CERIAS Weekly Security Seminar - Purdue University

GPS was formally approved as a U.S. Department of Defense program in December 1973 and developed as a military system for precise three-dimensional positioning, navigation, and timing—driven in large part by requirements for accurate munitions and missile guidance. The first developmental satellite launched in 1978; the system reached full operational capability in 1995. Civilian access was authorized beginning in the 1980s and later expanded widely into aviation, maritime shipping, and consumer devices. Its radio-frequency signals in the L-band enable global positioning through time-of-flight ranging, yet the same open, relatively weak signals that made GPS ubiquitous have become a systemic vulnerability. Recent incidents illustrate the stakes: a man jamming the Denver International Airport in January 2022 disrupted GPS over a roughly 50-nautical-mile radius for about 33 hours, affecting aircraft and other critical infrastructure; GPS jamming contributed to the 2024 Azerbaijan Airlines crash (38 fatalities) after loss of navigational aids near Grozny; AIS anomalies linked to GPS interference preceded the 2025 Front Eagle–Adalynn tanker collision near the Strait of Hormuz; and widespread jamming in Ukraine has driven the rapid adoption of fiber-optic-controlled drones. Mitigation efforts range from stronger LEO signals (Xona Space Systems' Pulsar) to physical tethers that bypass radio entirely, multi-modal feature fusion architectures that incorporate optical flow and geo-registration (such as Northrop Grumman's ANAGDA), and inertial/photonic systems. This talk examines these approaches as partial mitigations of a radio-based paradigm and contrasts them with fundamentally different sensing modalities—such as visual and topological fingerprinting of environmental features developed by Xphera—that reframe the positioning problem itself. Ultimately, this illustrates a broader cybersecurity lesson: every technology has inherent weaknesses, and it is common to develop tunnel vision focused solely on mitigating the risks of the original solution. Sometimes the most effective path forward is to return to identify the problem at a foundational level and apply different technologies to achieve the same outcomes. About the speaker: JohnGabriel is a Saint Louis University alumnus with a bachelor's degree in Forensic Science. Growing up and helping his Vietnamese refugee parents navigate new cities and airports, he pivoted to his passion in spatial navigation and founded Xphera in 2021. At Xphera, he spearheaded partnerships with airports and local government and managed LiDAR surveys at international airports ranging from 20K to 1M+ square feet. Xphera's offline Visual GPS/AltPNT system xEarth restores positioning and navigation in GPS-denied environments at ±15 cm accuracy using computer vision, LiDAR, and terrain maps. The system is currently deployed at the Indianapolis International Airport (IND) to enable spatial positioning in GPS-denied, TSA-secure zones. xEarth offers a resilient, offline ground layer that closes the most critical gap in the United States' multi-source PNT strategy. JohnGabriel is a Forbes 30 Under 30 lister, and his work with GPS and navigation has been featured by the European Business Review.

Modern communication networks face growing challenges in performance, security, and resilience as superintelligence,the Internet of Things, and high-performance computing continue to evolve. This talk explores how AI-driven techniques can transform network data into actionable intelligence to improve efficiency, adaptability, and security. It highlights three interconnected research areas: intelligent congestion control, network traffic fingerprinting, and resilient computing systems. First, machine learning techniques, including Gated Recurrent Units (GRUs), are examined for identifying TCP congestion control protocols and analyzing network behavior. Second, deep learning approaches for browser and IoT device fingerprinting using encrypted traffic are discussed, emphasizing their applications in network security. Third, fault-tolerant and adaptive mechanisms for improving the reliability of heterogeneous computing environments are explored. The talk concludes by discussing emerging opportunities for integrating large language models, knowledge graphs, and intelligent decision-making to develop more efficient, secure, and self-adaptive communication networks. About the speaker: Dr Sandhya Aneja is an Assistant Professor of Computer Science at Marist College in Poughkeepsie, New York. Her primary areas of interest include Wireless Networks, High-Performance Computing, the Internet of Things, and Artificial Intelligence technologies—machine Learning, machine Translation, and deep Learning.

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a security myth works: a plausible claim, repeated in enough checklists, becomes infrastructure, and nobody audits infrastructure that seems to be working. The newest myth is that AI makes security professionals optional. This talk separates the three claims that marketing bundles together. AI tools do find flaws in shipped code, and the evidence from Google, DARPA, Mozilla, and Microsoft is real. Autonomous agents do add kinds of risk that no deployed security architecture was designed for. Neither fact implies that fewer people are needed. The vulnerability flood of 2026 is an audit of forty years of deferred engineering, not a crisis AI created, and the bottleneck has moved to the human capacity to verify, coordinate, and fix. The organizations that bet on replacement are already rehiring, often at a premium, the judgment they discarded. Open positions in the field number in the hundreds of thousands. For students, the message is direct: AI is not replacing you; it is generating your workload. The talk closes with what grows, what shrinks, and  how to prepare. The capacities that make you a professional are the ones that do not become obsolete with the next model release. About the speaker: Eugene H. Spafford is a Distinguished Professor of Computer Science at Purdue University and the founder and Executive Director Emeritus of CERIAS. He is co-author of*Cybersecurity Myths and Misconceptions *(Addison-Wesley, 2023).

In contemporary digital environments, individuals increasingly exchange personal privacy for the convenience afforded by online services, often without full awareness of the breadth or implications of this trade-off. This study examines this phenomenon through a comparative analysis of the data practices of major communication, social networking, and dating applications, including Meta, Instagram, WhatsApp, TikTok, LinkedIn, Google,WeChat, Signal, Telegram, Snapchat, and others. By systematically reviewing privacy policies and related disclosures, the research evaluates how these platforms collect, process, and utilize a wide range of user data, encompassing identifiers such as IP address, location information, demographic attributes,behavioral telemetry, device metadata, and access to sensitive content. The analysis reveals substantial heterogeneity in data collection practices - both in terms of scope and transparency - across different categories of applications and geopolitical ecosystems. Notably,privacy-oriented services such as Signal demonstrate markedly reduced data gathering compared to mainstream or commercially driven platforms. An illustrative comparison between high-privacy and low-privacy application models highlights the extent to which features that enhance user convenience,including personalization algorithms and streamlined authentication, are frequently enabled by extensive behavioral tracking. The findings underscore the imperative for security professionals to advocate for stronger privacy standards, promote informed consent, and encourage data-minimizing design principles. Ultimately, the study argues that safeguarding privacy is not solely a technical undertaking but also a cultural and ethical responsibility requiring leadership within the securitycommunity. About the speaker: Dr. Tzvetanov has served as a Graduate Researcher at Purdue University for the past six years, focusing on Homeland Security, Cyber Threat Intelligence (CTI), and Influence Operations. Concurrently, he has served as Instructor of Record for graduate-level courses in Cybersecurity and Homeland Security.For the past three years, Dr. Tzvetanov has also served as CISO and Director of Security Engineering at Hydrolix. Prior to this role, he held positions including CTI Lead, Principal Security Engineer and Architect,and Red Team Operator at major technology companies such as Cisco, Yahoo!, and Google. Throughout his career, he has authored training materials, whitepapers, and academic publications covering distributed denial-of-service (DDoS)attack mitigation and investigation, cyber threat intelligence, privacy, and influence operations. He has also contributed to numerous law enforcement investigations, including providing expert witness testimony in federal court.Dr. Tzvetanov is an active contributor to the global cybersecurity research and incident response communities. He has served on program committees for ShmooCon, FIRST, NANOG, BayThreat, and the Underground Economy. He is an active participant in several Special Interest Groups within the Forum of Incident Response and Security Teams (FIRST), has contributed to the Honeynet Project, and was a principal organizer of the Bay Threat security conference. He also led the Radio Communications Department at DEF CON.Dr. Tzvetanov holds a Ph.D. and an M.S. in Technology, both with a concentration in Homeland Security; an M.S. in Digital Forensics and Investigations; and a B.S. in Electrical Engineering with a concentration in Radio Communications.

Internet users increasingly interact through emerging digital platforms and communities, which create complex online safety, security and privacy challenges that aredifficult to navigate. This talk will present insights from our research to understand the rising online safety landscape and improve online safety governance. I will first present our work characterizing online community responses to globalized scam-driven human trafficking, which received a Best Paper Award at ACM CHI 2026. Scam-driven cross-border human trafficking has become a long-standing societal crisis in Asia. Through our analysis of community responses on RedNote, a major Chinese social media platform, we identify several key challenges, including cultural values that can both enable trafficking and hinder survivors' recovery. Although online communities develop and share protective strategies, these efforts are complicated by uncertainty about the reliability of available support and difficulties in cross-border coordination. I will discuss the implications of these findings for prevention, platform governance, and international cooperation against scam-driven trafficking. Building on this work, I will then highlight opportunities for more proactive approaches to governing digital platforms and online communities, drawing on insights from our parallel research efforts. Finally, I will reflect on methodological lessons from our research and motivate discussion about future opportunities for studying and improving online safety, security and privacy in emerging digital environments. About the speaker: Jingjie Li is a Lecturer (Assistant Professor) in the School of Informatics, University of Edinburgh. His work spans privacy, security, and online safety,with the goal of seamlessly integrating these principles into emerging human-centered technologies such as smart homes, augmented and virtual reality, and AI-enabled systems. He published impactful work at premier conferences in security and privacy (IEEE S&P, USENIX Security, and ACM CCS), human-computer interaction (ACM CHI and ACM CSCW), and computer systems (IEEE/ACM ISCA, IEEE TMC and IEEE TVLSI). His interdisciplinary work received multiple best paper awards and has informed industry development and policymaking with key stakeholders across countries. Before joining the University of Edinburgh, Jingjie obtained a Ph.D. degree from the University of Wisconsin-Madison in 2023. For more information, please visit his homepage: www.jingjieli.me