Alexandros Kapravelos

Research Directions in Software Supply Chain Security

Williams, L., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., … Enck, W. (2025, January 27). ACM Transactions on Software Engineering and Methodology, Vol. 34.

Same Script, Different Behavior: Characterizing Divergent JavaScript Execution Across Different Device Platforms

Zafar, A., Su, J., Datta, S., Kapravelos, A., & Das, A. (2025, November 19).

Automated Generation of Behavioral Signatures for Malicious Web Campaigns

Sarker, S., Melicher, W., Starov, O., Das, A., & Kapravelos, A. (2024, October 17). Lecture Notes in Computer Science, Vol. 15258, pp. 226–245.

JSHint: Revealing API Usage to Improve Detection of Malicious JavaScript

Sarker, S., Schulz, K., Nahapetyan, A., Das, A., & Kapravelos, A. (2024, October 17). Lecture Notes in Computer Science, Vol. 15258, pp. 205–225.

On SMS Phishing Tactics and Infrastructure

Nahapetyan, A., Prasad, S., Childs, K., Oest, A., Ladwig, Y., Kapravelos, A., & Reaves, B. (2024, May 19). 45TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY, SP 2024, pp. 1–16.

Automatic Discovery of Emerging Browser Fingerprinting Techniques

Su, J., & Kapravelos, A. (2023, April 26).

WRIT: Web Request Integrity and Attestation Against Malicious Browser Extensions

Vasiliadis, G., Karampelas, A., Shevtsov, A., Papadopoulos, P., Ioannidis, S., & Kapravelos, A. (2023, October 6). IEEE Transactions on Dependable and Secure Computing, Vol. 21, pp. 3082–3095.

Characterizing the Security of Github CI Workflows

Proceedings of the USENIX Security Symposium.

Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking

Jueckstock, J., Snyder, P., Sarker, S., Kapravelos, A., & Livshits, B. (2022, April 25). Proceedings of the ACM Web Conference 2022.

Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking

Proceedings of The Web Conference (WWW).

SoK: Workerounds - Categorizing Service Worker Attacks and Mitigations

Subramani, K., Jueckstock, J., Kapravelos, A., & Perdisci, R. (2022, June 1).

SoK: Workerounds - Categorizing Service Worker Attacks and Mitigations

Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P).

yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers

Proceedings of the IEEE SecWeb Workshop.

yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers

Ajmani, D. K., Koishybayev, I., & Kapravelos, A. (2022, May 1).

Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy

Proceedings of the Information Security Conference (ISC).

Browserprint: an Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy

Akhavani, S. A., Jueckstock, J., Su, J., Kapravelos, A., Kirda, E., & Lu, L. (2021, January 1). Lecture Notes in Computer Science.

Cookie Swap Party: Abusing First-Party Cookies for Web Tracking

Chen, Q., Ilia, P., Polychronakis, M., & Kapravelos, A. (2021, April 19).

Cookie Swap Party: Abusing First-Party Cookies for Web Tracking

Proceedings of the The Web Conference (WWW).

CrawlPhish: Large-Scale Analysis of Client-Side Cloaking Techniques in Phishing

Zhang, P., Oest, A., Cho, H., Sun, Z., Johnson, R. C., Wardman, B., … Ahn, G.-J. (2021, December 13). IEEE Security & Privacy.

CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing

Proceedings of the IEEE Symposium on Security and Privacy.

Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures

Proceedings of the IEEE Symposium on Security and Privacy.

Favocado: Fuzzing Binding Code of JavaScript Engines Using Semantically Correct Test Cases

Proceedings of the Network and Distributed System Security Symposium (NDSS).

Favocado: Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Test Cases

Dinh, S. T., Cho, H., Martin, K., Oest, A., Zeng, K., Kapravelos, A., … Shoshitaishvili, Y. (2021, January 1).

Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets

Proceedings of the USENIX Security Symposium.

Towards Realistic and Reproducible Web Crawl Measurements

Proceedings of the The Web Conference (WWW).

Towards Realistic and ReproducibleWeb Crawl Measurements

Jueckstock, J., Sarker, S., Snyder, P., Beggs, A., Papadopoulos, P., Varvello, M., … Kapravelos, A. (2021, April 19).

Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage

Proceedings of the ACM Internet Measurement Conference (IMC).

Mininode: Reducing the Attack Surface of Node.js Applications

Proceedings of the International Symposium on Research in Attacks, Intrusions and Defenses (RAID).

You’ve Changed: Detecting Malicious Browser Extensions through their Update Deltas

Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Everyone is Different: Client-side Diversification for Defending Against Extension Fingerprinting

Proceedings of the USENIX Security Symposium.

Unnecessarily Identifiable: Quantifying the fingerprintability of browser extensions due to bloat

Starov, O., Laperdrix, P., Kapravelos, A., & Nikiforakis, N. (2019, May 13).

Unnecessarily Identifiable: Quantifying the fingerprintability of browser extensions due to bloat

Proceedings of the World Wide Web Conference (WWW).

VisibleV8

Jueckstock, J., & Kapravelos, A. (2019, October 18). (Vol. 10). Vol. 10.

VisibleV8: In-browser Monitoring of JavaScript in the Wild

Proceedings of the ACM Internet Measurement Conference (IMC).

Wild Extensions: Discovering and Analyzing Unlisted Chrome Extensions

Beggs, A., & Kapravelos, A. (2019, January 1). Lecture Notes in Computer Science.

Wild Extensions: Discovering and Analyzing Unlisted Chrome Extensions

Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA).

Mystique

Chen, Q., & Kapravelos, A. (2018, October 15). (Vol. 10). Vol. 10.

Mystique: Uncovering Information Leakage from Browser Extensions

Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Cloak of Visibility: Detecting When Machines Browse A Different Web

Proceedings of the IEEE Symposium on Security and Privacy.

Cloak of Visibility: Detecting When Machines Browse a Different Web

Invernizzi, L., Thomas, K., Kapravelos, A., Comanescu, O., Picod, J.-M., & Bursztein, E. (2016, May 1).

Ad Injection at Scale: Assessing Deceptive Advertisement Modifications

Proceedings of the IEEE Symposium on Security and Privacy.

Hulk: Eliciting Malicious Behavior in Browser Extensions

Proceedings of the USENIX Security Symposium. Presented at the USENIX.

PExy: The Other Side of Exploit Kits

In Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 132–151).

PExy: The other side of Exploit Kits

Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA).

The Dark Alleys of Madison Avenue: Understanding Malicious Advertisements

Proceedings of the Internet Measurement Conference (IMC).

Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting

Proceedings of the IEEE Symposium on Security and Privacy.

Revolver: An Automated Approach to the Detection of Evasive Web-based Malware

Proceedings of the USENIX Security Symposium.

You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions

Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Escape from Monkey Island: Evading High-Interaction Honeyclients

In Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 124–143).

Escape from Monkey Island: Evading High-Interaction Honeyclients

Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA).

D(e|i)aling with VoIP: Robust Prevention of DIAL Attacks

In Computer Security – ESORICS 2010 (pp. 663–678).

D(e|i)aling with VoIP: Robust Prevention of Dial Attacks

Proceedings of the European Symposium on Research in Computer Security (ESORICS).

FleXConf: A Flexible Conference Assistant Using Context-Aware Notification Services

Proceedings of the IEEE Workshop on Context Aware Mobile Systems (CAMS).

FleXConf: A Flexible Conference Assistant Using Context-Aware Notification Services

In Lecture Notes in Computer Science (pp. 108–117).

Realistic Passive Packet Loss Measurement for High-Speed Networks

In Traffic Monitoring and Analysis (pp. 1–7).

Realistic Passive Packet Loss Measurement for High-Speed Networks

Proceedings of the International Workshop on Traffic Monitoring and Analysis (TMA).

Passive end-to-end packet loss estimation for grid traffic monitoring

Proceedings of the CoreGRID Integration Workshop.