Experimental Security Lab
The Experimental Security Lab (XSL) at Virginia Tech collects and analyzes the data needed to improve the security of deployed systems.
XSL is directed by Eric Pauley, Assistant Professor of Computer Science.
We are recruiting PhD students for Fall 2027. How to join.
News
Research
- IP address reuse in public clouds
Cloud providers reassign IP addresses between tenants. Configuration that still points at a released address sends the old tenant's traffic to the next holder.
- Cloud telescopes
DScope collects scanning traffic from short-lived cloud addresses instead of unused address space, and observes attacks aimed at cloud services.
- Vulnerability lifecycles
We date real-world exploitation of 63 vulnerabilities from two years of scanning traffic and use the dates to evaluate coordinated disclosure.
- Measurement ethics
Internet measurement processes data from people who could not consent to its collection. We study the norms that justify it and apply them to our own collection.
Selected publications
- Secure IP Address Allocation at Cloud ScaleNDSS 2025PDFCodeBibTeX
- Understanding the Ethical Frameworks of Internet Measurement StudiesEthiCS 2023 · Best PaperPDFSlidesDOIBibTeX
- The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-DaysACM IMC 2023 · Best Paper Runner-UpPDFSlidesDOIBibTeX
- DScope: A Cloud-Native Internet TelescopeUSENIX Security 2023 · CSAW Applied Research Competition finalistPDFSlidesProjectBibTeX
- Measuring and Mitigating the Risk of IP Reuse on Public CloudsIEEE S&P 2022PDFFAQDOIBibTeX
Data
- AWS spot price history
EC2 spot prices for every availability zone, instance type, and operating system, published monthly.
openlive - DScope cloud telescope data
Traffic from scanners contacting public cloud IP addresses, collected by DScope, a cloud-native interactive Internet telescope on AWS. Operated by Terrace Networks.