	Pointer tainting still pointless (but we all see the point of tainting)   ACM SIGOPS Operating Systems Review (OSR), 44(3), July 2010 [Bibtex]
4	Brief Announcement: A Shared Disk on Distributed Storage   PODC’10, Zuerich, July 2010 [Bibtex]
	2009
1	CacheCard: a transparent cache for static and dynamic content on the NIC   Proceedings of ACM/IEEE ANCS, Princeton, NY, Oct. 2009 [Bibtex]
2	Isolating Faulty Device Drivers   Proceedings of IEEE/IFIP Dependable Systems and Networks (DSN 2009), Lisbon, Portugal, June 2009. [Bibtex]
3	Pointless tainting? Evaluating the practicality of pointer tainting   Proceedings of EUROSYS 2009, Nuremberg, Germany, March/April 2009. [Bibtex]
4	Mapping and synchronizing streaming applications on Cell processors   Proceedings of HiPEAC 2009, Paphos, Cyprus, January 25-28, 2009 [Bibtex]

2008
1	Countering IPC Threats in Multiserver Operating Systems   IEEE PRDC, Taipei, Taiwan, December 2008. [Bibtex]
2	PipesFS: Fast Linux I/O in the Unix Tradition   Operating Systems Review, Special Issue on the Linux Kernel, July 2008. [Bibtex]
3	Future Threats to Future Trust   Conference on the Future of Trust in Computing, July 2008. [Bibtex]
4	odel-T: Rethinking the OS for terabit speeds   Proceedings of High-Speed Networks Workshop HSN 2008, Phoenix, AZ, April 2008 [Bibtex]
5	Eudaemon: Involuntary and On-Demand Emulation Against Zero-Day Exploits   Proceedings of ACM SIGOPS EUROSYS 2008, Glasgow, UK, April, 2008. [Bibtex]
6	Beltway buffers: avoiding the OS traffic jam   The 27th IEEE International Conference on Computer Communications (INFOCOM 2008), April 2008, Phoenix, Arizona. [Bibtex]
7	Safe Execution of Untrusted Applications on Embedded Network Processors   International Journal of Embedded Systems (IJES), InderScience, Vol.3, No. 4, 2008. [Bibtex]
	2007
1	Ruler: easy packet matching and rewriting on network processors   Symposium on Architectures for Networking and Communications Systems (ANCS’07) [Bibtex]
2	The Age of Data: pinpointing guilty bytes in polymorphic buffer overflows on heap or stack   23rd Annual Computer Security Applications Conference (ACSAC’07), Miami, FLA, December 2007. [Bibtex]
3	Tales from the Crypt: fingerprinting attacks on encrypted channels by way of retainting   Proc. of 3rd European Conference on Computer Network Defense (EC2ND), Heraklion, Greece, October, 2007. Note: the paper in the link above has a better layout and more readable figures compared to the paper in the proceedings (we had to convert our latex to word which screwed things up a little). It also contains a few lines of text that were slashed from the paper in the proceedings for space reasons. If you want to know what the paper in the proceedings looks like, click here. [Bibtex]
4	component-based coordination language for efficient reconfigurable streaming applications   Proc. of International Conference on Parallel Processing (ICPP’07), Xian, China, Sept. 2007 [Bibtex]
5	Failure Resilience for Device Drivers   IEEE/IFIP International Conference on Dependable Systems and Networks (IEEE/IFIP DSN’07), Dependable Computing and Communication Track (William C. Carter award for →best paper), Edinburgh, UK, June 2007. [Bibtex]
6	Roadmap to a Failure-Resilient Operating System   “USENIX ;login:”, Volume 32, Number 1, February 2007 [Bibtex]
7	The Token Based Switch: per-packet access authorisation to optical shortcuts   IFIP Networking, Atlanta, Georgia, May, 2007 [Bibtex]
	2006
1	SP@CE – An SP-based Programming Model for Consumer Electronics Streaming Applications   Languages and Compilers for Parallel Computing (LCPC’06), New Orleans, Louisiana, USA, November, 2006 [Bibtex]
2	Construction of a Highly Dependable Operating System (preprint)   (Proceedings of EDCC’06, Coimbra, Portugal, October 2006) (accepted for publication) [Bibtex]
3	MINIX 3: A Highly Reliable, Self-Repairing Operating System  (ACM SIGOPS Operating Systems Review, vol. 40, nr. 3, July 2006) [Bibtex]
4	Reorganizing UNIX for Reliability (preprint)   (Proceedings of Asia-Pacific Computer Systems Architecture Conference (ACSAC’06), Shangai, China, September, 2006) (accepted for publication) [Bibtex]
5	SafeCard: a Gigabit IPS on the network card   (RAID’06, Hamburg, Germany, September 2006) [Bibtex]
6	Can We Make Operating Systems Reliable and Secure?  (IEEE Computer, Vol. 39, No. 5, pp. 44–51, ISSN 0018-9162, May 2006) [Bibtex]
7	Supporting Reconfigurable Parallel Multimedia Applications  (→distinguished paper, ACM/IFIP/IEEE Euro-Par’06, August 2006) [Bibtex]
8	Modular system programming in Minix 3  (“USENIX ;LOGIN:”, Vol 31, No. 2, April 2006) [Bibtex]
9	Argos: an Emulator for Fingerprinting Zero-Day Attacks  (ACM SIGOPS EUROSYS 2006, Leuven, Begium, April 2006) [Bibtex]
10	SweetBait: Zero-Hour Worm Detection and Containment Using Low- and High-Interaction Honeypots  (Elsevier Computer Networks, Special Issue on Security through Self-Protecting and Self-Healing Systems, 2006) [Bibtex]
11	Dynamically extending the Corral with native code for high-speed packet processing  (Elsevier Computer Networks, Special Issue on Active and Programmable Networks, 50(14), pp. 2444-2461, October 2006) [Bibtex]
12	File Size Distribution on UNIX Systems Then and Now  (Operating Systems Review, Vol 40, No. 1, January 2006).) [Bibtex]
	2005
1	Towards software-based signature detection for intrusion prevention on the network card  (Proceedings of Eighth International Symposium on Recent Advances in Intrusion Detection (RAID2005), Seattle, Washington, September 2005.) [Bibtex] [PPT]
2	Network intrusion prevention on the network card  (IXA Summit, Hudson, MA, September 2005.)
3	Robust distributed systems – achieving self-management through inference  (Proceedings of First International IEEE WoWMoM Workshop on Autonomic Communications and Computing, ACC2005, Taormina, Italy, June 2005.) [Bibtex]
4	FPL-3: towards language support for distributed packet processing  (Proceedings of IFIP Networking, Waterloo, Ontario, Canada, May 2005 (accepted for publication).) [Bibtex]
5	FPL-3e: towards language support for distributed reconfigurable packet processing  (Proceedings of SAMOS V: Embedded Computer Systems: Architectures, MOdeling, and Simulation, Lecture Notes in Computer Science, Vol.3553/2005, ISSN 0302-9743, July, 2005.) [Bibtex]
	2004
1	FFPF: Fairly Fast Packet Filters  (Proceedings of 6th Symposium on Operating Systems Design and Implementation (OSDI’2004), San Francisco, CA, December 2004.) [HTML version] [Bibtex] [PPT] [Here is also a short FFPF tutorial (powerpoint) – from the Lobster workshop in Stockholm in May 2005]
2	Scalable network monitors for high-speed links: a bottom-up approach  (Proceedings of IEEE IPOM 2004, Beijing, China, October 2004.) [Bibtex]
3	On the feasibility of using network processors for DNA processing (Slightly modified version of the NP3 paper, to be published as Chapter 10 in “Network Processor Design, Vol. 3”, Morgan Kaufmann, pp. 10.1 — 10.14, 2004.) [See also the NP3 paper below]
4	SNMP Plus a Lightweight API for SNAP Handling  (Proceedings of IEEE/IFIP Network Operations and Management Symposium (NOMS’04), Seoul, Korea, April, 2004) [Bibtex]
5	On the feasibility of using network processors for DNA processing   (Proceedings of NP3, Workshop on Network Processors & Applications, Madrid, Spain, Feb, 2004) [Bibtex] [PPT]
	2003
1	HOKES/POKES: Light-weight resource sharing  (Proceedings of ACM SIGBED EMSOFT’03, October 2003, Philadelphia, USA) [Bibtex]
2	SCAMPI: A Scalable and Programmable Architecture for Monitoring Gigabit Networks  (Proceedings of E2EMon’03, September 2003, Dublin, Ireland) [Bibtex]
3	Compiler assistance for safe resource sharing without hardware support (Compilers for Parallel Computers (CPC), Amsterdam, January 2003)
	2002
4	A perspective on how ATM lost Control  (ACM SIGCOMM Computer Communication Review, Volume 32, Number 5, November 2002)
5	The OKE Corral: Code Organisation and Reconfiguration at Runtime using Active Linking   (Proceedings of IWAN’2002, Zuerich, December 2002). [Bibtex]
6	Safe Kernel Programming in the OKE  (Here we explain the OKE in some detail. It is also the preferred OKE paper to cite. Proceedings of IEEE OpenArch’02, New York, June, 2002) [Bibtex]
7	Towards Flexible Real-Time Network Monitoring Using a Network Processor. (Short paper: Proceedings of 3rd USENIX/NLUUG International SANE Conference 2002, pp. 409-410, Maastricht, May, 2002)
	2001 and earlier
1	The Open Kernel Environment. (This is the first presentation of the OKE – OpenSig’2001, London, September, 2001)
2	Elastic Network Control: An Alternative to Active Networks  (This paper describes our work on marrying the various approaches to programmable networks in a single, sensible framework. Journal of Communications and Networks, Special Issue on Programmable Routers and Switches, Vol.3, No.2, 2001)
3	Open Extensible Network Control  (Journal of Network and Systems Management (JNSM), Vol.8. No.1, March 2000)
4	Elastic Network Control  (PhD thesis. Also published as Technical Report No. 483, Cambridge University Computer Laboratory, August 1999)
5	Application-Specific Policies: Beyond the Domain Boundaries  (Proceedings IM’99, Boston, USA, May 1999) [HTML version]
6	Application-specific Behaviour in Distributed Network Control  (Proceedings ERSADS’99, Madeira, Portugal, April 1999)
7	Building a Distributed Video Server using Advanced ATM Network Support  (Proceedings IFIP/IEEE MMNS’98, Versailles, France, Nov. 1998)
8	ATM Admission Control based on Reservations and Measurements  (Proceedings IEEE IPCCC’98, Phoenix, Arizona, Feb. 1998)
9	Efficient Reservations in Open ATM Network Control using Online Measurements  (Int. J. of Communication Systems, V11, No. 4, August 1998) [HTML version]
10	An Active Distributed File Server for Continuous Media (Proceedings ERSADS’97, Zinal, Switzerland, March 1997)

Conference Papers

Workshop Papers

Journal Papers

Magazine Papers

Reports

00