In 1999, Savage's research team published
TCP Congestion Control with a Misbehaving Receiver, which uncovered protocol flaws in the
TCP protocol that carries most Internet traffic. By exploiting these flaws, Savage proposed means for attackers to evade
congestion control, allowing attackers to monopolize crowded network connections that would otherwise be shared by multiple users. This was the first paper to address congestion control evasion as a
vulnerability, rather than as a theoretical design implication. That same year, Savage published "Sting", a paper and software tool that presented a mechanism to abuse quirks in the TCP protocol to allow a single party to infer bidirectional packet loss, a valuable contribution to
traffic measurement. In 2000, Savage's team published
Practical Network Support for IP Traceback, which proposed a simple
stochastic extension to
internet routers that would enable them to trace floods of traffic back to their origin. IP traceback is a major open networking research question, with significant implications towards DDOS mitigation: if IP traffic can be traced,
Internet service providers can track down and halt DDOS floods. Savage later co-founded Asta Networks, which offered a product that addressed these problems. In 2003, John Bellardo and Savage published
802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions, which introduced practical attacks on
802.11 wireless protocol flaws that would allow attackers to force legitimate clients off wireless networks. The paper is also a notable example of applied
reverse engineering in an academic setting; Bellardo and Savage reverse engineered the Intersil wireless chipset, finding an undocumented diagnostic mode that allowed them to directly inject malicious wireless packets onto a network. In 2004, Savage and
George Varghese led a research team that published
Automated Worm Fingerprinting, which introduced a novel hashing technique that allowed network operators to monitor network traffic and uncover data patterns that were "propagating", spreading across the network at an unusual rate. Propagating traffic is a strong indicator for network worm outbreaks, a key unsolved problem in
network security. Varghese later co-founded Netsift to capitalize on this research; Cisco purchased Netsift in 2005. In 2005,
Ishwar Ramani and Stefan Savage developed Syncscan algorithm that cuts the time needed to switch between Wi-Fi access points. In 2004, Savage was awarded a
Sloan Research Fellowship, in 2010 he was named a Fellow of the
Association for Computing Machinery and in 2013, he received the ACM
SIGOPS Mark Weiser Award. In 2015, he received the
ACM Prize in Computing for "innovative research in network security, privacy, and reliability that has taught us to view attacks and attackers as elements of an integrated technological, societal, and economic system." In 2017, he was named a
MacArthur Foundation Fellow (the "genius grant") for his body of work. Savage was elected a Fellow of the
American Academy of Arts and Sciences in 2021 and was named a recipient of the
American Association for the Advancement of Science-administered
Golden Goose Award the same year. In 2022, he was elected to the
National Academy of Engineering. In 2023, he was named an investigator on the Healthcare Ransomware Resiliency and Response Program, or H-R3P, at the University of California San Diego School of Medicine to strengthen healthcare systems against cyber threats, with Christian Dameff and
Jeff Tully. == References ==