William Robertson got his first taste of how vulnerable the world’s cyberinfrastructure is during the 1990s, when he hacked into computer networks. He did it for the adrenaline rush, says the assistant professor, and out of sheer curiosity.

“I was interested in system penetration and doing remote reconnaissance just to see what I could find,” Robertson recalls. “I discovered that anyone with the requisite knowledge could uncover all kinds of fascinating data.”

For several years, he honed his hacking acumen, breaking into secure networks and poring over private information for fun, without any intention of doing harm. But the allure of aimless hacking eventually wore off, and he realized he could put his vast knowledge of Internet networks to use, finding ways to block people from stealing information and doing real harm.

William Robertson, assistant professor of computer and information science and electrical and computer engineering

Today, Robertson has dual appointments in the College of Engineering and the College of Computer and Information Science at Northeastern. A leading expert in detecting and preventing Web-based attacks, he is part of a contingent of interdisciplinary faculty uniquely qualified to train the next generation of cyberscientists to outfox even the most ruthless hackers and to build truly secure software.

A 21st Century Challenge
The urgency behind putting together these teams of cybersecurity specialists is very real. Consumer cybercrime costs the global economy $110 billion a year, according to one of the largest studies on the growing threat of hackers, online scams, “phishing” attacks, and exploitative malware. The report, issued by the security software company Symantec, also found that cybercrime affects more than 1.5 million people each day.

This threat extends well beyond the personal computer. In a speech last fall in New York, former Defense Secretary Leon S. Panetta warned of the possibility of a “cyber-Pearl Harbor,” citing the vulnerability of the nation’s water supplies, power grids, and passenger trains.

Stephen Flynn, professor and founding co-director of the university’s George J. Kostas Research Institute for Homeland Security, echoes Panetta’s sentiment. He testified on the point at a congressional hearing on cybersecurity last spring. “Many of the software programs that support our critical infrastructure are wide open for exploitation,” he explains. “We don’t just risk a disruption of service or identity theft, but also mass sabotage and mass loss of life.”

Stepping Up the Response
In 2008, the U.S. government began to heed these warnings, establishing the Comprehensive National Cybersecurity Initiative. In 2010, the Obama administration stepped up the response with an expanded National Initiative for Cybersecurity Education. The U.S. Department of Homeland Security followed suit not long after with the formation of a CyberSkills Task Force aimed at building a world-class cybersecurity team to combat the looming crisis.

Much work lies ahead. Some 700,000 new information security professionals will be needed by 2015, according to a 2011 study sponsored by the International Information Systems Security Certification Consortium.

Northeastern is helping to chip away at that ambitious workforce goal by producing top cyberscientists through its master of science in information assurance program, established in 2007. The interdisciplinary curriculum blends the latest theory on information technology, law, policy, and human behavior with Northeastern’s signature experiential-learning opportunities.

Designated by the National Security Agency as a Center of Academic Excellence in Information Assurance Research and Education, Northeastern recently earned a five-year, $4.5 million grant from the National Science Foundation to train 32 additional graduate students through the CyberCorps Scholarship for Service program. The grant covers students’ tuition, fees, and living expenses for two years and includes a generous
annual stipend for academic and professional pursuits. In return, students agree to complete an information assurance co-op or internship and work for a national laboratory or federal agency for two years after graduation.

The Deep End
One of the reasons the university is recognized as a hub of information assurance education is that students  learn to think on their feet. They’re immediately thrust into real-world situations—both in co-op and in the classroom—through Northeastern’s rare blend of experiential learning and academics.

The curriculum is centered around a series of complex laboratory and independent assignments, such as securing a closed-circuit server that has received 200,000 failed login attempts from a cast of fictional cybercriminals or assuming the mindset of a hacker and extracting cryptographic information from hardware. Using industry tools and commercial-grade networking equipment, students get inside the heads of these fictional hackers and come up with viable solutions.

Samuel Jenkins, MS’12, graduated in May with the second Scholarship for Service class. Jenkins, who has an undergraduate degree in German studies from Swarthmore College, returned to his childhood love of tinkering with computers and decided to pursue graduate work in cybersecurity. He now works as a security analyst with the Executive Office of the President of the United States, providing information technology services to the White House.

Jenkins liked Northeastern’s blend of technical and nontechnical courses. “When I began the program, I felt as if I had been thrown into the deep end,” he recalls. “And I wanted to be in the deep end. My professors were very responsive to my technical questions and extremely knowledgeable real-world practitioners. I applied to the program because its multidisciplinary approach to computer security fit well with my diverse interests.”

Thinking Like a Thief
Northeastern’s experiential approach also affords students a unique opportunity to understand the many scenarios cybersecurity specialists encounter every day.

One of the biggest challenges experts face in trying to shut down cybercrime is that cybercriminals continually morph their malware, making it virtually impossible to catch and prosecute them. Robertson likens the system to a global Internet mafia, with individuals sitting behind backlit screens in nondescript locations, coding their way into people’s sensitive data around the clock.

The key, says Robertson and others, is to think like the cyberthieves. He and his team spend their days studying malicious software, discovering how it is constructed, how it works, and how it behaves. With that background, they are able to cripple the criminals’ ability to operate.

Engin Kirda, Sy and Laurie Sternberg Interdisciplinary Associate Professor of Computer Science

This objective takes more than trained cyberdetectives. It requires cutting-edge technology that can detect, analyze, and prevent virtual attacks. For instance, Robertson uses machine-learning techniques to develop security programs that “know” what normal user behavior looks like. Then, when a threat presents itself by demonstrating anomalous behavior, the program can automatically intervene to end the threat.

He is also working with his colleague Engin Kirda, co-director of Northeastern’s Systems Security Lab, to make mobile phones more secure. Backed by a $2 million grant from the Defense Advanced Research Projects Agency, the duo is developing tools to identify and defend against malicious activity in Android applications.

DARPA, says Kirda, also the director of Northeastern’s Information Assurance Institute and the Sy and Laurie Sternberg Interdisciplinary Associate Professor of Computer Science, is particularly interested in blocking acts of cyberespionage. “If a mobile phone is compromised,” he points out, “then someone could potentially steal data by activating its camera or microphone.”

Agnes Chan, principal investigator on the NSF education grant, whose research expertise lies in cryptography and communication security, is developing a tool to hide information-retrieval patterns from cloud computing providers, some of which cannot be trusted. The real-world applications are many, ranging from protecting financial information to patient confidentiality.

Agnes Chan, professor of computer and information science and associate dean

Jenny Mankin, a doctoral candidate in computer engineering who conducts research in Northeastern’s Computer Architecture Research Laboratory, spent the last four years developing the infrastructure for analyzing and detecting malware, such as computer viruses, worms, and “Trojan horses,” which appear to perform desirable functions but instead facilitate unauthorized access to steal information or harm computers. Mankin hopes that computer security software companies will eventually incorporate her tool into products that ward off malware attacks.

The Chase
But even with the introduction of sophisticated technology, the human factor remains essential. “We can have all the latest technology in the world,” Chan reminds us, “but if we don’t have the people to manage it, then [our networks] will be vulnerable.”

With the backing of the Scholarship for Service grant,  Northeastern’s role in providing that human capital will continue to grow. In January, Robertson and David Kaeli, co-principal investigators on the NSF grant, attended the Scholarship for Service’s annual job fair in Washington, D.C. Students had a chance to meet with representatives of some 500 federal agencies.

“Congress talks about the Scholarship for Service program whenever it wants to fund a new cybersecurity initiative,” says Kaeli, a virtualization technology expert and professor and associate dean of electrical and computer engineering. “It receives the most credit for training the next generation of cyberexperts.”

David Kaeli, professor of electrical and computer engineering and associate dean

Northeastern is also designated by the NSA as a National Center for Academic Excellence in Cyber Operations, an honor shared by only four universities nationwide. The designation, another part of President Obama’s cybersecurity education initiative, allows undergraduate computer science students to specialize in cyberoperations by taking high-level courses in software vulnerability, network security, and the fundamentals of information assurance.

“Honors like this indicate that our research is vibrant, our faculty is well-funded, and we are working on problems that are relevant to the intelligence and security community,” says Chan.

And they’re problems that aren’t going away anytime soon. As Mankin puts it, “Security researchers and malware writers are playing a game of cat and mouse. I think it’s possible that the race will never end.”

Ear­lier this month, the U.S. gov­ern­ment declared that the emerging H7N9 bird flu “poses a sig­nif­i­cant poten­tial for a public health emer­gency.” The virus, a rel­a­tive of other bird flus we’ve seen pre­vi­ously like H1N1 and H5N1, orig­i­nated in China and results in a severe res­pi­ra­tory infec­tion and, in some cases, death. While the virus is not, at this time, trans­mis­sible between humans, researchers believe that just a few genetic muta­tions could change that. Net­work sci­en­tist Alessandro Vespig­nani, the Stern­berg Family Dis­tin­guished Uni­ver­sity Pro­fessor of physics, com­puter sci­ence, and health sci­ences, is map­ping the disease’s pro­gres­sion in his lab. We asked him to dis­cuss the pan­demic poten­tial of the virus and explain how this strain dif­fers from those in the past.

One of the world’s foremost network scientists, Barabási is leading an interdisciplinary team of researchers on a quest to construct the human “diseasome”—the sum of all human diseases and the ways they relate to one another.

This map of human diseases would revolutionize medicine on all levels, says Barabási, enabling researchers to understand the molecular and genetic linkages between one disease, like asthma, and other respiratory diseases.

The team has already developed a map of 70 of the most common diseases based on their protein and metabolite interactions. As the pool of knowledge about those molecular interactions expands, so will the map.

Once the diseasome is fully mapped, Barabási says, physicians could use individual genetic mutations as a predictor of future health. And pharmaceutical researchers would have a powerful tool to design drugs with greater precision and effectiveness.

Alessandro Vespignani, Sternberg Family Distinguished University Professor of Physics, Computer Science, and Health Sciences is a pioneer in the emerging field of digital epidemiology, which promises to revolutionize the way we approach public health issues involving the spread of infectious diseases.

He notes that it took nearly a decade for the Black Plague to spread through Europe, while, thanks to modern transportation, the 2009 H1N1 pandemic swept across the globe in just four months.

Vespignani has developed computational modeling tools that would transform preemptive public-health efforts the next time a contagion decides to hitch a lightning–fast ride around the world.

Using data such as airline traffic and cell phone usage, Vespignani creates maps of human mobility across the planet. Combining that data and the specific dynamics of a disease, his computational models can predict epidemic outbreaks with great precision. In fact, Vespignani and his team confirmed that their model accurately predicted—with a lead time of several months—the peak of the 2009 H1N1 outbreak in 42 countries in the Northern Hemisphere.

Amy Sliva is a pioneer in the emerging field of security informatics, taking a Big Data approach to mining the labyrinth of terrorism’s contextual markers to predict when and where violence might erupt.

It’s a method suited to the times, says Sliva, because the information stream related to violence and terrorism has never been more abundant. From smartphone activity to broadcast media reports, we have at our fingertips the perfect storm of indicators when large-scale violence is brewing. The question is, how do we sort and make sense of all the clues we have at our disposal?

By using many of the same principles that experts in bioinformatics use to map and predict disease, Sliva and her colleagues are building artificial intelligence models to analyze and forecast potential threats. Such predictions could help officials make smarter security policy, prevent bloodshed, and save lives.

Among researchers focused on cleaning up the world’s black market of Internet insecurity, Robertson is a leader—in large part because he has learned to think like a cybercriminal.

This highly sophisticated set of hackers, members of a global Internet mafia, sit quietly behind backlit screens, coding their way into our sensitive data. From credit card numbers to computing power, nothing is off limits. So Robertson spends his days studying their malicious software: how it is constructed, how it works, and how it behaves. With that knowledge, he can create more robust security tools and safer systems.

For instance, Robertson uses machine-learning techniques to develop security programs that recognize the normal behavior of users and other programs. Then, when a threat presents itself and demonstrates anomalous behavior, the security program can automatically intervene to stop it. Robertson’s goal is not to catch the criminals, but rather to fatally cripple their ability to operate.

Healthy adults with fully developed vocal systems convey more information by producing speech and changing the melody of their voice.

But children and adults with severe speech-motor disorders tend to rely more heavily on melodic cues, such as volume and duration. Patel uses her understanding of speech melody to create computational tools that can dramatically improve a disordered speaker’s ability to interact with the world.

In one project, Patel overlays meolodic fluctuations from a disordered speaker’s voice with a sentence spoken by a healthy donor of the same demographic. By merging the two signals, she creates a novel synthetic voice that conveys the user’s personal identity.

For children learning how to read, Patel also develops digital tools with visual cues—such as a rising and falling line—that signal pitch changes. Research suggests that by understanding the melody of speech earlier, children may achieve greater reading comprehension.

Timothy Bickmore is using technology to help patients manage their own healthcare in a way no one else has. Meet Tanya, an avatar or “relational agent” in Bickmore’s phrase, who can serve as a nurse and personal health advocate.

By studying the behavior of real nurses and then turning his observations into complex computational algorithms, Bickmore is able to create avatars that show empathy and converse naturally with patients. They can access a patient’s medical records and provide information about drug treatments.

Avatars have unlimited time to walk patients through often confusing postclinic procedures, such as when to take their medication and how to dress a wound—abilities relevant to the critical issue of hospital readmissions.

In fact, a majority of patients involved in early clinical trials—particularly those with limited health and computer literacy—reported feeling more at ease interacting with avatars like Tanya than with live nurses.

Wearable devices: Matthew Goodwin is using sensors, such as the device shown here on his wrist, to accurately monitor anxiety and repetitive behaviors in children with autism.

Here’s a scenario that Matthew Goodwin is all too familiar with. A child with autism is sitting at a desk, seemingly checked out, staring into space. A teacher asks the child to get back to work, and the child stands up, flips over the desk and runs out of room.

“One second he’s fine and the next he’s having a tantrum,” says Goodwin, assistant professor of health sciences at Northeastern University in Boston.

But looks can be deceiving: Goodwin has shown that some children sitting and looking calm may actually be deeply anxious, with a pulse racing at 120 beats per minute. And the child’s apparent ‘spacing out’ may be an attempt to self-regulate his physiology.

“If I knew the child’s internal state, I wouldn’t place a demand on that kid. I might encourage him to relax or take a walk,” says Goodwin. “I would adjust my interaction style to calm him back down.”

The problem is that many children on the more severe end of the autism spectrum are nonverbal, and even those who can talk often have difficulty identifying and expressing how they feel. Goodwin is trying to develop alternative ways to measure these children’s internal states and in turn help teachers and parents modulate their interactions with them.

Goodwin is tackling this task with myriad monitors — from ceiling cameras and microphones to wearable sensors that track heart rate, temperature and sweat — and computer algorithms. Together, these may be able to determine when a child is stressed and what triggered the episode, and to evaluate the most effective strategy for making him feel better.

Similar tools could be used to assess treatments as well — automated monitoring may provide a way to more quantitatively measure changes in hyperactivity, for example, and even irritability and aggression, which are typically measured by short questionnaires.

Researchers who have worked with Goodwin uniformly comment on his unique ability to think about how to apply technology to autism care.

“Many people are experts in the autonomic nervous system, signal processing and hardware design, but he is able to bring these roles together and think about how we can develop methodologies that can ultimately impact care,” says James Rehg, professor of interactive computing at the Georgia Institute of Technology and a collaborator.

Early entry:

Goodwin began working with children who have autism early in his career, volunteering at a school for children with autism for 20 hours a week during a year of college spent at Oxford University in the U.K.

“He’s an experimental psychologist but also really tuned in to the kids — I’ve been in this field for 30 years, and there are not a lot of people like that,” says Terry Hamlin, chief of staff at the Center for Discovery in Harris, New York, a residence facility on a farm in the Catskills for people with autism and other disabilities. “He also makes wonderful connections and brings people together.”

The children at the Oxford center had challenges making eye contact and with joint attention, classical features of autism, Goodwin recalls. “But after showing up repeatedly and just spending time together, they would start to look at me and talk to me and show some empathy toward me,” he says. “Around then, I started reading the literature, which says these kids have no theory of mind, but that didn’t match the behavior I saw.”

Goodwin returned to the U.S. for college in 1995 and began interning at the Groden Center in Rhode Island, a day and residential program that serves profoundly impaired children with autism.

He noticed that stress and anxiety often aggravated the children’s behavioral problems. The clinical staff would try to calm the children down using a variety of methods, such as deep breathing or cognitive exercises. Goodwin says he wanted to understand what triggered the anxiety in the first place, and how effective the different methods were.

“That requires some measure of how stressed or non-stressed a person is,” says Goodwin. But if children can’t identify or communicate how they feel, how can a scientist adequately measure it? Or efficiently treat it? “Most stress research is based on surveys or direct behavioral observation, and herein lies the problem,” Goodwin says.

Flapping hands:

Fortunately for Goodwin, two technology trends were then beginning to be incorporated into the study of human health.

The first was wearable computing — sensors on the body or in clothing or accessories that can measure an individual’s biology or behavior. These are especially advantageous for studying children with autism, who often have sensory and movement issues that make traditional monitoring technologies unsuitable. They can be also used in real-world settings, such as the home or classroom, and can monitor a child for hours, days or weeks, rather than in a limited lab session.

Magic wristband: The Affectiva sensor tracks stress and other measures in children with autism, wirelessly transmitting the data to a computer.

The second trend was ubiquitous computing, in which sensors built into spaces, such as classrooms, record what’s going in the environment.

One of Goodwin’s first targets was hand flapping, a repetitive behavior seen in 70 percent of children with autism. “We don’t know why kids do this. We don’t know if it’s stimulatory or self-soothing,” says Goodwin. “It’s certainly socially stigmatizing.”

Hand flapping and other repetitive behaviors are a hot-button issue among families, educators and clinicians. Some education programs try to stop children from engaging in these behaviors, but that can make the child agitated or aggressive.

Goodwin is passionate about trying to understand these behaviors. “We ignore them, restrain them or medicate them,” says Goodwin. “But before we decide what to do about it, let’s try to decide why they do it.”

Preliminary research suggests that people with autism engage in repetitive behaviors for a variety of reasons — sometimes to calm down, sometimes to excite themselves. Hand flapping may even act as form of communication, showing happiness when they get something they want or frustration when they can’t get out of a situation they don’t like.

“If this is how they communicate, regulate stress and sensation, and feel their body, the last thing I want to do is stop them from doing it or medicate them,” says Goodwin.

Most studies measuring restricted and repetitive behaviors in autism use either parent report or direct observation, both of which can be unreliable. Two observers rating repetitive behaviors in real time agree only a third of the time, says Goodwin, largely because the behaviors can start and stop so quickly. Video recording is more accurate but is slow and expensive.

For his doctoral dissertation, Goodwin analyzed data from children with autism who wore three accelerometers — small devices that detect movement — one on each wrist and one around the waist. He created algorithms that, after a short training period, can automatically detect when a child is flapping or rocking, and found that the three devices together have an accuracy of 90 percent¹.

Complex sensors:

Goodwin’s latest work incorporates more complex sensors, which can track skin conductance — an indirect measure of the autonomic nervous system — as well as heart rate, movement and body temperature.

Goodwin strapped one such device around my wrist when I visited his lab, and we watched as it conveyed a stream of data to a laptop. A set of lines on the screen rose and fell throughout the conversation as my attention focused or wavered.

One of the biggest challenges of the project is to figure out how to interpret the sensor’s signals. Unlike, say, an electrocardiogram, which records electrical signals from the heart, there is no standard pattern for skin conductance.

Goodwin and his colleagues are analyzing data collected from ten children with autism wearing accelerometers and heart rate monitors in a classroom during a variety of tasks and emotional states.

Their goal is to determine whether repetitive behaviors are triggered by particular activities or internal states. The answer is unlikely to be simple: According to their preliminary findings, repetitive movements appear to be linked to physiology in some children but not in others.

Goodwin is also part of a five-year, $10 million project, funded by the National Science Foundation, to create automated tracking technology to help diagnose people with autism and track the outcome of therapies. The project involves bringing together a mix of sophisticated technologies, including cameras, sensors and machine learning — computational techniques that learn from data — to solve clinical problems.

He is also working with Hamlin on a pilot project at the Center for Discovery, set in a classroom outfitted with ten ceiling cameras and two microphones. The children and staff all wear wireless monitors that record their heart rate, temperature and movement.

The researchers are creating algorithms to automatically identify problem behaviors, such as wandering off or self-injury, based on data from the sensors. They can also look at the physiological data leading up to a behavioral outburst, as well as the physiological consequences of the behavior.

Hamlin says they have been recording for about a year and that the computers are now able to automatically recognize different behaviors.

The next challenge will be figuring out what to do with the enormous volume of data being collected. “We have to get it into the hands of clinicians to figure out which measures are predictive,” Goodwin says. He is also setting up instruments at his own testing center at Northeastern.

Goodwin has also helped launch a new graduate program at Northeastern that bridges technology and medicine.

“I was trained as a behavioral scientist and got interested in computer science late in life,” says Goodwin. (At 36, late is a relative term.) “The idea of the program is to train the next generation simultaneously, so they will be able to do what we can’t.”

References:

1: Goodwin M.S. et al. J. Autism Dev. Disord. 41, 770-782 (2011) PubMed

Article originally appeared at the Simons Foundation Autism Research Initiative

Shay McDo­nough, a senior infor­ma­tion sci­ence major, spent her first two co-​​op cycles at the phar­ma­ceu­tical giant Novartis working as a pro­grammer, ana­lyst, and project man­ager. She honed her skills and received valu­able real-​​world work expe­ri­ence at a large firm. For her third co-​​op, she went in a dif­ferent direction—working for a startup. It’s an expe­ri­ence that opened her eyes to an arena that has since become her passion.

“The beauty of working at a startup is that, even as a co-​​op or an intern, there is so much to do that you have no other choice but to get involved in every­thing,” McDo­nough said. Her co-​​op posi­tion was at Boston-​​based EverTrue, which builds mobile net­working plat­forms and was the result of a new col­lab­o­ra­tion between North­eastern and the startup accel­er­ator Mass­Chal­lenge. The part­ner­ship is aimed at pairing stu­dents with star­tups for their co-​​op posi­tions. McDo­nough thrived in her role—even staying on part-​​time after her co-op—and is seeking that kind of envi­ron­ment after graduation.

“I was asked to do so many things at EverTrue,” she said. “I know I have a lot to give.”