RSVP: Register via Luma (Approval required; light refreshments provided)
Hosted by Innovation UBC, this networking mixer connects the university’s venture ecosystem with the wider community of women and non-binary founders, researchers, technical executives, innovators, and mentors. This event is designed to foster informal conversations, build professional relationships, and support diverse leadership within the local startup space.
Join Women in Computer Science (WiCS) and Tri-Mentorship for a Mid-Year Check In Social. Location and RSVP details to be announced.
Name: Swati Goswami
Date: Monday, November 30
Time: 2 - 5 pm
Location: x836, ICICS
Supervisor's name: Margo Seltzer
Thesis title: Plane and Prejudice: Accelerating Network Functions using Programmable Switches
Abstract:
Network Functions (NF) such as firewalls, load balancers, Network Address Translators (NAT), and Distributed Denial of Service detectors and mitigators are important building blocks of datacenters. For example, load balancers distribute incoming traffic among multiple servers, and firewalls block malicious traffic. NFs are on the critical path of applications and web services deployed in datacenters, and therefore, it is important that NFs scale well in response to the increasing traffic volume processed by modern-day datacenters.
We use programmable switches to accelerate NFs. Our first contribution is PayloadPark - a throughput optimization that stores unused packet payloads in the switch data plane for NFs that process only packet headers. Our evaluation shows that PayloadPark improves throughput by up to 36% and reduces PCIe bandwidth by up to 58% for the Firewall -> NAT chain. Our second contribution, Flow- Cache, uses the switch to cache header transformation rules to accelerate NFs. We benchmark the control plane API, and evaluate the impact of cache update rate and counter read rate on the cache hit rate. Based on our benchmarking results, we implement SwitchCache, a control plane API driven cache that provides up to 45% cache hit rate when simultaneously processing 8 CAIDA traces. Our prototype incurs minimal throughput overhead of only 0.1%. We also show that with highly skewed workloads (θ >= 0:95), we can reduce the number of NF servers by 33%. To further improve the cache hit rate, we explore an alternate data plane-driven cache that provides a cache hit rate of up to 57% with 8 CAIDA traces, but at the cost of higher throughput overhead of 4.20%.
Join WiCS for the Vibe-Code-a-Thon. Location and RSVP details to be announced.
Name: Partha Protim Paul
Date: 26-Nov-2026
Time: 3:00 PM
Location: ICICS 304
Supervisor: Reid Holmes
Title: Empirically Measuring Test Suite Behavioural Gaps
Abstract:
Traditional test adequacy metrics measure a system’s implementation, not whether it adheres to its expected behaviour. While developers rely heavily on code coverage and mutation testing to assess test suite quality, these metrics are fundamentally implementation-centric and cannot detect gaps between what the code is expected to do and what it actually does. Unfortunately, there has been no way to reliably detect these discrepancies; in this thesis we introduce an automated proof-of-concept approach to investigate these gaps. The approach extracts expected method-level behaviours from natural language documentation and source code, maps them to existing test cases, and identifies gaps between expected and validated behaviours. We evaluate the approach across ten well-tested open-source Java projects comprising 8,922 methods, extracting 20,729 behaviours with 93.1% ± 2.7% precision. Our empirical analysis conservatively estimates that 17.5% of detected expected behaviours remain entirely untested, which we term the test suite’s behavioural gap. To determine if these gaps are merely an artifact of human-driven testing, we evaluate state-of-the-art automated test generators (ASTER / EVOSUITE), finding that they similarly fail to validate at least 27.1% / 20.6% of detected expected behaviours. We further demonstrate that behavioural gaps are not predicted by traditional structural metrics: 38.2% of methods with perfect line coverage and 29.6% of methods with a perfect mutation kill score still contain at least one untested behaviour. These results suggest behavioural coverage is a complementary dimension of test suite adequacy not captured by traditional structural metrics.
Name: Soo Yee Lim
Date: 26 Nov 2026
Time: 12:30 PM
Location: Zoom
Zoom Link:
Supervisor's name: Thomas Pasquier
Thesis title: Towards Safe Unprivileged Kernel Extensibility
Abstract:
The eBPF framework enables execution of user-provided code in the Linux kernel. In the last few years, a large ecosystem of cloud services has used eBPF to enhance container security, system observability, and network management. Meanwhile, incessant discoveries of memory safety vulnerabilities have left the systems community with no choice but to disallow unprivileged eBPF programs, which unfortunately limits eBPF use to only privileged users.
Unprivileged eBPF is useful and feasible for Linux kernel extensibility. It is useful because a default policy in Linux, while performing well on average, cannot be optimal in all circumstances. The demand is not only mine. Developers have repeatedly proposed extending seccomp with eBPF to make its filters more expressive, and because installing a filter is an unprivileged operation by design, such proposals need unprivileged eBPF to be safe. I demonstrate this utility with SABPF, an extension of the eBPF framework capable of deploying secure system-level audit mechanisms at the container granularity, with an audit framework, an intrusion detection system, and a lightweight access control mechanism. PROVBPF extends SABPF into the first eBPF-based whole-system provenance capture mechanism, and FetchBPF, which I co-design, allows developers to express and deploy prefetching policies without modifying the kernel codebase.
Unprivileged eBPF is feasible because an extension can be scoped to the workload that loaded it and isolated at run time. For scoping, I extend the eBPF subsystem so that a program runs only for Linux Security Module events triggered by processes in a designated cgroup; Google later contributed an equivalent mechanism upstream. For isolation, I survey kernel compartmentalization and propose a taxonomy for comparing how techniques define and enforce intra-kernel boundaries. I then present SandBPF, which dynamically sandboxes eBPF programs, which confines their memory accesses using either software fault isolation or ARM’s Memory Tagging Extension. Together, scoping and isolation bring unprivileged eBPF a step closer to being usable in practice.