Stefan Savage (born 1969) is an American

computer science Computer science is the study of computation, automation, and information. Computer science spans theoretical disciplines (such as algorithms, theory of computation, information theory, and automation) to practical disciplines (includi ...

researcher, currently a Professor in the Systems and Networking Group at the

University of California, San Diego The University of California, San Diego (UC San Diego or colloquially, UCSD) is a public land-grant research university in San Diego, California. Established in 1960 near the pre-existing Scripps Institution of Oceanography, UC San Diego is t ...

. There, he holds the Irwin and Joan Jacobs Chair in Information and Computer Science. Savage is widely cited in

computer security Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, t ...

, particularly in the areas of email spam, network worms and malware propagation,

distributed denial of service In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host conne ...

(DDOS) mitigation and traceback, automotive hacking and wireless security. He received his undergraduate degree at

Carnegie Mellon Carnegie may refer to: People *Carnegie (surname), including a list of people with the name *Clan Carnegie, a lowland Scottish clan Institutions Named for Andrew Carnegie * Carnegie Building (Troy, New York), on the campus of Rensselaer Polyte ...

and his Ph.D. from the

University of Washington The University of Washington (UW, simply Washington, or informally U-Dub) is a public research university in Seattle, Washington. Founded in 1861, Washington is one of the oldest universities on the West Coast; it was established in Seattl ...

Career

In 1999, Savage's research team published ''TCP Congestion Control with a Misbehaving Receiver'', which uncovered protocol flaws in the TCP protocol that carries most Internet traffic. By exploiting these flaws, Savage proposed means for attackers to evade

congestion control Network congestion in data networking and queueing theory is the reduced quality of service that occurs when a network node or link is carrying more data than it can handle. Typical effects include queueing delay, packet loss or the blocking of ...

, allowing attackers to monopolize crowded network connections that would otherwise be shared by multiple users. This was the first paper to address congestion control evasion as a

vulnerability Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally." A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, com ...

, rather than as a theoretical design implication. That same year, Savage published "Sting", a paper and software tool that presented a mechanism to abuse quirks in the TCP protocol to allow a single party to infer bidirectional packet loss, a valuable contribution to traffic measurement. In 2000, Savage's team published ''Practical Network Support for IP Traceback'', which proposed a simple stochastic extension to

internet router A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions between networks and on the global Internet. Data sent through a network, such as a web page or email, is ...

s that would enable them to trace floods of traffic back to their origin. IP traceback is a major open networking research question, with significant implications towards DDOS mitigation: if IP traffic can be traced,

Internet Service Provider An Internet service provider (ISP) is an organization that provides services for accessing, using, or participating in the Internet. ISPs can be organized in various forms, such as commercial, community-owned, non-profit, or otherwise privat ...

s can track down and halt DDOS floods. Savage later co-founded Asta Networks, which offered a product that addressed these problems. In 2001, Savage, with colleagues at UCSD and CAIDA, published ''Inferring Internet Denial-of-Service Activity'', which introduced the idea of the

network telescope A network telescope (also known as a packet telescope, darknet, Internet motion sensor or black hole) is an Internet system that allows one to observe different large-scale events taking place on the Internet. The basic idea is to observe traffic ta ...

and provided major empirical results regarding DDOS attacks. Follow-on work has provided insight into the spread of network worms, including

Code Red II Code Red II is a computer worm similar to the Code Red worm. Released two weeks after Code Red on August 4, 2001, it is similar in behavior to the original, but analysis showed it to be a new worm instead of a variant. Unlike the first, the seco ...

and SQL Slammer. In 2003, John Bellardo and Savage published ''802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions'', which introduced practical attacks on

802.11 IEEE 802.11 is part of the IEEE 802 set of local area network (LAN) technical standards, and specifies the set of media access control (MAC) and physical layer (PHY) protocols for implementing wireless local area network (WLAN) computer com ...

wireless protocol flaws that would allow attackers to force legitimate clients off wireless networks. The paper is also a notable example of applied reverse engineering in an academic setting; Bellardo and Savage reverse engineered the Intersil wireless chipset, finding an undocumented diagnostic mode that allowed them to directly inject malicious wireless packets onto a network. In 2004, Savage and

George Varghese George Varghese (born 1960) is a Principal Researcher at Microsoft Research. Before joining MSR's lab in Silicon Valley in 2013, he was a Professor of Computer Science at the University of California San Diego, where he led the Internet Algorithm ...

led a research team that published ''Automated Worm Fingerprinting'', which introduced a novel hashing technique that allowed network operators to monitor network traffic and uncover data patterns that were "propagating", spreading across the network at an unusual rate. Propagating traffic is a strong indicator for network worm outbreaks, a key unsolved problem in

network security Network security consists of the policies, processes and practices adopted to prevent, detect and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves th ...

. Varghese later co-founded Netsift to capitalize on this research; Cisco purchased Netsift in 2005. In 2005, Ishwar Ramani and Stefan Savage developed Syncscan algorithm that cuts the time needed to switch between Wi-Fi access points. In 2010 he was named a Fellow of the Association for Computing Machinery. In 2013, Savage received the ACM SIGOPS Mark Weiser Award. In 2015, he received the ACM Prize in Computing for "innovative research in network security, privacy, and reliability that has taught us to view attacks and attackers as elements of an integrated technological, societal, and economic system." In 2017, he was named a

MacArthur Foundation The John D. and Catherine T. MacArthur Foundation is a private foundation that makes grants and impact investments to support non-profit organizations in approximately 50 countries around the world. It has an endowment of $7.0 billion and p ...

Fellow (the "genius grant") for his body of work. Savage was elected a Fellow of the

American Academy of Arts and Sciences The American Academy of Arts and Sciences (abbreviation: AAA&S) is one of the oldest learned societies in the United States. It was founded in 1780 during the American Revolution by John Adams, John Hancock, James Bowdoin, Andrew Oliver, a ...

in 2021.

References

External links

Stefan Savage's home page at UCSD
{{DEFAULTSORT:Savage, Stefan American computer scientists Computer security academics University of California, San Diego faculty University of Washington alumni Carnegie Mellon University alumni Hunter College High School alumni Living people 1969 births Fellows of the Association for Computing Machinery MacArthur Fellows Recipients of the ACM Prize in Computing Scientists from New York (state)