|
Robert J. WallsAssociate Professor, Computer ScienceProgram Director, Cybersecurity 147 Fuller Labs Worcester, MA 01609 rjwalls@wpi.edu The Cake Lab Google Scholar Github |
|
||||||||||||||||||||||||||||||||
About MeI am an associate professor in the Department of Computer Science at Worcester Polytechnic Institute and the Director of WPI’s Cybersecurity Program. My work focuses on systems security and performance, with an emphasis on the places where software, hardware, and real-world constraints meet. At WPI, my students and I are part of The Cake Lab. We study how to make computing systems more secure, reliable, and predictable, including embedded systems, firmware, GPUs, and shared computing infrastructure. Before joining WPI, I was a postdoctoral scholar at Penn State working with Prof. Patrick McDaniel and earned my Ph.D. from the University of Massachusetts Amherst, where I was advised by Prof. Brian Levine. News
Current ProjectsI’ve had the opportunity to work on a number of interesting research projects during my career. At WPI, my students and I are part of The Cake Lab, where we work on systems security and performance. Securing Resource-Constrained SystemsEmbedded and cyber-physical systems sit inside critical infrastructure, vehicles, medical devices, industrial equipment, consumer electronics, and smart devices. These systems often lack the abstractions and resources that desktop and server defenses assume, such as virtual memory, abundant memory, and flexible timing. My group studies how to provide stronger security guarantees while respecting the constraints that make these platforms useful in the first place. This work includes defenses for embedded software and real-time systems, such as Kage (USENIX Security 2022), Silhouette (USENIX Security 2020), and Recfish (ECRTS 2019). More recently, our embedded CTF work (ACM CCS 2025) studied what these competitions reveal about the practical challenges of securing microcontroller systems. Firmware and Binary AnalysisIn many real systems, source code is unavailable. Instead, analysts must work from firmware images or compiled binaries. My group develops techniques for recovering useful program structure from binaries, comparing code across firmware versions, and enabling security analysis or transformation when the original source is unavailable. Recent work includes REVDECODE (USENIX Security 2025), which uses context-aware graph representations and relevance decoding to improve binary function matching. GPU Systems and SchedulingGPUs are now shared infrastructure for machine learning, scientific computing, cloud services, and other performance-critical applications. My group studies how concurrent workloads interact on modern GPUs and how better scheduling can improve performance, predictability, and isolation. Recent work includes ReFINE (SPAA 2025), a reactive and fine-grained scheduling framework for general-purpose GPUs. This builds on earlier work studying GPU concurrency mechanisms under deep learning workloads, including Performance 2020 and Performance 2021. Past ProjectsBelow are some of the previous projects I have had the privilege to work on. Secure Deep LearningML models are valuable intellectual property due to the investment and expertise required to gather training data and construct the model. To monetize these models, companies often make them available as a service through APIs. At the same time, model owners often rely on hardware operated by cloud providers or end users. Our Data-Free Model Extraction work (CVPR 2021) demonstrated the feasibility of extracting models without knowledge of the underlying training dataset. In our trusted execution environment study (IC2E 2021), we identified performance bottlenecks that complicate efforts to run models in trusted execution environments. Web Security and PrivacyDomain names have become the Internet’s de facto root of trust. In practice, they are also a root of insecurity as common security systems depend on the unfounded assumption that domain ownership remains constant; this leaves users vulnerable to exploitation when domain ownership changes. In our Domain-Z work (IEEE Symposium on Security and Privacy 2016), we found that many seemingly disparate security problems share a root cause in residual domain trust abuse. In our ad blocking study (IMC 2015), we studied the most popular ad blocking software and examined the gap between how ad blockers are marketed and how they behave in practice. Digital ForensicsMobile phones can contain evidence that is invaluable for criminal investigations, but forensic tools have often needed to be hand-tailored to specific phone models. When no tool supports a target phone, investigators may be forced to examine raw storage manually. The DEC0DE project grew out of our mobile phone forensics work (USENIX Security 2011). It is an inference engine that extracts meaningful information from raw byte streams. Liftr (SPSM 2014) incorporates investigator feedback and relevance graphs to improve the results of inference engines like DEC0DE. Science of SecurityOne of the most ambitious projects I have been involved with was the 10-year Cyber-Security Collaborative Research Alliance with the Army Research Laboratory, Penn State, Carnegie Mellon, UC Riverside, UC Davis, and Indiana University. The project’s mandate was to develop a new science of security. As part of this effort, I worked on foundations for representing operational and environmental knowledge, including work on ontologies (STIDS 2014), with the goal of reasoning about both current and future system states to make better security decisions. Selected PublicationsBelow is a partial list of my recent publications.
|
|||||||||||||||||||||||||||||||||