Michael D. Bailey

Assistant Research Scientist
Software Systems Laboratory, or Real-Time Computing Laboratory
Computer Science and Engineering Division
Department of Electrical Engineering and Computer Science
University of Michigan

My CV is here.

Research:

My research focuses on the security and availability of complex distributed systems. To date this has included the characterization of specific network threats (e.g., worms) and techniques for measurement of these threats at scale (e.g., distributed network telescopes). More recently I have been focused on the interplay between the attackers and the defenders of these systems including the creation of techniques that allow defenders to hide from attackers as well as through the classification and analysis of complex attacker tool ecosystems. This work is accomplished under the following projects:

Automatic Topology Discovery for Perspective-Aware Internet Threat Detection
Detecting and Dismantling Botnet Command and Control Infrastructure using Behavioral Profilers and Bot Informants
Virtual Center for Network and Security Data as part of PREDICT

If you are interested in becoming a graduate student at UM, but are not yet admitted/enrolled, please read this note.

Papers:

David Dittrich, Michael Bailey, Sven Dietrich. Towards Community Standards for Ethical Behavior in Computer Security Research. Stevens CS Technical Report 2009-1, 20 April 2009. [pdf] [bib]

David Dittrich, Michael D. Bailey, and Sven Dietrich. Have we Crossed the Line? The Growing Ethical Debate in Modern Computer Security Research. In (Poster at) Proceedings of the 16th ACM Conference on Computer and Communication Security (CCS-09), Chicago, Illinois USA, November 2009 [pdf] [bib]

Jon Oberheide, Michael Bailey, and Farnam Jahanian. PolyPack: An Automated Online Packing Service for Optimal Antivirus Evasion. In 3rd USENIX Workshop on Offensive Technologies (WOOT '09), Montreal, Canada, August 2009. [pdf] [bib]
Sushant Sinha, Michael D. Bailey, and Farnam Jahanian. One Size Does Not Fit All: 10 Years of Applying Context Aware Security. In Proceedings of the 2009 IEEE International Conference on Technologies for Homeland Security (HST '09), Waltham, Massachusetts, USA, May 2009. [pdf] [bib]
Michael D. Bailey, Evan Cooke, Farnam Jahanian, Yunjing Xu, and Manish Karir. A Survey of Botnet Technology and Defenses. In Proceedings of the Cybersecurity Applications & Technology Conference For Homeland Security (CATCH '09), pages 299-304, Washington, District of Columbia, USA, March 2009. [pdf] [bib]
Scott E. Coull, Fabian Monrose, Michael K. Reiter, and Michael D. Bailey. The Challenges of Effectively Anonymizing Network Data. In Proceedings of the Cybersecurity Applications & Technology Conference For Homeland Security (CATCH '09), pages 230-236, Washington, District of Columbia, USA, March 2009. [pdf] [bib]
Sushant Sinha, Michael D. Bailey, and Farnam Jahanian. Shades of Grey: On the Effectiveness of Reputation-based blacklists. In Proceedings of the 3rd International Conference on Malicious and Unwanted Software (MALWARE '08), pages 57-64, Fairfax, Virginia, USA, October 2008. [pdf] [bib]
Xu Chen, Jon Andersen, Z. Morley Mao, Michael D. Bailey, and Jose Nazario. Towards an Understanding of Anti-Virtualization and Anti-Debugging Behavior in Modern Malware. In Proceedings of the 38th Annual IEEE International Conference on Dependable Systems and Networks (DSN '08), pages 177-186, Anchorage, Alaska, USA, June 2008. [pdf] [bib]
Sushant Sinha, Michael D. Bailey, and Farnam Jahanian. Shedding Light on the Configuration of Dark Addresses. In Proceedings of the 14th Annual Network & Distributed System Security Symposium (NDSS '07), pages 125-139, San Diego, California, USA, February-March 2007. [pdf] [bib]
Michael D. Bailey, Jon Oberheide, Jon Andersen, Zhuoqing Morley Mao, Farnam Jahanian, and Jose Nazario. Automated Classification and Analysis of Internet Malware. In Proceedings of the 10th International Symposium on Recent Advances in Intrusion Detection (RAID '07), pages 178-197, Gold Coast, Australia, September 2007. [pdf] [bib]
Michael Donald Bailey. A Scalable Hybrid Network Monitoring Architecture for Measuring, Characterizing, and Tracking Internet Threat Dynamics. PhD thesis, University of Michigan, Ann Arbor, MI, USA, 2006. [pdf] [bib]
Evan Cooke, Michael D. Bailey, Farnam Jahanian, and Richard Mortier. The Dark Oracle: Perspective-Aware Unused and Unreachable Address Discovery. In Proceedings of the 3rd Symposium on Networked Systems Design & Implementation (NSDI '06), pages 101-114, San Jose, California, USA, May 2006. [pdf] [bib]
Michael D. Bailey, Evan Cooke, Farnam Jahanian, Andrew Myrick, and Sushant Sinha. Practical Darknet Measurement. In Proceedings of the 40th Annual Conference on Information Sciences and Systems (CISS '06), pages 1496-1501, Princeton, New Jersey, USA, March 2006. [pdf] [bib]
Michael D. Bailey, Evan Cooke, Farnam Jahanian, David Watson, and Jose Nazario. The Blaster Worm: Then and Now. IEEE Security and Privacy, 3(4):26-31, 2005. [pdf] [bib]
Michael D. Bailey, Evan Cooke, Farnam Jahanian, Niels Provos, Karl Rosaen, and David Watson. Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic. In Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement (IMC '05), pages 239-252, Berkeley, California, USA, October 2005. [pdf] [bib]
Michael D. Bailey, Evan Cooke, Farnam Jahanian, and Jose Nazario. The Internet Motion Sensor - A Distributed Blackhole Monitoring System. In Proceedings of the 12th Annual Network & Distributed System Security Symposium (NDSS '05), pages 167-179, San Diego, California, USA, February 2005. [pdf] [bib]
Michael D. Bailey, Evan Cooke, David Watson, Farnam Jahanian, and Niels Provos. A Hybrid Honeypot Architecture for Scalable Network Monitoring. Technical Report CSE-TR-499-04, University of Michigan, Ann Arbor, Michigan, USA, October 2004. [pdf] [bib]
Evan Cooke, Michael D. Bailey, Z. Morley Mao, David Watson, Farnam Jahanian, and Danny McPherson. Toward Understanding Distributed Blackhole Placement. In Proceedings of the 2nd Workshop on Rapid Malcode (WORM '04), pages 54-64, Washington, District of Columbia, USA, October 2004. [pdf] [bib]
Michael D. Bailey, Farnam Jahanian, G. Robert Malan, Jose Nazario, Dug Song, and Robert Stone. Measuring, Characterizing, and Tracking Internet Threat Dynamics. In Proceedings of the OpenSig 2003 Workshop (OpenSig '03), New York, New York, USA, October 2003. [pdf] [bib]
Craig Labovitz, Abha Ahuja, and Michael D. Bailey. Shining light on dark address space. Technical Report TR-2001-01, Arbor Netwoks, Ann Arbor, Michigan, USA, November 2001. [pdf] [bib]

Contact Information:

Email:

mibailey AT eecs DOT umich DOT edu

U.S. Mail Address:

4611 CSE
University of Michigan
2260 Hayward Street
Ann Arbor, MI 48109-2121

Voice:

Phone: (734) 647-8086
Fax: (734) 763-8094

Authentication:

-Mike