Li Xiong: Researching the human elements of cybersecurity

By Carol Clark | Emory Report | Feb. 23, 2016

Story image



Li Xiong is Winship Distinguished Research Associate Professor in Emory University's Department of Mathematics and Computer Science and its Department of Biomedical Informatics. She directs Emory College's Assured Information Management and Sharing (AIMS) research lab, focused on cybersecurity issues.

One of the lab's long-term goals is to improve ways to manage health-care data records that benefit biomedical research while also guaranteeing individual patient privacy.

"My research has a strong human element in the sense that it's person-oriented," Xiong says. "I want to aggregate your data in ways that protect your confidentiality and also benefit you and society as a whole. Basically, I want you to tell me everything about you, without telling me anything about you. It sounds impossible, but like most computer science problems it's really a matter of optimization."

In this interview, Xiong talks about current challenges in cybersecurity and her career as a computer scientist.

Where are you from originally?



How did you get interested in computer science?


I was accepted in the computer science department at USTC.

How did you wind up in the United States?


The year I graduated, in 1997, the Internet was just becoming ubiquitous. I didn't sign up for an email account until I was a senior. We had really slow Internet connections. I remember getting a big book, called Pearson's Guide, which was like the Bible for how to apply to U.S. universities. I used the limited information resources that I had and typed my applications on a typewriter.

I got accepted into the Ph.D. program at Johns Hopkins University. I sometimes call myself a Hopkins dropout because I left after 1.5 years when I finished my master's degree. It was the Internet boom period and I wanted to see what it was like to work in industry.

I worked for a few years with a private company on projects like analysis of stock market data to detect fraud and suspicious transactions. I found cybersecurity interesting, but private industry was not as intellectually challenging as research. I realized I wanted to go back to school and I was accepted at Georgia Tech.

How important is cybersecurity to the average person?





On the other hand, there are a lot of dangers associated with misuse of data. There is the potential for theft and for an individual's rights of privacy to be violated.

As a cybersecurity expert, do you do anything differently than most consumers?

I mostly disable the location access on my phone. By default, when you download an app it asks if it can use your location. So if you go to "Settings" on your phone, then to "Privacy" and "Location Services," you will probably find that a lot of your apps are accessing your location.


I'm not very paranoid, but I'm probably more cautious than most people. I disable the location services for most, but not all, of my apps. You may think there is no risk, but there is always some risk.

In fact, a major project of my research group is building privacy-ensuring location mechanisms. We are trying to cloak a user's location by making it a bit less precise, but still viable for applications. This is where the human element comes in. It's a tradeoff between usefulness and protecting privacy.

You recently received a $1.06 million funding award from the Patient-Centered Outcomes Research Institute. Can you talk about your lab's work on that project?




One way to protect an individual's privacy is to perturb the data by adding some noise. But when you perturb data, its quality suffers. So you have to figure out how to perturb it just enough to obfuscate an individual's identity without sacrificing the value of the data.

Another challenge is efficiency of use. Hospitals can encrypt data before storing it to make sure that it's not misused. But analyzing encrypted data requires a lot of computation making it impractical in the real world.

