Pub Crawl
Pub Crawl
The Pub Crawl section contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the past year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
Submissions and suggestions are welcome.
Early versions of the Pub Crawl were known as Publications of Interest, and featured in the VO's SoS Newsletter. They are indexed here:
- 2014 Issues: 1, 2, 3, 4, 5, 6
- 2015 Issues: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
- 2016 Issues: 1, 2, 3, 4, 5, 6, 7, 8
Pub Crawl is now a regularly featured section of the SoS Reviews & Outreach publication, and entered into the SoS VO bibliographic section. They are automatically indexed below.
Pub Crawl #1
The Pub Crawl section summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. This research looks at behavioral as well as technical aspects.
Channel Coding and Encryption (2015) 
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance. The research was presented in 2015. This bibliography completes an earlier survey of 2015 posted before the end of the year.
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability. They complete an earlier bibliography.
Computational Intelligence Data Security and Privacy (2015)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to scalability and compositionality, as well as cryptography.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability. This completes a bibliography previously posted before year's end.
Control Theory Resiliency and Security (2015)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems. The research work presented here specifically addresses issues in resiliency.
Control Theory Security and Smart Grids (2015)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems. The research work presented here specifically addresses issues related to smart grids.
As cyber-crime grows, methods for preventing, detecting, and responding are growing as well. Research is examining new faster more automated methods for dealing with cyber-crime both from a technical and a behavioral standpoint. For the Science of Security community, the behavioral aspects are of great interest.
Discrete and Continuous Optimization 2015 Final 
Discrete and continuous optimization are mathematical approaches to problem solving. The research works cited here are primarily focused on continuous optimization. For Science of Security, they relate to cyber-physical systems, resilience, and composability. Some of the most important work is being done in control systems.
Edge detection is an important issue in image and signal processing. The work cited here looks at the development of metrics.
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Facial Recognition and Privacy 2015
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. The works cited here, presented or published in 2015, address various techniques and issues such as the use of TDM, PCA and Markov models, application of keystroke dynamics to facial thermography, multiresolution alignment, and sparse representation. These works complete a bibliography previously posted.
Honeypots area traps set up to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. The articles cited here reflect current thinking on honeypots.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl #2
The Pub Crawl section summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl #3
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Android Encryption 2016 (all)
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops--all five Hard Problems. The research cited here looked at encryption issues specific to the Android operating system.
Attribution 2016 (all)
Attribution of the source of an attack or the author of malware is a continuing problem in computer forensics. For the Science of Security community, it is an important issue related to human behavior, metrics, and composability.
Coding Theory and Security 2016 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, and metrics.
Command Injection Attacks 2016 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Composability 2016 (all)
Composability is one of the five Hard Problems for the Science of Security. The term refers to the capacity to build a security framework from components and have the security of each retained in the final product.
iOS Encryption 2016 (all)
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops--all five Hard Problems. The research cited here looked at encryption issues specific to Apple's iOS operating system.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #4
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Anonymity in Wireless Networks 2016 
(all)
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Attestation is he process of validating the integrity of a computing device needed for trusted computing. For the Science of Security community, it is important in addressing the hard problems of predictive metrics and resilience.
Big Data Security in the Cloud 2016 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. For the Science of Security community, research in this area relates to the hard problems of resiliency, composability and human behavior. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection.
Big Data Security Metrics 2016 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. The works cited here addresses those problems.
Black Box Cryptography 2016 (all)
According to Stack Exchange, black box security is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Cross Site Scripting 2016 (all)
A type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community XSS is relevant to resilience, composability, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
Networked Control Systems Security 2016 
(all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics. The research work cited here was presented in 2015.
Network on Chip Security 2016 (all)
Securing hardware as well as software is important in developing resilient systems, particularly cyber-physical systems. The exponential growth of capacity on a single chip, now grown to network scale, presents substantial security problems.
Network Reconnaissance 2016 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance. All were presented in 2015.
Neural Network Security and Resiliency 2016 (all)
Neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2016 (all)
Physical layer security presents the theoretical foundation of a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
Resiliency is one of the five hard problems for the Science of Security. Research work in this area has been growing.
Situational Awareness 2016 (all)
Situational awareness is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Virtual Machine Security 2016 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
White Box Cryptography 2016 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box cryptography is create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to the Science of Security Hard Problems of composability, resilience, and metrics. The work cited here has been presented over a period of years.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #5
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Analogical Transfer 2016 
(all)
Analogical transfer is a theory in psychology concerned with overcoming fixed ways of viewing particular problems or objects. In security, this problem is manifested in one example by system developers and administrators overlooking critical security requirements due to lack of tools and techniques that allow them to tailor security knowledge to their particular context. The works cited here use analogy and simulations to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Applications Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Bluetooth is a standard for short-range wireless interconnection of cellular phones, computers, and other electronic devices. In common use, it is important to the Science of Security because of its relevance to human behavior, resilient architectures, cyber physical systems, and composability.
Compositionality is one of the Hard Problems in the Science of Security. It refers to the development of methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
Concurrency and Security 2016 
(all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyberphysical systems in general.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Controller Area Network Security 2016 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the internet of Things.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of Resiliency in the context of cyber physical systems.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the core subjects of the Science of Security and impacts study into all of the hard problems.
Deep Packet Inspection 2016 
(all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach.
Differential Privacy 2016 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include.
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. The articles cited here were presented in 2015.
Game Theoretic Security 2016 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. Research cited here was presented in 2015.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is related to the hard problems of resiliency, composability and scalability, and metrics.
Human behavior creates the most complex of hard problems for the Science of Security community. The research work cited here was presented in 2015.
Human behavior is complex and that complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a Hard Problem.
Information Theoretic Security 2016 
(all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high.
Intrusion Detection Systems (IDS) 2016 (all)
Intrusion detection systems defend communications, computer and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability. This collection cites publications of interest addressing new methods of building secure fault tolerant systems.
Kerberos supports authentication in distributed systems. Used in intelligent systems, it is an encrypted data structure naming a user and a service the user may access. For the Science of Security community, it is relevant to the broad issues of cryptography and to resilience, human behavior, resiliency, and metrics. The work cited here was presented in 2015.
Location Privacy in Wireless Networks 2016 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality. The work cited here was presented in 2015.
Multicore Computing Security 2016 (all)
As high performance computing has evolved into larger and faster computing solutions, new approaches to security have been identified. The articles cited here address security issues related to multicore environments and are relevant to the Science of Security Hard Problems of resilience, scalability, and metrics.
Oscillating Behaviors 2016 (all)
The oscillation of a function or a sequence quantifies the variance between its extreme values as it approaches infinity or a point. As such, oscillating behaviors are important to the Science of Security in terms of predictive metrics and resilience.
Privacy Models and Measurement 2016 (all)
Measurement is one of the five hard problems in the Science of Security. The research work cited here looks at the development of metrics in the area of privacy. All work was presented in 2015.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Research into the security of software of unknown provenance (SOUP) is also included. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
Quantum Computing Security 2016 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. They are a hard problem of interest to cryptography.
Remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problem of resilience. The work cited here was presented over a several year period.
Safe Coding Standards 2016 (all)
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Measurement is at the core of science. The development of accurate metrics is a major element for achieving a true Science of Security.It is also one of the hard problems to solve.
Security Scalability 2016 (all)
Scalability is one of the Hard Problems in the Science of Security.
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance. The articles cited here focus on prevention, detection, and testing.
Static Code Analysis 2016 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency. The work was presented in 2015.
Supply Chain Security 2016 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures. The workwas presented in 2015.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. The research articles focused on measurement and privacy are of particular interest to the Science of Security community.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Work Factor Metrics 2016 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. The research cited here describes analytic tools, methods and processes for measuring and evaluating software, networks, and authentication and is related to the Science of Security Hard Problems of resiliency, scalability, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #6
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The use of analogies and simulations is used to overcome fixed ways of viewing particular problems or objects to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Artificial Intelligence Security 2016 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.)) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
Privacy issues related to Big Data are a growing area of interest for researchers. For the Science of Security community, this work is relevant to scalability, resilience, human behavior, and compositionality. The work presented here addresses methodologies to protect personal information using both technical and policy solutions.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. It is important to the Science of Security community relative to the problems of composability, resilience, and metrics.
Identity Management 2016 (all)
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. One of the core competencies for cybersecurity, the increasingly complex IT world demands smarter identity management solutions. Research in this area relates to the Science of Security issues of scalability, resilience, metrics, and human behavior.
Immersive Systems and Security 2016 (all)
Immersive systems, commonly known as "virtual reality", are used for a variety of functions such as gaming, rehabilitation, and training. These systems mix the virtual with the actual, and have implications for cybersecurity because attackers may make the jump from virtual to actual systems. For the Science of Security community, this work is relevant to resilience, human factors, cyber physical systems, privacy, and composability.
Information Forensics 2016 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the science of security. The work cited here, looks at policies, methodologies, and tools.
Internet Protocol Version 6 is slowly being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Linux Operating Systems Security 2016 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Linux operating system.
Mobile Ad Hoc Networks (MANETS) and Vehicle Ad Hoc Networks (VANETS) are cyber and cyberphysical systems of interest to the Science of Security community. Privacy issues are related to the problems of human behavior, scalability and resilience.
Mobile Ad Hoc Networks (MANETS) and Vehicle Ad Hoc Networks (VANETS) are cyber and cyberphysical systems of interest to the Science of Security community. All five hard problems have relevant issues related to MANET security.
Moving Target Defenses 2016 (all)
Moving Target Defense (MTD) research focuses on the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to scalability, resilience and predictive metrics. The works cited here were presented in 2015.
Object Oriented Security 2016 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Peer to Peer Security 2016 (all)
In a peer-to-peer (P2P) network, tasks such as searching for files or streaming audio or video are shared among multiple interconnected nodes--peers-- who share resources with other network participants without the need for centralized coordination by servers. Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits.
Random Key Generation 2016 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Relational Database Security 2016 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability human behavior, and metrics.
Searchable Encryption 2016 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Self-healing Networks 2016 (all)
Self-healing networks are an important goal for cyber physical systems. Resiliency and composability are essential elements.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to scalability, resilience, and scalability.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
User Privacy in the Cloud 2016 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Windows Operating Systems Security 2016 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #7
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Belief networks are Bayesian models that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modelling beliefs in complex physical networks or systems and are important to the Science of Security.
Biometric Encryption 2016 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues.
Control Theory and Privacy 2016 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here specifically addresses issues in privacy.
Control Theory and Security 2016 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here broadly addresses issues in security.
Cybersecurity Education 2016 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
Efficient Encryption 2016 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
E-government and Cybersecurity 2016 (all)
Electronic government is a growing area for the delivery of services to citizens. However, attacks on government data bases create large problems for a government and its citizens through lost or manipulated information and personal privacy violations. For the Science of Security community, its issues related to human behavior, policy-based governance of information technology systems, and resilience.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance and resilience.
I-O Systems Security 2016 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
Successful key management is critical to the security of any cryptosystem. It is perhaps the most difficult part of cryptography including as it does system policy, user training, organizational and departmental interactions, and coordination between all of these elements and includes dealing with the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, key management is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
MANET Attack Prevention and Detection 2016 (all)
Security and privacy are important research issues for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention and detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Measurement and Metrics Testing 2016 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity measurement and metrics techniques.
Multiple Fault Diagnosis 2016 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Nearest Neighbor Search 2016 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problem of measurement and predictive metrics.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Network Intrusion Detection 2016 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Outsourced Database Security 2016 (all)
The outsourcing of database security adds complexity and risk to the challenges of security. For the Science of Security community, the problems created are related to the hard problems of scalability, human behavior, predictive metrics, and resiliency.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses.
Pervasive Computing 2016 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. The goal of pervasive computing, which combines current network technologies with wireless computing, voice recognition, Internet capability and artificial intelligence, is to create an environment where the connectivity of devices is embedded in such a way that the connectivity is unobtrusive and always available. This work is related to the Science of Security issues of scalability, resilience, and human behavior.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Recommender Systems 2016 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Signature Based Defense 2016 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Smart Grid Consumer Privacy 2016 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Steganography Detection 2016 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Support Vector Machines 2016 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
Theoretical Cryptography 2016 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Virtualization Privacy 2016 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
The creation of trust across networks is an important aspect of cybersecurity. Current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #8
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Advanced Persistent Threat 2016 (all)
Advanced persistent threats are the subject of considerable research of interest to all of the hard problems for the Science of Security community. The research cited here looks at behavioral as well as technical aspects.
Web browser exploits are a common attack vector. Research into browser security has looked at the common browsers and add-ons to address both specific and general problems. Included in the articles cited here are some addressing cross site scripting, hardware virtualization, bothounds, system call monitoring, and phishing detection. For the Science of Security community, this work relates to human factors, resiliency and scalability.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Cognitive Radio Security 2016 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Compressive Sampling 2016 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence 2016 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Control Theory and Resiliency 2016 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems. The research work presented here specifically addresses issues in resiliency.
CPS Modeling and Simulation 2016 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and realiable.
Edge Detection and Security 2016 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
False Data Detection 2016 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Honeypots area traps set up to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Information Assurance 2016 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
The Internet of Biometric Things (IoBT) is a term recently coined to cover the profusion of biometric sensors, human networks, and other health related systems that are interconnected and interrelated. These systems have major security and privacy issues and are relevant to the Science of Security community relative to the hard problems of human behavior, resiliency, scalability, and metrics.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Lightweight Ciphers 2016 (all)
Lightweight cryptography is a major research direction. The release of SIMON in June 2013 generated significant interest and a number of studies evaluating and comparing it to other cipher algorithms. To the Science of Security community, lightweight ciphers can support resilience, especially in cyber physical systems constrained with power and "weight" budgets.
Malware Analysis and Graph Theory 2016 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2016 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Natural Language Processing 2016 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations, to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work relates to the problems of resiliency, metrics, and human behavior.
Network Accountability 2016 (all)
The term "accountability' suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Network Security Architecture 2016 (all)
The requirement for resilience in network security architecture is a large part of the hard problems of resiliency and compositionality in the Science of Security.
Router Systems Security 2016 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The work cited here looks specifically at sensors as an area of security concern.
Signal Processing Security 2016 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #9
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human, behavior, and scalability.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm is a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. For the Science of Security community, they are relevant to the problems of resiliency and scalability.
Because they are dynamic, done over shared wireless facilities, and proliferating, ad hoc networks are an important area for security research. For the Science of Security community, ad hoc networks security it related to the problems of resiliency, scalability, and human behavior.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security, particularly in the context of threats to privacy--data privacy, location, privacy, and other forms. It relates to the hard problems of human behavior, resiliency, and scalability.
Anonymous Messaging 2016 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Asymmetric Encryption 2016 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Attribute Based Encryption 2016 (all)
The role of Attribute Based Encryption (ABE) is being examined as a scalable means of addressing security in the Cloud. For the Science of Security community, this research is relevant to scalability, resilience, and metrics.
Automated Response Actions 2016 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, it is relevant to scalability, resiliency, and human behavior, relative to ransomware.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community they are relevant to the problems of resiliency, scalability, predictive metrics, and human behavior.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior, scalability and resilience.
Computing Theory and Trust 2016 (all)
The works cited here combine research into computing theory with research into trust between humans and humans, humans and computers, and between computers.
Computing Theory and Compositionality 2016 (all)
The work cited here combine research into computing theory with research into composability and compositionality.
Computing Theory and Privacy 2016 (all)
Getting to the Science of Security will both require and generate fresh looks at computing theory. Privacy, too, is a research area with a theoretical underpinning worth researching. The work cited here is relevant to the Science of Security community problems of human behavior, resilience, and scalability.
Computing Theory and Resilience 2016 (all)
The works cited here combine research into computing theory with research into security resilience.
Computing Theory and Security Metrics 2016 (all)
The works cited here combine research into computing theory with research into security metrics.
Conversational Agents 2016 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Coupled Congestion Control 2016 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
Increased dependence on cyber systems has created a variety of effects of interest to the Science of Security community. The related hard problems are scalability, resilience, and human behavior.
The ability to assess damage accurately and quickly is critical to resilience. These articles address those challenges.
Expert Systems and Privacy 2016 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Forward Error Correction and Security 2016 (all)
Controlling errors in data transmission in noisy or lossy circuits is a problem often solved by channel coding or forward error correction. Security resilience can be impacted by loss or noise. The articles cited here look are related to this Science of Security concern and are relevant to resiliency and scalability.
ICS Anomaly Detection 2016 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Industrial Control Systems 2016 (all)
Anomaly detection is a key to the development of resilient systems and resilient architectures. The work cited here looks at anomalies in industrial control systems. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability, and metrics.
Information Centric Networks 2016 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Protocol Verification 2016 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
Return-oriented programming (ROP) attacks are becoming more prevalent. The research cited here looks at a variety of methods and techniques to detect, prevent and recover from them. For the Science of Security community, this work is relevant to the problems of resilience, composability and scalability, and metrics.
SCADA Systems Security 2016 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalable Verification 2016 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security by Default 2016 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Policies Analysis 2016 (all)
Systems for testing and validating the employment of policy-based security systems are an important step in achieving scalability. For the Science of Security community, this work relates not only to scalability, but also resiliency and human behavior.
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources--is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency and metrics. The work cited here addresses privacy concerns.
Sensors represent are a both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Supply Chain Risk Assessment 2016 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
As malicious code--malware--continues to become more complex and as the threat adds worsened consequences financially, economically, and politically, the need to identify mitigation strategies, tools, and techniques is urgent. The work cited here addresses a series of approaches to the problem. For the Science of Security community, this work relates to the hard problems of human behavior, metrics, scalability, and resilience.
Trojan Horse Detection 2016 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Underwater Networks 2016 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
Visible Light Communications Security 2016 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Wireless Mesh Network Security 2016 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #10
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Artificial Neural Networks 2016 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Blockchain Security 2016 (all)
The blockchain is the "public ledger" of all Bitcoin transactions. It is a so-called "trustless" proof mechanism of all the transactions on the network. Access to it is public. Since the blockchain is the record of all Bitcoin transactions, it has a special need for security. For the Science of Security community, research into this problem is related to resiliency and scalability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Elliptic Curve and Cryptography 2016 (all)
Elliptic curve cryptography is a major research area globally. The work cited here focuses on areas of specific interest to the Science of Security community, including cyber physical systems security. They relate to the hard problems of resiliency, composability, and predictive metrics.
Expert Systems and Security 2016 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans, For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
Middleware and Security 2016 (all)
Middleware facilitates distributed processing, and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Power Grid Vulnerability Analysis 2016 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bit coin. For the Science of Security community, there are implications for human behavior, resiliency, composability, and metrics.
At a recent Lablet quarterly meeting and at HotSoS, sandboxing was discussed as an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Security Heuristics 2016 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Weaknesses 2016 (all)
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience.
Time Frequency Analysis and Security 2016 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trusted Platform Modules 2016 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Video surveillance is a fast growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Vulnerability Detection 2016 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #11
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Autonomic computing refers to the self-management of complex distributed computing resources that can adapt to unpredictable changes with transparency to operators and users. Security is one of the four key elements of autonomic computing and includes proactive identification and protection from arbitrary attacks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, and predictive metrics.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Cognitive Radio Security 2017 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
Elliptic Curve Cryptography 2017 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Information Reuse and Security 2017 (all)
The objective of information reuse is to maximize the value of information by creating simple, rich, and reusable knowledge representations and integrating it into systems and applications. With reuse comes inherent security risk. For the Science of Security community, this problem is relevant to compositionality and resiliency.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance and resilience.
The term Internet of Things (IT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Metadata Discovery Problem 2017 (all)
Metadata is often described as "data about data." Usage varies from virtualization to data warehousing to statistics. Because of its volume and complexity, metadata has the potential to tax security procedures and processes. For the Science of Security community, work in this area is relevant to the problems of scalability, resilience, and compositionality.
Oscillating Behaviors 2017 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. The work is related to the Science of Security issues of resiliency and human behaviors.
Scientific Computing Security 2017 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Security Policies Analysis 2017 (all)
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Signal Processing Security 2017 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Web Browser Security 2017 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #12
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic Fingerprints 2017 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Automated Response Actions 2017 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Recent revelations that processors have had long-standing vulnerabilities have triggered a greater interest in relooking at firmware in general. Research into BIOS has produced some work relevant to the Science of Security issues of human factors, resilience, metrics, and scalability.
Chaotic Cryptography 2016 (all)
Adding chaos theory to cryptography allows the development of lighter, stronger and more efficient methods. For the Science of Security community, work in this area relates to resiliency, composability, and predictive metrics.
Chaotic Cryptography 2017 (all)
Adding chaos theory to cryptography allows the development of lighter, stronger and more efficient methods. For the Science of Security community, work in this area relates to resiliency, composability, and predictive metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Cross Layer Security 2016 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Cross Layer Security 2017 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDoS Attack Detection 2017 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDoS Attack Mitigation 2017 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDoS Attack Prevention 2017 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Homomorphic Encryption 2017 (all)
Homomorphic encryption shows promise, but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Immersion systems, commonly known as "virtual reality", are used for a variety of functions such as gaming, rehabilitation, and training. These systems mix the virtual with the actual, and have implications for cybersecurity because attackers may make the jump from virtual to actual systems. For the Science of Security community, this work is relevant to resilience, human factors, cyber physical systems, privacy, and composability.
Information Theoretic Security 2017 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Intrusion Tolerance 2016 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
Intrusion Tolerance 2017 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
Theft of Intellectual Property, that is, piracy, continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Malware analysis, along with detection and classification, is a major issue in cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Moving Target Defense 2017 (all)
Moving Target (MT) research and development results in the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to resilience and predictive metrics.
Natural Language Processing 2017 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations, to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Operating Systems Security 2017 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics.
Outsourced Database Integrity 2016 (all)
The growth of distributed storage systems such as the Cloud has produced novel security problems. The works cited here address untrusted servers, generic trusted data, trust extension on commodity computers, defense against frequency-based attacks in wireless networks, and other topics. For the Science of Security community, these topics relate to composability, metrics, and resilience.
Outsourced Database Integrity 2017 (all)
The growth of distributed storage systems such as the Cloud has produced novel security problems. The works cited here address untrusted servers, generic trusted data, trust extension on commodity computers, defense against frequency-based attacks in wireless networks, and other topics. For the Science of Security community, these topics relate to composability, metrics, and resilience.
Pervasive Computing Security 2017 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
Policy-based Governance 2017 (all)
Governance is one of the five hard problems in the Science of Security. The work cited here includes some work of specific interest in this difficult topic.
Predictive Security Metrics 2017 (all)
Measurement is at the core of science. The development of accurate metrics is a major element for achieving a true Science of Security. It is also one of the hard problems to solve.
QR codes are used to store information in two dimensional grids which can be decoded quickly. The work here deals with extending its encoding and decoding implementation for user authentication and access control as well as tagging. For the Science of Security community, the work is relevant to cyber physical systems, cryptography, and resilience.
Scalability of security is one of the five hard problem in the Science of Security. The work cited here includes some work of specific interest in this difficult topic.
Science of Security 2016 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements.
Science of Security 2017 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements.
Security Scalability 2017 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community. Work in this area seems to be increasing.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #13
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Ad Hoc Network Security 2017 (all)
Because they are dynamic, done over shared wireless facilities, and proliferating, ad hoc networks are an important area for security research. For the Science of Security community, they are relevant to the issues of resilience, composability, and human behavior.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.)) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Artificial Intelligence Security 2017 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.)) These divisions are attributed to both technical and social factors. The research cited here looks at the broad security implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, metrics and resilience.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Big Data Security in the Cloud 2017 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2017 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Cross Site Scripting 2017 (all)
A type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community, this work is relevant to the hard problems of human behavior, scalability, and resilience.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Human behavior is complex and that complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a Hard Problem.
Identity Management 2017 (all)
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. For the Science of Security community, this research is relevant to scalability, resilience, and human behavior.
Internet of Vehicles 2017 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
Successful key management is critical to the security of any cryptosystem. It is perhaps the most difficult part of cryptography including as it does system policy, user training, organizational and departmental interactions, and coordination between all of these elements and includes dealing with the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, key management is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Microelectronic Security 2017 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Multicore Computing Security 2017 (all)
As high performance computing has evolved into larger and faster computing solutions, new approaches to security have been identified. The articles cited here focus on security issues related to multicore environments. Multicore computing relates to the Science of Security hard topics of scalability, resilience, and metrics.
Multifactor Authentication 2017 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Multiple Fault Diagnosis 2017 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Network Reconnaissance 2017 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance.
Network Security Architecture 2017 (all)
The requirement for security and resilience in network security architecture is one of the hard problems in the Science of Security.
Predictive security metrics are one of the five hard problems in the Science of Security.
Quantum Computing Security 2017 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. To the Science of Security community, they are interest in terms of scalability.
Resilient Security Architectures 2016 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Resilient Security Architectures 2017 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Searchable Encryption 2017 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Security Risk Estimation 2017 (all)
Calculating risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Situational Awareness 2017 (all)
Situational awareness is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Privacy is a specific problem within the general area of cybersecurity in the Smart Grid. The protection of customer data and usage is of particular importance. To the Science of Security community, this research is relevant to the hard problems of resiliency, scalability, and human factors.
Smart Grid Security 2017 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
Trusted Platform Modules 2017 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trustworthy Systems 2017 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Ubiquitous Computing Security 2017 (all)
Ubiquitous computing is a concept in software engineering and computer science where computing is made to appear anytime and everywhere. In contrast to desktop computing, ubiquitous computing can occur using any device, in any location, and in any format. Incorporating all aspects of the cyber world, including the internet, the processor, the Cloud, and so on, ubiquitous computing has significant security challenges. The Science of Security community, the work cited here is relevant to scalability, metrics, human factors and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #14
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the hard problems of human behavior, resiliency, metrics and composability.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Advanced Persistent Threats 2017 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience and metrics.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Analogical Transfer 2017 (all)
Analogical transfer is a theory in psychology concerned with overcoming fixed ways of viewing particular problems or objects. In security, this problem is manifested in one example by system developers and administrators overlooking critical security requirements due to lack of tools and techniques that allow them to tailor security knowledge to their particular context. The works cited here use analogy and simulations to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Attribute-based Encryption 2017 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Black Box Encryption 2017 (all)
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Coding Theory and Security 2017 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Command Injection Attacks 2017 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Composability is one of the five hard problems for the Science of Security.
Compositionality is one of the five hard problems in the Science of Security.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
Dynamic Networks and Security 2017 (all)
Since the Bell System introduced "dynamic routing" several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
Information Forensics 2017 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Internet-scale Computing Security 2017 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
Internet Protocol Version 6 is gradually being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Peer to Peer Security 2017 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Secure File Sharing 2017 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
Self-healing Networks 2017 (all)
Self-healing networks are an important goal for cyber physical systems. The Science of Security community hard problems of resiliency and composability are essential elements.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
White Box Encryption 2017 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #15
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Applications Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Artificial Neural Networks 2017 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Asymmetric Encryption 2017 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Theoretical Cryptography 2017 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural 'security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Time Frequency Analysis and Security 2017 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trojan Horse Detection 2017 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Underwater Networks 2017 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
Video surveillance is a fast growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Virtual Machine Security 2017 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Vulnerability Detection 2017 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Web caches offer a potential for mischief. With the expanded need for caching capability with the cloud and mobile communications, the need for more and better security has also grown. This research is relevant to the Science of Security hard problems of resilience, scalability, and metrics.
The creation of trust across networks is an important aspect of cybersecurity. Current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
Windows Operating System Security 2017 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Wireless Mesh Networks 2017 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Work Factor Metrics 2017 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Zero Day Attacks and Defense 2017 (all)
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #16
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Internet-scale Computing Security 2017 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
Policy Based Governance 2017 (all)
Policy-based governance of security is one of the five hard problems for the Science of Security community.
Power Grid Vulnerability Analysis 2017 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Privacy Models and Measurement 2017 (all)
Measurement is one of the five hard problems in the Science of Security. The research work cited here looks at the development of metrics in the area of privacy.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Protocol Verification 2017 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Random Key Generation 2017 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Recommender Systems 2017 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Relational Database Security 2017 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability, human behavior, and metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency is one of the hard problems for the Science of Security.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. The work is related to the Science of Security issues of resiliency and human behaviors.
Router Systems Security 2017 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2017 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2017 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2017 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to resilience, and scalability.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security by Default 2017 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Heuristics 2017 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Steganography Detection 2017 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Supply Chain Security 2017 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. For the Science of Security community, supply chain security is relevant to resilient architectures, scalability, and human behavior issues.
Support Vector Machines 2017 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #17
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Analysis and Graph Theory 2017 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2017 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Detection 2017 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Mitigation 2017 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack mitigation. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Prevention 2017 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Privacy is an important research issues for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Security is an important research issue for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Measurement and Metrics Testing 2017 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity of measurement and metrics techniques.
Microelectronics Security 2017 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Middleware Security 2017 (all)
Middleware facilitates distributed processing, and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Named Data Network Security 2017 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Nearest Neighbor Search 2017 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problem of measurement and predictive metrics.
Network Accountability 2017 (all)
The term "accountability' suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Networked Control Systems Security 2017 (all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics.
Network Intrusion Detection 2017 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Network on Chip Security 2017 (all)
Network on chip (NoC or NOC) is a communication subsystem on an integrated circuit. NOC technology applies networking theory and methods to on-chip communication and brings improvements over conventional interconnections. From a Science of Security perspective, NOC security is relevant to scalability, resilience, and metrics.
Neural Network Resilience 2017 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Resilience is the Science of Security interest referenced here.
Neural Networks Security 2017 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Object Oriented Security 2017 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability and resilience.
Physical Layer Security 2017 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Security Risk Management 2017 (all)
Security risk management is relevant to the Science of Security hard problems of predictive metrics, human behavior, scalability and resilience.
Security Weaknesses 2017 (all)
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Signature Based Defense 2017 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Smart Grid Consumer Privacy 2017 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Static Code Analysis 2017 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Stochastic Computing Security 2017 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #18
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Computing Theory and Privacy 2017 (all)
Getting to the Science of Security will both require and generate fresh looks at computing theory. Privacy, too, is a research area with a theoretical underpinning worth researching. The work cited here is relevant to the Science of Security community problems of human behavior, resilience, and scalability.
Computing Theory and Security Metrics 2017 (all)
The works cited here combine research into computing theory with research into security metrics.
Control Theory and Privacy 2017 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The research work presented here specifically addresses issues in privacy.
Control Theory and Resiliency 2017 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The work cited here focuses on resiliency.
Control Theory and Security 2017 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
Controller Area Network Security 2017 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the internet of Things.
CPS Modeling and Simulation 2017 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of Resiliency in the context of cyber physical systems.
The ability to assess damage accurately and quickly is critical to resilience.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
Deep Packet Inspection 2017 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #19
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Differential Privacy 2017 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Edge Detection and Security 2017 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Efficient Encryption 2017 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
E-government and Cybersecurity 2017 (all)
Electronic government is a growing area for the delivery of services to citizens. However, attacks on government data bases create large problems for a government and its citizens through lost or manipulated information and personal privacy violations. For the Science of Security community, its issues related to human behavior, policy-based governance of information technology systems, and resilience.
Fog Computing and Security 2017 (all)
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. For the Science of Security community, it is relevant to the hard problems of resilience and scalability.
Forward Error Correction and Security 2017 (all)
Controlling errors in data transmission in noisy or lossy circuits is a problem often solved by channel coding or forward error correction. Security resilience can be impacted by loss or noise. The articles cited here look are related to this Science of Security concern and are relevant to resiliency and scalability.
Fuzzy Logic and Security 2017 (all)
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Game Theoretic Security 2017 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Internet-scale Computing Security 2017 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #20
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
Cryptojacking is a new method criminals are using to take over computers and using the hijacked processing power to earn cryptocurrency. For the Science of Security community, this new attack vector is relevant to resiliency, metrics, and human behavior.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Expert Systems and Privacy 2017 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2017 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
Generative Adversarial Learning 2017 (all)
AI and Machine Learning are being used to develop a wide range of applications including visual, audio, and text. The use of these methods has large security implications. Research into the security aspects is relevant to the Science of Security hard problems of resilience, predictive metrics, and scalability.
Honeypots area traps set up to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Human behavior and its impact on cybersecurity is one of the five hard problems for the Science of Security community.
Neural Style Transfer 2017 (all)
Neural style transfer is receiving significant attention and showing results. One approach trains by defining and optimizing perceptual loss functions in feed-forward convolutional neural networks. Work in this area addresses security issues relative to AI and ML and the hard problems of scalability, resilience, and predictive metrics.
Sensors represent are both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Visible Light Communications Security 2017 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #21
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Analogies and Transference 2017 (all)
The use of analogies and simulations is used to overcome fixed ways of viewing particular problems or objects to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Anonymous Messaging 2017 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Conversational Agents 2017 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include. It is relevant to the hard problems of scalability and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
False Data Detection 2017 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
Internet of Battlefield Things (IoBT) 2017 (all)
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
Return Oriented Programming 2017 (all)
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Supply Chain Risk Assessment 2017 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics, scalability, and resilience.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
User Privacy in the Cloud 2017 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Virtualization Privacy 2017 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
Work Factor Metrics 2018 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Explainable Artificial Intelligence (XAI) has become an area of interest in research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero Day Attacks and Defense 2018 (all)
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #22
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Acoustic Fingerprints 2018 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Ad Hoc Network Security 2018 (all)
Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Advanced Persistent Threats 2018 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience and metrics.
Virtualization Privacy 2018 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
Visible Light Communications Security 2018 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Vulnerability Detection 2018 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Web Browser Security 2018 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Web caches offer a potential for mischief. With the expanded need for caching capability with the cloud and mobile communications, the need for more and better security has also grown. This research is relevant to the Science of Security hard problems of resilience, scalability, and metrics.
The creation of trust across networks is an important aspect of cybersecurity. Much of current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Windows Operating System Security 2018 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Wireless Mesh Networks 2018 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #23
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.)) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Analogical Transfer 2018 (all)
Analogical transfer is a theory in psychology concerned with overcoming fixed ways of viewing particular problems or objects. In security, this problem is manifested in one example by system developers and administrators overlooking critical security requirements due to lack of tools and techniques that allow them to tailor security knowledge to their particular context. The works cited here use analogy and simulations to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Anonymous Messaging 2018 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Applications Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Artificial Intelligence Security 2018 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
Artificial Neural Networks 2018 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Asymmetric Encryption 2018 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Attestation is the verification of changes to software as part of trusted computing. For the Science of Security community, it is relevant to composability, resilience, and human behavior.
Attribute-based Encryption 2018 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Honeypots area traps set up to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
Theoretical Cryptography 2018 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural 'security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
Trustworthy Systems 2018 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Two Factor Authentication 2018 (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers, because it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
User Privacy in the Cloud 2018 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Video surveillance is a fast growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Virtual Machine Security 2018 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #24
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Belief networks are Bayesian models that that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modeling beliefs in complex physical networks or systems and are important to the Science of Security.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Sensors represent are both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance.
Static Code Analysis 2018 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2018 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stochastic Computing Security 2018 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Supply Chain Risk Assessment 2018 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Security 2018 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. For the Science of Security community, supply chain security is relevant to resilient architectures, scalability, and human behavior issues.
Support Vector Machine 2018 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Time Frequency Analysis and Security 2018 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trojan Horse Detection 2018 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trusted Platform Modules 2018 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #25
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Big Data Security in the Cloud 2018 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2018 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Biometric Encryption 2018 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues. For the Science of Security community, this work is relevant to resilience, scalability, and metrics.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
Black Box Encryption 2018 (all)
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Blockchain Security 2018 (all)
The blockchain is the "public ledger" of all Bitcoin transactions. It is a so-called "trustless" proof mechanism of all the transactions on the network. Access to it is public. Since the blockchain is the record of all Bitcoin transactions, it has a special need for security. For the Science of Security community, research into this problem is related to resiliency and scalability.
Bluetooth is a standard for short-range wireless interconnection of cellular phones, computers, and other electronic devices. In common use, it is important to the Science of Security because of its relevance to human behavior, resilient architectures, cyber physical systems, and composability.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Self-healing Networks 2018 (all)
Self-healing networks are an important goal for cyber physical systems. Resiliency and composability are essential elements.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Signal Processing Security 2018 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Signature Based Defense 2018 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Situational Awareness 2018 (all)
Situational awareness is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Smart Grid Security 2018 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #26
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Edge Detection and Security 2018 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Elliptic Curve Cryptography 2018 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Fuzzy Logic and Security 2018 (all)
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Generative Adversarial Learning 2018 (all)
AI and Machine Learning are being used to develop a wide range of applications including visual, audio, and text. The use of these methods has large security implications. Research into the security aspects is relevant to the Science of Security hard problems of resilience, predictive metrics, and scalability.
Industrial Control Systems 2018 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Information Forensics 2018 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Information Theoretic Security 2018 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance and resilience.
The term Internet of Things (IT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Kerberos supports authentication in distributed systems. Used in intelligent systems, it is an encrypted data structure naming a user and a service the user may access. For the Science of Security community, it is relevant to the broad issues of cryptography and to resilience, human behavior, resiliency, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #27
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Information Theoretic Security 2018 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Machine Learning and Security 2018 (all)
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Analysis and Graph Theory 2018 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2018 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Detection 2018 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Mitigation 2018 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack mitigation. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Prevention 2018 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Risk Management 2018 (all)
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Scalability 2018 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #28
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
SCADA Systems Security 2018 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2018 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to scalability and resilience.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security Heuristics 2018 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Risk Management 2018 (all)
Almost all of cybersecurity is a risk management process. Tradeoffs among level of security, overall performance, automation, weight, cost, and other factors can make risk management complicated. For the Science of Security, risk management is related to human factors and governance.
Security Scalability 2018 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Security Weaknesses 2018 (all)
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Smart Grid Consumer Privacy 2018 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #29
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Control Theory and Security 2018 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve the Science of Security community hard problems in resiliency and composability.
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
Cross Layer Security 2018 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
Deep Packet Inspection 2018 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Information Assurance 2018 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
Information Centric Networks 2018 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
Security is an important research issue for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Metadata Discovery Problem 2018 (all)
Metadata is often described as "data about data." Usage varies from virtualization to data warehousing to statistics. Because of its volume and complexity, metadata has the potential to tax security procedures and processes. For the Science of Security community, work in this area is relevant to the problems of scalability, resilience, and compositionality.
Microelectronics Security 2018 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Moving Target Defense 2018 (all)
Moving Target Defense (MTD) research focuses on the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to scalability, resilience and predictive metrics.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
Quick Response (QR) codes are used to store information in two dimensional grids which can be decoded quickly. The work here deals with extending its encoding and decoding implementation for user authentication and access control as well as tagging. For the Science of Security community, the work is relevant to cyber physical systems, cryptography, and resilience.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Searchable Encryption 2018 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Secure File Sharing 2018 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
Security Risk Management 2018 (all)
Almost all of cybersecurity is a risk management process. Tradeoffs among level of security, overall performance, automation, weight, cost, and other factors can make risk management complicated. For the Science of Security, risk management is related to human factors and governance.
Security Weaknesses 2018 (all)
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Smart Grid Consumer Privacy 2018 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
If there is no link between a pair of entities, no trust decision has yet been made. Operating in an unknown trust environment creates security problems related to scalability, policy-based governance, human factors, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #30
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Quantum Computing Security 2018 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. To the Science of Security community, they are interest in terms of scalability.
Random Key Generation 2018 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Recommender Systems 2018 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency is one of the five identified hard problems in the Science of Security.
Return Oriented Programming 2018 (all)
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. This work is related to the Science of Security issues of resiliency and human behaviors.
Security Policies Analysis 2018 (all)
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Risk Estimation 2018 (all)
Calculating risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #31
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Policy Based Governance 2018 (all)
Governance is one of the five hard problems in the Science of Security. The work cited here includes some work of specific interest in this difficult topic.
Power Grid Vulnerability Analysis 2018 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Predictive Security Metrics 2018 (all)
Measurement is at the core of science. The development of accurate metrics is a major element for achieving a true Science of Security. It is also one of the hard problems to solve.
Protocol Verification 2018 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Relational Database Security 2018 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability, human behavior, and metrics.
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Router Systems Security 2018 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Scientific Computing Security 2018 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Science of Security 2018 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Security by Default 2018 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #32
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Analogies and Transference 2018 (all)
The use of analogies and simulations is used to overcome fixed ways of viewing particular problems or objects to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2018 (all)
Adding chaos theory to cryptography allows the development of lighter, stronger and more efficient methods. For the Science of Security community, work in this area relates to resiliency, composability, and predictive metrics.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Coding Theory and Security 2018 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Cognitive Radio Security 2018 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Command Injection Attacks 2018 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber-physical systems and are related to composability, resiliency, and metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Composability of security processes is one of the five hard problems for the Science of Security.
Compressive Sampling 2018 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence 2018 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computing Theory and Compositionality 2018 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of trust between humans and humans, humans and computers, and between computers.
Computing Theory and Resilience 2018 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of resilience.
Computing Theory and Trust 2018 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability and compositionality.
Concurrency and Security 2018 (all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyber-physical systems in general.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Controller Area Network Security 2018 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the Internet of Things.
Control Theory and Privacy 2018 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber-physical systems. The research work presented here specifically addresses issues in privacy.
Control Theory and Resiliency 2018 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber-physical systems. The work cited here focuses on resiliency.
Conversational Agents 2018 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Cross Site Scripting 2018 (all)
A type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community, this work is relevant to the hard problems of human behavior, scalability, and resilience.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDoS Attack Detection 2018 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDoS Attack Mitigation 2018 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDoS Attack Prevention 2018 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Outsourced Database Integrity 2018 (all)
The growth of distributed storage systems such as the Cloud has produced novel security problems. The works cited here address untrusted servers, generic trusted data, trust extension on commodity computers, defense against frequency-based attacks in wireless networks, and other topics. For the Science of Security community, these topics relate to composability, metrics, and resilience.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability and resilience.
Peer to Peer Security 2018 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
Pervasive Computing Security 2018 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2018 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
Science of Security 2018 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #33
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber-physical system security.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human, behavior, and scalability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Differential Privacy 2018 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Efficient Encryption 2018 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Expert Systems and Privacy 2018 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2018 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include. It is relevant to the hard problems of scalability and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
False Data Detection 2019 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
Fog Computing and Security 2019 (all)
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. For the Science of Security community, it is relevant to the hard problems of resilience and scalability.
Game Theoretic Security 2018 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Homomorphic Encryption 2018 (all)
Homomorphic encryption shows promise, but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Identity Management 2019 (all)
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. For the Science of Security community, this research is relevant to scalability, resilience, and human behavior.
Industrial Control Systems (ICS) Anomaly Detection 2019 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Information Assurance 2019 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
Information Centric Networks 2019 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance and resilience.
Intrusion Detection Systems 2019 (all)
Intrusion detection systems defend communications, computer and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability.
Internet Protocol Version 6 is slowly being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Lightweight Ciphers 2019 (all)
Lightweight cryptography is a major research direction. The release of SIMON in June 2013 generated significant interest and a number of studies evaluating and comparing it to other cipher algorithms. To the Science of Security community, lightweight ciphers can support resilience and scalability, especially in cyber physical systems constrained with power and "weight" budgets.
Science of Security 2018 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Wireless Mesh Networks 2019 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Work Factor Metrics 2019 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Explainable Artificial Intelligence (XAI) has become an area of interest in research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero Day Attacks and Defense 2019 (all)
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
If there is no link between a pair of entities, no trust decision has yet been made. Operating in an unknown trust environment creates security problems related to scalability, policy-based governance, human factors, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #34
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Information Assurance 2019 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
Successful key management is critical to the security of any cryptosystem. It is perhaps the most difficult part of cryptography including as it does system policy, user training, organizational and departmental interactions, and coordination between all of these elements and includes dealing with the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, key management is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Microelectronics Security 2019 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Moving Target Defense 2019 (all)
Moving Target Defense (MTD) research focuses on the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to scalability, resilience and predictive metrics.
Multicore Computing Security 2019 (all)
As high performance computing has evolved into larger and faster computing solutions, new approaches to security have been identified. The articles cited here focus on security issues related to multicore environments. Multicore computing relates to the Science of Security hard topics of scalability, resilience, and metrics.
Multifactor Authentication 2019 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Security Risk Management 2019 (all)
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Self-healing Networks 2019 (all)
Self-healing networks are an important goal for cyber physical systems. Resiliency and composability are essential elements.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for sensor security.
Signal Processing Security 2019 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Situational Awareness 2019 (all)
Situational awareness is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Self-healing Networks 2019 (all)
Self-healing networks are an important goal for cyber physical systems. Resiliency and composability are essential elements.
Smart Grid Security 2019 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Sensors represent are both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Static Code Analysis 2019 (all)
Static code is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2019 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Supply Chain Risk Assessment 2019 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Support Vector Machines 2019 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Vulnerability Detection 2019 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Web caches offer a potential for mischief. With the expanded need for caching capability with the cloud and mobile communications, the need for more and better security has also grown. This research is relevant to the Science of Security hard problems of resilience, scalability, and metrics.
White Box Cryptography 2019 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #35
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Random Key Generation 2019 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Recommender Systems 2019 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency of cybersecurity systems and their development is one of the five major hard problems in the Science of Security.
Return Oriented Programming 2019 (all)
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. This work is related to the Science of Security issues of resiliency and human behaviors.
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Router Systems Security 2019 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2019 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2019 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Scientific Computing Security 2019 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to resilience and scalability.
Searchable Encryption 2019 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Secure File Sharing 2019 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security Heuristics 2019 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Security Risk Estimation 2019 (all)
Calculating risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Signature Based Defense 2019 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Supply Chain Security 2019 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. For the Science of Security community, supply chain security is relevant to resilient architectures, scalability, and human behavior issues.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
Theoretical Cryptography 2019 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural "security concerns" mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Trojan Horse Detection 2019 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber-physical systems security, resilience and composability, as well as being an issue in supply chain security.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Two Factor Authentication 2019 (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers, because it it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
Ubiquitous Computing Security 2019 (all)
Ubiquitous computing is a concept in software engineering and computer science where computing is made to appear anytime and everywhere. In contrast to desktop computing, ubiquitous computing can occur using any device, in any location, and in any format. Incorporating all aspects of the cyber world, including the internet, the processor, the Cloud, and so on, ubiquitous computing has significant security challenges. The Science of Security community, the work cited here is relevant to scalability, metrics, human factors and resilience.
Underwater Networks 2019 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
Virtual Machine Security 2019 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #36
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Object Oriented Security 2018 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Oscillating Behaviors 2018 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Oscillating Behaviors 2019 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability and resilience.
Peer to Peer Security 2019 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
Pervasive Computing Security 2019 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2019 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Policy Based Governance 2019 (all)
Governance is one of the five hard problems in the Science of Security. The work cited here includes some work of specific interest in this difficult topic.
Power Grid Vulnerability Assessment 2019 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Predictive Security Metrics 2019 (all)
Predictive security metrics are one of the five hard problems in the Science of Security.
Privacy Models and Measurement 2018 (all)
Measurement is one of the five hard problems in the Science of Security. The research work cited here looks at the development of metrics in the area of privacy.
Privacy Models and Measurement 2019 (all)
Measurement is one of the five hard problems in the Science of Security. The research work cited here looks at the development of metrics in the area of privacy.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Protocol Verification 2019 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
QR codes are used to store information in two dimensional grids which can be decoded quickly. The work here deals with extending its encoding and decoding implementation for user authentication and access control as well as tagging. For the Science of Security community, the work is relevant to cyber physical systems, cryptography, and resilience.
Quantum Computing Security 2019 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. To the Science of Security community, they are interest in terms of scalability.
Relational Database Security 2019 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability, human behavior, and metrics.
Security by Default 2019 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Support Vector Machines 2019 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Trustworthy Systems 2019 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Video surveillance is a fast growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Virtualization Privacy 2019 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
Web Browser Security 2019 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Windows Operating System Security 2019 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #37
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Multiple Fault Diagnosis 2018 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Multiple Fault Diagnosis 2019 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Natural Language Processing 2018 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations, to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Natural Language Processing 2019 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations, to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Nearest Neighbor Search 2018 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problems of measurement and predictive metrics.
Nearest Neighbor Search 2019 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problems of measurement and predictive metrics.
Network Accountability 2018 (all)
The term "accountability" suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Network Accountability 2019 (all)
The term "accountability" suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Networked Control Systems Security 2018 (all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics.
Networked Control Systems Security 2019 (all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics.
Network Intrusion Detection 2018 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Network Intrusion Detection 2019 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Network on Chip Security 2018 (all)
Network on chip (NoC or NOC) is a communication subsystem on an integrated circuit. NOC technology applies networking theory and methods to on-chip communication and brings improvements over conventional interconnections. From a Science of Security perspective, NOC security is relevant to scalability, resilience, and metrics.
Network on Chip Security 2019 (all)
Network on chip (NoC or NOC) is a communication subsystem on an integrated circuit. NOC technology applies networking theory and methods to on-chip communication and brings improvements over conventional interconnections. From a Science of Security perspective, NOC security is relevant to scalability, resilience, and metrics.
Network Reconnaissance 2018 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance. These are related to the Science of Security hard problems of resilience and scalability.
Network Reconnaissance 2019 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance. These are related to the Science of Security hard problems of resilience and scalability.
Network Security Architecture 2018 (all)
The requirement for security and resilience in network security architecture is one of the hard problems in the Science of Security.
Network Security Architecture 2019 (all)
The requirement for security and resilience in network security architecture is one of the hard problems in the Science of Security.
Neural Network Security 2018 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Neural Network Security 2019 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Object Oriented Security 2019 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #38
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
In a blackhole attack, a malicious node advertises itself as the shortest route to a destination, luring packets. The malicious node can then drop the packets or create a false route. For the Science of Security community, this research is relevant to resiliency and scalability.
In a blackhole attack, a malicious node advertises itself as the shortest route to a destination, luring packets. The malicious node can then drop the packets or create a false route. For the Science of Security community, this research is relevant to resiliency and scalability.
Differential Privacy 2019 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Edge Detection and Security 2019 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Efficient Encryption 2019 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
Elliptic Curve Cryptography 2019 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Forward Error Correction 2018 (all)
Forward Error Correction, also known as Channel coding, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Forward Error Correction 2019 (all)
Forward Error Correction, also known as Channel coding, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Game Theoretic Security 2019 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Generative Adversarial Learning 2019 (all)
AI and Machine Learning are being used to develop a wide range of applications including visual, audio, and text. The use of these methods has large security implications. Research into the security aspects is relevant to the Science of Security hard problems of resilience, predictive metrics, and scalability.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Homomorphic Encryption 2019 (all)
Homomorphic encryption shows promise, but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Honeypots area traps set up to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Immersion systems, commonly known as "virtual reality", are used for a variety of functions such as gaming, rehabilitation, and training. These systems mix the virtual with the actual, and have implications for cybersecurity because attackers may make the jump from virtual to actual systems. For the Science of Security community, this work is relevant to resilience, human factors, cyber physical systems, privacy, and composability.
Information Forensics 2019 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Information Theoretic Security 2019 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Security is an important research issue for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Middleware Security 2018 (all)
Middleware facilitates distributed processing, and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Middleware Security 2019 (all)
Middleware facilitates distributed processing, and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Multifactor Authentication 2018 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Named Data Network Security 2018 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Named Data Network Security 2019 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #39
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Cipher Text-Policy Attribute Based Encryption (CP-ABE) 2018 (all)
Ciphertext Policy Attribute Based Encryption techniques provide fine grained access control to securely share organizational data where role-based access rights are in use. For the Science of Security community, CP-ABE is related to policy-based governance and scalability.
Cipher Text-Policy Attribute Based Encryption (CP-ABE) 2019 (all)
Ciphertext Policy Attribute Based Encryption techniques provide fine grained access control to securely share organizational data where role-based access rights are in use. For the Science of Security community, CP-ABE is related to policy-based governance and scalability.
Control Theory and Resiliency 2019 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The work cited here focuses on resiliency.
Control Theory and Security 2019 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve the Science of Security community hard problems in resiliency and composability.
Controller Area Network Security 2019 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the internet of Things.
Conversational Agents 2019 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
CPS Modeling and Simulations 2018 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
CPS Modeling and Simulations 2019 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
Cryptojacking is a new method criminals are using to take over computers and using the hijacked processing power to earn cryptocurrency. For the Science of Security community, this new attack vector is relevant to resiliency, metrics, and human behavior.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
The ability to assess damage accurately and quickly is critical to resilience.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDOS Attack Detection 2019 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Mitigation 2019 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Prevention 2019 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
Deep Packet Inspection 2019 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Key Policy Attribute Based Encryption (KP-ABE) 2018 (all)
Recent works show that the reality of the privacy preserving and security in decentralized key policy ABE (KP-ABE) schemes are doubtful. How to construct a decentralized KP-ABE with privacy-preserving and user collusion avoidance remains a challenging problem.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
User Privacy in the Cloud 2019 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Visual Light Communications Security 2019 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
The creation of trust across networks is an important aspect of cybersecurity. Much of current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
White Box Cryptography 2017 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
White Box Cryptography 2018 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #40
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic Fingerprints 2019 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Ad Hoc Network Security 2019 (all)
Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Advanced Persistent Threat 2019 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience, and metrics.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Anonymous Messaging 2019 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Applications Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Artificial Intelligence Security 2019 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
Artificial Neural Networks 2019 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Asymmetric Encryption 2019 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Attestation is the verification of changes to software as part of trusted computing. For the Science of Security community, it is relevant to composability, resilience, and human behavior.
Attribute-based Encryption 2019 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Intrusion Tolerance 2018 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
Intrusion Tolerance 2019 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
The term Internet of Things (IT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #41
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Attribution of the source of an attack or the author of malware is a continuing problem in computer forensics. For the Science of Security community, it is an important issue related to human behavior, metrics, and composability.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
Automated Response Actions 2019 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Belief networks are Bayesian models that that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modelling beliefs in complex physical networks or systems and are important to the Science of Security.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Big Data Security in the Cloud 2019 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2019 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Biometric Encryption 2019 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues. For the Science of Security community, this work is relevant to resilience, scalability, and metrics.
Recent revelations that processors have had long-standing vulnerabilities have triggered a greater interest in relooking at firmware in general. Research into Basic Input Output Operations Systems (BIOS) has produced some work relevant to the Science of Security issues of human factors, resilience, metrics, and scalability.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
Black Box Encryption 2019 (all)
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." This research looks at how to protect the black box itself separate from the encryption problem. For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Bluetooth is a standard for short-range wireless interconnection of cellular phones, computers, and other electronic devices. In common use, it is important to the Science of Security because of its relevance to human behavior, resilient architectures, cyber physical systems, and composability.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
Browser Security 2019 Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Brute Force Attacks 2018 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
Brute Force Attacks 2019 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2019 (all)
Adding chaos theory to cryptography allows the development of lighter, stronger and more efficient methods. For the Science of Security community, work in this area relates to resiliency, composability, and predictive metrics.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Composability of security processes is one of the five hard problems for the Science of Security.
Coding Theory and Security 2019 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Cognitive Radio Security 2019 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Command Injection Attacks 2019 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Compressive Sampling 2019 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence 2019 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computer Theory and Trust 2019 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability and compositionality.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Control Theory and Privacy 2019 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber-physical systems. The research work presented here specifically addresses issues in privacy.
Cross Layer Security 2019 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #42
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Automated Secure Software Engineering 2019 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Blockchain Security 2019 (all)
The blockchain is the "public ledger" of all Bitcoin transactions. It is a so-called "trustless" proof mechanism of all the transactions on the network. Access to it is public. Since the blockchain is the record of all Bitcoin transactions, it has a special need for security. For the Science of Security community, research into this problem is related to resiliency and scalability.
Compositionality is one of the five hard problems in the Science of Security.
Compositionality is one of the five hard problems in the Science of Security.
Computing Theory and Privacy 2018 (all)
Getting to the Science of Security will both require and generate fresh looks at computing theory. Privacy, too, is a research area with a theoretical underpinning worth researching. The work cited here is relevant to the Science of Security community problems of human behavior, resilience, and scalability.
Computing Theory and Privacy 2019 (all)
Getting to the Science of Security will both require and generate fresh looks at computing theory. Privacy, too, is a research area with a theoretical underpinning worth researching. The work cited here is relevant to the Science of Security community problems of human behavior, resilience, and scalability.
Computing Theory and Resilience 2019 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of resiliency.
Computing Theory and Security Metrics 2019 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of security metrics.
Concurrency and Security 2019 (all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyberphysical systems in general.
Control Theory and Security 2019 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of resiliency in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of resiliency in the context of cyber physical systems.
Cross Site Scripting 2019 (all)
The research work cited here looks at the Science of Security hard problem of human factors andA type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community, this work is relevant to the hard problems of human behavior, scalability, and resilience.
Dynamic Networks and Security 2018 (all)
Since the Bell System introduced "dynamic routing" several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
Dynamic Networks and Security 2019 (all)
Since the Bell System introduced "dynamic routing" several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
E-government and Cybersecurity 2018 (all)
Electronic government is a growing area for the delivery of services to citizens. However, attacks on government data bases create large problems for a government and its citizens through lost or manipulated information and personal privacy violations. For the Science of Security community, its issues related to human behavior, policy-based governance of information technology systems, and resilience.
E-government and Cybersecurity 2019 (all)
Electronic government is a growing area for the delivery of services to citizens. However, attacks on government data bases create large problems for a government and its citizens through lost or manipulated information and personal privacy violations. For the Science of Security community, its issues related to human behavior, policy-based governance of information technology systems, and resilience.
Expert Systems and Privacy 2019 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2019 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
False Data Detection 2019 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
Human Behavior and Cybersecurity 2018 (all)
Human behavior and cybersecurity is one of the five Hard Problems for the Science of Security.
Human Behavior and Cybersecurity 2019 (all)
Human behavior and cybersecurity is one of the five Hard Problems for the Science of Security.
Industrial Control Systems (ICS) Anomaly Detection 2019 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Internet of Vehicles 2019 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
Kerberos supports authentication in distributed systems. Used in intelligent systems, it is an encrypted data structure naming a user and a service the user may access. For the Science of Security community, it is relevant to the broad issues of cryptography and to resilience, human behavior, resiliency, and metrics.
Recent works show that the reality of privacy preserving and security in decentralized key policy ABE (KP-ABE) schemes are doubtful. How to construct a decentralized KP-ABE with privacy-preserving and user collusion avoidance remains a challenging problem. For the Science of Security community, the problem relates to resilience and scalability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #43
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
Computing Theory and Compositionality 2019 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of trust between humans and humans, humans and computers, and between computers.
Cybersecurity Education 2018 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies. For the Science of Security community, these items are relevant to the areas of hard problems, privacy and cyber-physical systems.
Cybersecurity Education 2019 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies. For the Science of Security community, these items are relevant to the areas of hard problems, privacy and cyber-physical systems.
Information Reuse and Security 2018 (all)
The objective of information reuse is to maximize the value of information by creating simple, rich, and reusable knowledge representations and integrating it into systems and applications. With reuse comes inherent security risk. For the Science of Security community, this problem is relevant to compositionality and resiliency.
Information Reuse and Security 2019 (all)
The objective of information reuse is to maximize the value of information by creating simple, rich, and reusable knowledge representations and integrating it into systems and applications. With reuse comes inherent security risk. For the Science of Security community, this problem is relevant to compositionality and resiliency.
Intellectual Property Security 2018 (all)
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intellectual Property Security 2019 (all)
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Internet of Vehicles 2018 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
I/O Systems Security 2018 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
I/O Systems Security 2019 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
Theft of Intellectual Property, that is, piracy, continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Theft of Intellectual Property, that is, piracy, continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Linux Operating System Security 2019 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focuses on the Linux kernel.
Location Privacy in Wireless Networks 2018 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality.
Location Privacy in Wireless Networks 2019 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2019 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Detection 2019 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Prevention 2019 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Privacy is an important research issues for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Privacy is an important research issues for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Measurement and Metrics Testing 2018 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity of measurement and metrics techniques.
Measurement and Metrics Testing 2019 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity of measurement and metrics techniques.
Operating Systems Security 2018 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics.
Outsourced Database Integrity 2019 (all)
The growth of distributed storage systems such as the Cloud has produced novel security problems. The works cited here address untrusted servers, generic trusted data, trust extension on commodity computers, defense against frequency-based attacks in wireless networks, and other topics. For the Science of Security community, these topics relate to composability, metrics, and resilience.
Resilient Security Architectures 2018 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Resilient Security Architectures 2019 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Security Policies Analysis 2018 (all)
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Policies Analysis 2019 (all)
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Smart Grid Consumer Privacy 2019 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Stochastic Computing Security 2019 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #44
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Ad Hoc Network Security 2020 (all)
Ad Hoc Network Security 2020 Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Bluetooth is a standard for short-range wireless interconnection of cellular phones, computers, and other electronic devices. In common use, it is important to the Science of Security because of its relevance to human behavior, resilient architectures, cyber physical systems, and composability.
Coding Theory and Security 2020 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Computing Theory and Trust 2019 (all)
The works cited here combine research into computing theory with research into trust between humans and humans, humans and computers, and between computers.
Coupled Congestion Control 2018 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
Coupled Congestion Control 2019 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
Human behavior is complex. That complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a Hard Problem.
Human behavior is complex. That complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a hard problem.
Intrusion detection systems defend communications, computer and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability.
Intelligent Data Security 2018 (all)
The term "intelligent data" refers to data that directly feeds decision-making processes. It has real time critical importance and therefore needs a high degree of integrity. For the Science of Security community, it is important to the hard problems of resilience, scalability, and compositionality.
Intelligent Data Security 2019 (all)
The term "intelligent data" refers to data that directly feeds decision-making processes. It has real time critical importance and therefore needs a high degree of integrity. For the Science of Security community, it is important to the hard problems of resilience, scalability, and compositionality.
Internet-scale Computing Security 2018 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
Internet-scale Computing Security 2019 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Malware Analysis and Graph Theory 2019 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Metadata Discovery Problem 2019 (all)
Metadata is often described as "data about data." Usage varies from virtualization to data warehousing to statistics. Because of its volume and complexity, metadata has the potential to tax security procedures and processes. For the Science of Security community, work in this area is relevant to the problems of scalability, resilience, and compositionality.
Neural Style Transfer 2018 (all)
Neural style transfer is receiving significant attention and showing results. One approach trains by defining and optimizing perceptual loss functions in feed-forward convolutional neural networks. Work in this area addresses security issues relative to AI and ML and the hard problems of scalability, resilience, and predictive metrics.
Neural Style Transfer 2019 (all)
Neural style transfer is receiving significant attention and showing results. One approach trains by defining and optimizing perceptual loss functions in feed-forward convolutional neural networks. Work in this area addresses security issues relative to AI and ML and the hard problems of scalability, resilience, and predictive metrics.
Robot Operating Systems Security 2018 (all)
The Robot Operating System (ROS) is a widely adopted standard robotic middleware that is devoid of native security features. With the increased use of robots and the risk to both the machine and the interacting human, consideration of this topic has become important. To the Science of Security community, it is relevant to the hard problems of resilience, policy-based governance, and human factors.
Robot Operating Systems Security 2019 (all)
The Robot Operating System (ROS) is a widely adopted standard robotic middleware that is devoid of native security features. With the increased use of robots and the risk to both the machine and the interacting human, consideration of this topic has become important. To the Science of Security community, it is relevant to the hard problems of resilience, policy-based governance, and human factors.
Robot Operating Systems Security 2020 (all)
The Robot Operating System (ROS) is a widely adopted standard robotic middleware that is devoid of native security features. With the increased use of robots and the risk to both the machine and the interacting human, consideration of this topic has become important. To the Science of Security community, it is relevant to the hard problems of resilience, policy-based governance, and human factors.
The proliferation of robots in the form of personal assistants, medical support devices, and other applications has heighted awareness of security issues with them. Of particular interest here is trust--the confidence the human has that the machine has not been compromised, nor the ones it has been linked to are compromised. For the Science of Security community, this relates to the hard problems of resilience and of human factors.
The proliferation of robots in the form of personal assistants, medical support devices, and other applications has heighted awareness of security issues with them. Of particular interest here is trust--the confidence the human has that the machine has not been compromised, nor the ones it has been linked to are compromised. For the Science of Security community, this relates to the hard problems of resilience and of human factors.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Support Vector Machines 2020 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
Time Frequency Analysis and Security 2019 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trusted Platform Modules 2019 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #45
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic Fingerprints 2020 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Advanced Persistent Threat 2020 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
Applications Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Asymmetric Encryption 2020 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Chaotic Cryptography 2019 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
Chaotic Cryptography 2020 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
"DeepFakes" are realistic but phony facial images produced by generative adversarial networks (GANs) with manipulated audio and/or video clips. There are many ways to use counterfeit contents for nefarious or unlawful purposes. For the Science of Security community, deepfakes are important to the hard problems of metrics, scalability, resilience, and human factors.
"DeepFakes" are realistic but phony facial images produced by generative adversarial networks (GANs) with manipulated audio and/or video clips. There are many ways to use counterfeit contents for nefarious or unlawful purposes. For the Science of Security community, deepfakes are important to the hard problems of metrics, scalability, resilience, and human factors.
Deep Packet Inspection 2020 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Differential Privacy 2020 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
Fuzzy cryptology uses fuzzy set theory to be used as a tool in securing cryptosystems. For the Science of Security community, this topic is relevant to the hard problems of scalability, resilience, and metrics.
Fuzzy cryptology uses fuzzy set theory to be used as a tool in securing cryptosystems. For the Science of Security community, this topic is relevant to the hard problems of scalability, resilience, and metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #46
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience and metrics.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smart phone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
Cross Site Scripting 2020 (all)
A type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community, this work is relevant to the hard problems of human behavior, scalability, and resilience.
Cryptojacking is a method criminals are using to take over computers and using the hijacked processing power to earn cryptocurrency. For the Science of Security community, this new attack vector is relevant to resiliency, metrics, and human behavior.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
The ability to assess damage accurately and quickly is critical to resilience.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDOS Attack Detection 2020 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Since the Bell System introduced "dynamic routing" several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
Edge Detection and Security 2020 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Efficient Encryption 2020 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
Elliptic Curve Cryptography 2020 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Homomorphic Encryption 2020 (all)
Homomorphic encryption shows promise but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Honeypots are traps set up to detect, deflect, or in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Human behavior is complex. That complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a Hard Problem.
Immersion systems, commonly known as "virtual reality", are used for a variety of functions such as gaming, rehabilitation, and training. These systems mix the virtual with the actual, and have implications for cybersecurity because attackers may make the jump from virtual to actual systems. For the Science of Security community, this work is relevant to resilience, human factors, cyber physical systems, privacy, and composability.
Industrial Control Systems 2020 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Neural Style Transfer 2020 (all)
Neural style transfer is receiving significant attention and showing results. One approach trains by defining and optimizing perceptual loss functions in feed-forward convolutional neural networks. Work in this area addresses security issues relative to AI and ML and the hard problems of scalability, resilience, and predictive metrics.
The proliferation of robots in the form of personal assistants, medical support devices, and other applications has heighted awareness of security issues with them. Of particular interest here is trust--the confidence the human has that the machine has not been compromised, nor the ones it has been linked to are compromised. For the Science of Security community, this relates to the hard problems of resilience and of human factors.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #47
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Biometric Encryption 2020 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues. For the Science of Security community, this work is relevant to resilience, scalability, and metrics.
Recent revelations that processors have had long-standing vulnerabilities have triggered a greater interest in relooking at firmware in general. Research into Basic Input Output Operations Systems (BIOS) has produced some work relevant to the Science of Security issues of human factors, resilience, metrics, and scalability.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
Black Box Encryption 2020 (all)
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." This research looks at how to protect the black box itself separate from the encryption problem. For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
In a blackhole attack, a malicious node advertises itself as the shortest route to a destination, luring packets. The malicious node can then drop the packets or create a false route. For the Science of Security community, this research is relevant to the Hard Problems of resiliency and scalability.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
Brute Force Attacks 2020 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Cognitive Radio Security 2020 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Command Injection Attacks 2020 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Compiler Security Security 2020 (all)
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Named Data Networking 2020 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Natural Language Processing 2020 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Nearest Neighbor Search 2020 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problems of measurement and predictive metrics.
Network Accountability 2020 (all)
The term "accountability" suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Network Intrusion Detection 2020 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Network Reconnaissance 2020 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance. These are related to the Science of Security hard problems of resilience and scalability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Windows Operating System Security 2020 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Wireless Mesh Network Security 2020 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Work Factor Metrics 2020 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Explainable Artificial Intelligence (XAI) has become an area of interest in research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero Day Attacks and Defense 2020 (all)
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
If there is no link between a pair of entities, no trust decision has yet been made. Operating in an unknown trust environment creates security problems related to scalability, policy-based governance, human factors, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #48
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Belief networks are Bayesian models that that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modelling beliefs in complex physical networks or systems and are important to the Science of Security.
Composability of security processes is one of the five hard problems for the Science of Security.
Compressive Sampling 2020 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Expert Systems and Privacy 2020 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2020 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include. It is relevant to the hard problems of scalability and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
Fuzzy Logic and Security 2020 (all)
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Game Theoretic Security 2020 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Generative Adversarial Learning 2020 (all)
AI and Machine Learning are being used to develop a wide range of applications including visual, audio, and text. The use of these methods has large security implications. Research into the security aspects is relevant to the Science of Security hard problems of resilience, predictive metrics, and scalability.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Human Behavior and Security 2020 (all)
Human behavior and its impact on cybersecurity is a hard problem in the Science of Security.
ICS Anomaly Detection 2020 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is required to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. For the Science of Security community, this research is relevant to scalability, resilience, and human behavior.
Intrusion detection systems defend communications, computer, and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability.
Information Assurance 2020 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
Information Centric Networks 2020 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
Information Forensics 2020 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Information Reuse and Security 2020 (all)
The objective of information reuse is to maximize the value of information by creating simple, rich, and reusable knowledge representations and integrating it into systems and applications. With reuse comes inherent security risk. For the Science of Security community, this problem is relevant to compositionality and resiliency.
Information Theoretic Security 2020 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance, and resilience.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Searchable Encryption 2020 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Security Heuristics 2020 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #49
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Anonymous Messaging 2020 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable, and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Artificial Intelligence Security 2020 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
Artificial Neural Networks 2020 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Attestation is the verification of changes to software as part of trusted computing. For the Science of Security community, it is relevant to composability, resilience, and human behavior.
Attribution of the source of an attack or the author of malware is a continuing problem in computer forensics. For the Science of Security community, it is an important issue related to human behavior, metrics, and composability.
Big Data Security in the Cloud 2020 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2020 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Blockchain Security 2020 (all)
The blockchain is the "public ledger" of all Bitcoin transactions. It is a so-called "trustless" proof mechanism of all the transactions on the network. Access to it is public. Since the blockchain is the record of all Bitcoin transactions, it has a special need for security. For the Science of Security community, research into this problem is related to resiliency and scalability.
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Router Systems Security 2020 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2020 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2020 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Secure File Sharing 2020 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
Security by Default 2020 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Measurement and metrics are one of the five hard problems in the Science of Security.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Visible Light Communications Security 2020 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Vulnerability Detection 2020 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Web Browser Security 2020 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Web caches offer a potential for mischief. With the expanded need for caching capability with the cloud and mobile communications, the need for more and better security has also grown. This research is relevant to the Science of Security hard problems of resilience, scalability, and metrics.
The creation of trust across networks is an important aspect of cybersecurity. Much of current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
White Box Cryptography 2020 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #50
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Compositionality of security processes is one of the five hard problems for the Science of Security.
Computational Intelligence 2020 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computing Theory and Trust 2020 (all)
The works cited here combine research into computing theory with research into trust between humans and humans, between humans and computers, and between computers. For the Science of Security community, this work relates to the hard problems of human factors, resiliency, and composability.
Concurrency and Security 2020 (all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyberphysical systems in general.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Control Theory and Privacy 2020 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The research work presented here specifically addresses issues in privacy.
Control Theory and Resiliency 2020 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The work cited here focuses on resiliency.
Ciphertext Policy Attribute Based Encryption (CP-ABE) techniques provide fine grained access control to securely share organizational data where role-based access rights are in use. For the Science of Security community, CP-ABE is related to policy-based governance and scalability.
CPS Modeling and Simulation 2020 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of Resiliency in the context of cyber physical systems.
Cross Layer Security 2020 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Cybersecurity Education 2020 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies. For the Science of Security community, these items are relevant to the areas of hard problems, privacy and cyber-physical systems.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #51
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
Automated Response Actions 2020 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Automated Secure Software Engineering 2020 (all)
Automation of secure software engineering holds promise for reducing coding errors that can be exploited. For the Science of Security community, such processes can be keys to composability and resiliency.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Black box attacks occur against "security of a cryptographic algorithm studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Computing Theory and Privacy 2020 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of privacy.
Computing Theory and Resilience 2020 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability and compositionality.
False Data Detection 2020 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Fog Computing and Security 2020 (all)
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. For the Science of Security community, it is relevant to the hard problems of resilience and scalability.
Forward Error Correction and Security 2020 (all)
Forward Error Correction, also known as Channel coding, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Intellectual Property Security 2020 (all)
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intelligent Data and Security 2020 (all)
The term "intelligent data" refers to data that directly feeds decision-making processes. It has real time critical importance and therefore needs a high degree of integrity. For the Science of Security community, it is important to the hard problems of resilience, scalability, and compositionality.
Internet of Vehicles Security 2020 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Two Factor Authentication 2020 (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers because it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
Ubiquitous Computing Security 2020 (all)
Ubiquitous computing is a concept in software engineering and computer science where computing is made to appear anytime and everywhere. In contrast to desktop computing, ubiquitous computing can occur using any device, in any location, and in any format. Incorporating all aspects of the cyber world, including the internet, the processor, the Cloud, and so on, ubiquitous computing has significant security challenges. The Science of Security community, the work cited here is relevant to scalability, metrics, human factors and resilience.
Underwater Networks Security 2020 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
User Privacy in the Cloud 2020 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Video surveillance is a fast-growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Virtualization Privacy 2020 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
Virtual Machine Security 2020 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggests it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #52
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Attribute-based Encryption 2020 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Computing Theory and Composability 2020 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability.
Computing Theory and Security Metrics 2020 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of security metrics.
Computer Theory and Trust 2020 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of trust between humans and humans, humans and computers, and between computers.
Internet-scale Computing Security 2020 (all)
Addressing security at Internet scale relates to all of the Hard Problems of the Science of Security.
Intrusion Tolerance 2020 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
The term Internet of Things (IT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Theft of Intellectual Property, that is, privacy, continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Internet Protocol Version 6 is slowly being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Kerberos supports authentication in distributed systems. Used in intelligent systems, it is an encrypted data structure naming a user and a service the user may access. For the Science of Security community, it is relevant to the broad issues of cryptography and to resilience, human behavior, resiliency, and metrics.
Successful key management is critical to the security of any cryptosystem. It is perhaps the most difficult part of cryptography including as it does system policy, user training, organizational and departmental interactions, and coordination between all of these elements and includes dealing with the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, key management is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Lightweight Ciphers 2020 (all)
Lightweight cryptography is a major research direction. The release of SIMON in June 2013 generated significant interest and a number of studies evaluating and comparing it to other cipher algorithms. To the Science of Security community, lightweight ciphers can support resilience and scalability, especially in cyber physical systems constrained with power and "weight" budgets.
Linux Operating System Security 2020 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focuses on the Linux kernel.
Location Privacy in Wireless Networks 2020 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality.
Privacy is an important research issues for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Security is an important research issue for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Measurement And Metrics Testing 2020 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity of measurement and metrics techniques.
Metadata Discovery Problem 2020 (all)
Metadata is often described as "data about data." Usage varies from virtualization to data warehousing to statistics. Because of its volume and complexity, metadata has the potential to tax security procedures and processes. For the Science of Security community, work in this area is relevant to the problems of scalability, resilience, and compositionality.
Microelectronics Security 2020 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Middleware Security 2020 (all)
Middleware facilitates distributed processing and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Moving Target Defense 2020 (all)
Moving Target Defense (MTD) research focuses on the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to scalability, resilience and predictive metrics.
Science of Security 2019 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #53
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Controller Area Network Security 2020 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the Internet of Things.
Control Theory and Security 2020 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve the Science of Security community hard problems in resiliency and composability.
Conversational Agents 2020 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Coupled Congestion Control 2020 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
DDOS Attack Detection 2020 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Mitigation 2020 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Prevention 2020 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
I-O Systems Security 2020 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Analysis and Graph Theory 2020 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2020 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Detection 2020 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
MANET Attack Prevention 2020 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Quantum Computing Security 2020 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. To the Science of Security community, they are interest in terms of scalability.
Random Key Generation 2020 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Recommender Systems 2020 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Relational Database Security 2020 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability, human behavior, and metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency of cybersecurity systems and their development is one of the five major hard problems in the Science of Security.
Resilient Security Architectures 2020 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Return Oriented Programming 2020 (all)
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. This work is related to the Science of Security issues of resiliency and human behaviors.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Scientific Computing Security 2020 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #54
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Multicore Computing Security 2020 (all)
As high performance computing has evolved into larger and faster computing solutions, new approaches to security have been identified. The articles cited here focus on security issues related to multicore environments. Multicore computing relates to the Science of Security hard topics of scalability, resilience, and metrics.
Multifactor Authentication 2020 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Multiple Fault Diagnosis 2020 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Networked Control Systems Security 2020 (all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics.
Network on Chip Security 2020 (all)
Network on chip (NoC or NOC) is a communication subsystem on an integrated circuit. NOC technology applies networking theory and methods to on-chip communication and brings improvements over conventional interconnections. From a Science of Security perspective, NOC security is relevant to scalability, resilience, and metrics.
Network Security Architecture 2020 (all)
The requirement for security and resilience in network security architecture is one of the hard problems in the Science of Security.
Neural Network Security 2020 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Object Oriented Security 2020 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Operating Systems Security 2020 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics.
Oscillating Behaviors 2020 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Outsourced Database Security 2020 (all)
The outsourcing of database security adds complexity and risk to the challenges of security. For the Science of Security community, the problems created are related to the hard problems of scalability, human behavior, predictive metrics, and resiliency.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability, and resilience.
Peer to Peer Security 2020 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
Pervasive Computing Security 2020 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
Power Grid Vulnerability 2020 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Predictive Security Metrics 2020 (all)
Measurement is at the core of science. The development of accurate metrics is a major element for achieving a true Science of Security. It is also one of the hard problems to solve.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Privacy Policies and Measurement 2020 (all)
Measuring the impact and technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of metrics, scalability and to human behavior.
Protocol Verification 2020 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #55
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for sensor security.
Signal Processing Security 2020 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Signature Based Defense 2020 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Situational Awareness 2020 (all)
Situational awareness is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Smart Grid Consumer Privacy 2020 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart-meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
Smart Grid Security 2020 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Theoretical Cryptography 2020 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Time Frequency Analysis and Security 2020 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trojan Horse Detection 2020 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trusted Platform Modules 2020 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trustworthy Systems 2020 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #56
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Acoustic Fingerprints 2021 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices, and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by a variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Ad Hoc Network Security 2021 (all)
Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Advanced Persistent Threat 2021 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience and metrics.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Minimizing privacy risk is one of the major problems in the development of social media and hand-held smartphone technologies, vehicle ad hoc networks, and wireless sensor networks. For the Science of Security community, the research issues addressed relate to the hard problems of resiliency, composability, metrics, and human behavior.
Anonymous Messaging 2021 (all)
Anonymous messages contain embedded information about where to send them next. In theory, message strings can become untraceable, and anonymity maintained. This is a double-edged issue, offering security and privacy on the one hand and creating an attribution problem on the other. For the Science of Security community, this work is relevant to the problems of resiliency and scalability.
Application Programming Interfaces, APIs, are definitions of interfaces to systems or modules. As code is reused, more and more are modified from earlier code. For the Science of Security community, the problems of compositionality and resilience are direct.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Sensors represent both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
Theoretical Cryptography 2020 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Explainable Artificial Intelligence (XAI) has become an area of interest in the research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
If there is no link between a pair of entities, no trust decision has yet been made. Operating in an unknown trust environment creates security problems related to scalability, policy-based governance, human factors, and resilience.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #57
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Artificial Intelligence Security 2021 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
Artificial Neural Networks 2021 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Asymmetric Encryption 2021 (all)
Asymmetric, or public key, encryption is a cornerstone of cybersecurity. The research presented here looks at key distribution, compares symmetric and asymmetric security, and evaluates cryptographic algorithms, among other approaches. For the Science of Security community, encryption is a primary element for resiliency, compositionality, metrics, and behavior.
Security analysts use attack graphs for detection, defense and forensics. An attack graph is defined as a representation of all paths through a system that end in a state where an intruder has successfully breached the system. They are an important tool for the Science of Security related to predictive metrics, resiliency, and composability.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Attestation is the verification of changes to software as part of trusted computing. For the Science of Security community, it is relevant to composability, resilience, and human behavior.
Attribution of the source of an attack or the author of malware is a continuing problem in computer forensics. For the Science of Security community, it is an important issue related to human behavior, metrics, and composability.
Attribute-based Encryption 2021 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
Automated Response Actions 2021 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Automated Secure Software Engineering 2021 (all)
Automation of secure software engineering holds promise for reducing coding errors which can be exploited. For the Science of Security community, such processes can be keys to composability and resiliency.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #58
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Classification 2021 (all)
Malware classification, along with detection and analysis, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Detection 2021 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack detection. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Privacy is an important research issues for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Security is an important research issue for mobile ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Microelectronics Security 2021 (all)
Microelectronics is at the center of the IT world. Their security--provenance, integrity of their manufacture, and capacity for providing embedded security--is both an opportunity and a problem for cybersecurity research. For the Science of Security community, microelectronic security is a constituent component of resiliency, composability, and predictive metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency of cybersecurity systems and their development is one of the five major hard problems in the Science of Security.
Return Oriented Programming 2021 (all)
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. This work is related to the Science of Security issues of resiliency and human behaviors.
Robot Operating Systems Security 2021 (all)
The Robot Operating System (ROS) is a widely adopted standard robotic middleware that is devoid of native security features. With the increased use of robots and the risk to both the machine and the interacting human, consideration of this topic has become important. To the Science of Security community, it is relevant to the hard problems of resilience, policy-based governance, and human factors.
The proliferation of robots in the form of personal assistants, medical support devices, and other applications has heighted awareness of security issues with them. Of particular interest here is trust--the confidence the human has that the machine has not been compromised, nor the ones it has been linked to are compromised. For the Science of Security community, this relates to the hard problems of resilience and of human factors.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Theoretical Cryptography 2020 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Time Frequency Analysis and Security 2020 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trojan Horse Detection 2020 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trusted Platform Modules 2020 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trustworthy Systems 2020 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
The proliferation of personal wearable devices to track athletic performance and their adaptation and adaptation for health monitoring presents challenges for security. The small processing power and storage and the potential for compromise have stimulated research. For the Science of Security community, this research is relevant to the hard problems of human behavior and privacy, resiliency, and scalability.
Web Browser Security 2021 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Web caches offer a potential for mischief. With the expanded need for caching capability with the cloud and mobile communications, the need for more and better security has also grown. This research is relevant to the Science of Security hard problems of resilience, scalability, and metrics.
The creation of trust across networks is an important aspect of cybersecurity. Much of current research is focusing on graph theory as a means to develop a "web of trust." For the Science of Security community, resiliency and composability are related hard problems.
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Wireless Mesh Networks 2021 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Work Factor Metrics 2021 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #59
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Malware Analysis and Graph Theory 2021 (all)
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
MANET Attack Prevention 2021 (all)
Security is an important research issue for mobile ad hoc networks (MANETs). The work cited here looks at attack prevention. For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Measurement and Metrics Testing 2021 (all)
Measurement and metrics are hard problems in the Science of Security. The research cited here looks at methods and techniques for testing the validity of measurement and metrics techniques.
Metadata Discovery Problem 2021 (all)
Metadata is often described as "data about data." Usage varies from virtualization to data warehousing to statistics. Because of its volume and complexity, metadata has the potential to tax security procedures and processes. For the Science of Security community, work in this area is relevant to the problems of scalability, resilience, and compositionality.
Middleware Security 2021 (all)
Middleware facilitates distributed processing and is of significant interest to the security world with the development of cloud and mobile applications. It is important to the Science of Security community relative to resilience, policy-based governance and composability.
Moving Target Defense 2021 (all)
Moving Target Defense (MTD) research focuses on the presentation of a dynamic attack surface to an adversary, increasing the work factor necessary to successfully attack and exploit a cyber target. For the Science of Security community, MTD is related to scalability, resilience and predictive metrics.
Multicore Computing 2021 (all)
As high-performance computing has evolved into larger and faster computing solutions, new approaches to security have been identified. The articles cited here focus on security issues related to multicore environments. Multicore computing relates to the Science of Security hard topics of scalability, resilience, and metrics.
Multifactor Authentication 2021 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Multiple Fault Diagnosis 2021 (all)
According to Shakeri, "the computational complexity of solving the optimal multiple-fault isolation problem is super exponential." Most processes and procedures assume that there will be only one fault at any given time. Many algorithms are designed to do sequential diagnostics. With the growth of cloud computing and multicore processors and the ubiquity of sensors, the problem of multiple fault diagnosis has grown even larger. For the Science if Security community, multiple fault diagnosis is relevant to cyber physical systems, resiliency, metrics, and human factors.
Named Data Networking 2021 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Natural Language Processing 2021 (all)
Natural language processing research focuses on developing efficient algorithms to process texts and to make their information accessible to computer applications. Texts can contain information with different complexities ranging from simple word or token-based representations to rich hierarchical syntactic representations, to high-level logical representations across document collections. For the Science of Security community, this work is relevant to scalability, resilience, and human behavior.
Nearest Neighbor Search 2021 (all)
The search for secure privacy protecting nearest neighbor searches is an issue in cybersecurity related to the Science of Security community hard problems of measurement and predictive metrics.
Network Accountability 2021 (all)
The term "accountability' suggests that an entity should be held responsible for its own specific actions. Once an event has transpired, the events that took place need to be traceable so that the causes can be determined afterwards. The goal of network accountability research is to provide accountability within networks and computers by building trace files of events. For the Science of Security community, it is relevant to composability, resilience, and metrics.
Network coding methods are used to improve a network's throughput, efficiency and scalability. It can also be a method for dealing with attacks and eavesdropping. For the Science of Security community, research into network coding is relevant to the general network problems associated with the hard problems of resiliency, composability, and predictive metrics, as well as cyber physical systems.
Networked Control Systems Security 2021 (all)
Network control systems (NCS) offer a relatively inexpensive way for communications networks to provide diagnostics, flexibility, and robustness. To the Science of Security community, NCS research is relevant to the hard problems of resiliency, composability, and predictive metrics.
Network Intrusion Detection 2021 (all)
Network intrusion detection is one of the chronic problems in cybersecurity. The growth of cellular and ad hoc networks has increased the threat and risks and research into this area of concern reflects its importance. For the Science of Security community, NID is relevant to metrics, composability, and resilience.
Network on Chip Security 2021 (all)
Network on chip (NoC or NOC) is a communication subsystem on an integrated circuit. NOC technology applies networking theory and methods to on-chip communication and brings improvements over conventional interconnections. From a Science of Security perspective, NOC security is relevant to scalability, resilience, and metrics.
Network Reconnaissance 2021 (all)
The capacity to survey, analyze and assess a network is a critical aspect of developing resilient systems. The work cited here addresses multiple methods and approaches to network reconnaissance. These are related to the Science of Security hard problems of resilience and scalability.
The requirement for security and resilience in networks is one of the hard problems in the Science of Security.
Neural Network Security 2021 (all)
Artificial neural networks have been used to solve a wide variety of tasks that are hard to solve using ordinary rule-based programming. What has attracted much interest in neural networks is the possibility of learning. Tasks such as function approximation, classification pattern and sequence recognition, anomaly detection, filtering, clustering, blind source separation and compression and controls all have security implications. Cyber physical systems, resiliency, policy-based governance and metrics are the Science of Security interests.
Neural Style Transfer 2021 (all)
Neural style transfer is receiving significant attention and showing results. One approach trains by defining and optimizing perceptual loss functions in feed-forward convolutional neural networks. Work in this area addresses security issues relative to AI and ML and the hard problems of scalability, resilience, and predictive metrics.
Peer to Peer Security 2021 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
Predictive Security Metrics 2021 (all)
Measurement is at the core of science. The development of accurate metrics is a major element for achieving a true Science of Security. It is also one of the hard problems to solve.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Privacy Policies and Measurement 2021 (all)
Measuring the impact and technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of metrics, scalability and to human behavior.
Protocol Verification 2021 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy-based collaboration, as well as for privacy alone.
The term "provable security" refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Provenance refers to information about the origin and activities of system data and processes. With the growth of shared services and systems, including social media, cloud computing, and service-oriented architectures, finding tamperproof methods for tracking files is a major challenge. Provenance is important to the Science of Security relative to human behavior, metrics, resilience, and composability.
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Router Systems Security 2021 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2021 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2021 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Smart Grid Security 2021 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Sensors represent are both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Support Vector Machines 2021 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #60
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
Ciphertext Policy Attribute Based Encryption (CP-ABE) techniques provide fine grained access control to securely share organizational data where role-based access rights are in use. For the Science of Security community, CP-ABE is related to policy-based governance and scalability.
CPS Modeling and Simulation 2021 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of resiliency in the context of cyber physical systems.
Cross Layer Security 2021 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Cross Site Scripting 2021 (all)
A type of computer security vulnerability typically found in Web applications, cross-site scripting (XSS) enables attackers to inject client-side script into Web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same origin policy. Consequences may range from petty nuisance to significant security risk, depending on the value of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner. A frequent method of attack, research is being conducted on methods to prevent, detect, and mitigate XSS attacks. For the Science of Security community, this work is relevant to the hard problems of human behavior, scalability, and resilience.
The ability to assess damage accurately and quickly is critical to resilience.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDOS Attack Detection 2021 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Mitigation 2021 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Prevention 2021 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Scientific Computing Security 2021 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resiliency.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to scalability and resiliency.
Searchable Encryption 2021 (all)
Searchable encryption allows one to store encrypted data externally, but still allow for easy data searches that do not require the search to download everything before decrypting and to allow others to search data without having access to plaintext. As an application, it is becoming increasingly important in the Cloud environment. For the Science of Security community, it is an area of research related to cryptography, resilience, and composability.
Secure File Sharing 2021 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security Heuristics 2021 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Risk Estimation 2021 (all)
Calculating risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Scalability 2021 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Security Weaknesses 2021 (all)
Attackers need only find one or a few exploitable vulnerabilities to mount a successful attack while defenders must shore up as many weaknesses as practicable. The research presented here covers a range of weaknesses and approaches for identifying and securing against attacks. Many articles focus on key systems, both public and private. Hard problems addressed include human behavior, policy-based governance, resilience and metrics.
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Signature Based Defense 2021 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Signal Processing Security 2021 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #61
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
"DeepFakes" are realistic but phony facial images produced by generative adversarial networks (GANs) with manipulated audio and/or video clips. There are many ways to use counterfeit contents for nefarious or unlawful purposes. For the Science of Security community, deepfakes are important to the hard problems of metrics, scalability, resilience, and human factors.
Deep Packet Inspection 2021 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Differential Privacy 2021 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Dynamical Systems Security 2021 (all)
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Edge Detection and Security 2021 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Efficient Encryption 2021 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
Elliptic Curve Cryptography 2021 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality, resiliency.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
Theoretical Cryptography 2021 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Trojan Horse Detection 2021 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Ubiquitous Computing 2021 (all)
Ubiquitous computing is a concept in software engineering and computer science where computing is made to appear anytime and everywhere. In contrast to desktop computing, ubiquitous computing can occur using any device, in any location, and in any format. Incorporating all aspects of the cyber world, including the internet, the processor, the Cloud, and so on, ubiquitous computing has significant security challenges. The Science of Security community, the work cited here is relevant to scalability, metrics, human factors and resilience.
Underwater Networks Security 2021 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
User Privacy in the Cloud 2021 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Video surveillance is a fast-growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Virtual Machine Security 2021 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Visible Light Communications Security 2021 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Vulnerability Detection 2021 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #62
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Homomorphic Encryption 2021 (all)
Homomorphic encryption shows promise but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Honeypots are traps set up to detect, deflect, or in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Human behavior is complex. That complexity creates a tremendous problem for cybersecurity. The works cited here address a range of human trust issues related to behaviors, deception, enticement, sentiment and other factors difficult to isolate and quantify. For the Science of Security community, human behavior is a Hard Problem.
Intrusion detection systems defend communications, computer, and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability.
Industrial Control Systems 2021 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance, and resilience.
Intellectual Property Security 2021 (all)
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intelligent Data and Security 2021 (all)
The term "intelligent data" refers to data that directly feeds decision-making processes. It has real time critical importance and therefore needs a high degree of integrity. For the Science of Security community, it is important to the Hard Problems of resilience, scalability, and compositionality.
Internet of Vehicles Security 2021 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
Internet-scale Computing Security 2021 (all)
Addressing security at Internet scale relates to all of the Hard Problems of the Science of Security.
Intrusion Tolerance 2021 (all)
Intrusion tolerance refers to a fault-tolerant design approach to defending communications, computer and other information systems against malicious attack. Rather than detecting all anomalies, tolerant systems only identify those intrusions which lead to security failures. The topic relates to the Science of Security issues of resilience and composability.
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
The term "text analytics" refers to linguistic, statistical, and machine learning techniques that model and structure the information content of textual sources for intelligence, exploratory data analysis, research, or investigation. The research cited here focuses on large volumes of text mined to identify insider threats, intrusions, and malware detection. It is of interest to the Science of Security community relative to metrics, scalability and composability, and human factors.
Theoretical Cryptography 2021 (all)
Cryptography can only exist if there is a mathematical hardness to it constructed to maintain a desired functionality, even under malicious attempts to change or destroy the prescribed functionality. The foundations of theoretical cryptography are the paradigms, approaches and techniques used to conceptualize, define and provide solutions to natural ``security concerns' mathematically using probability-based definitions, various constructions, complexity theoretic primitives and proofs of security. For the Science of Security community, this work is relevant to the broad problem of developing a science, as well as contributing to the solution of the hard problems of composability and compositionality.
Threat mitigation is a continuous need in cybersecurity. For the Science of Security community, threat mitigation is related to resiliency, metrics, and human behavior.
As systems become larger and more complex, the surface that hackers can attack also grows. Is this set of recent research articles, topics are explored that include smartphone malware, zero-day polymorphic worm detection, source identification, drive-by download attacks, two-factor face authentication, semantic security, and code structures. Of particular interest to the Science of Security community are the research articles focused on measurement and on privacy.
Trojan Horse Detection 2021 (all)
Detection and neutralization of hardware-embedded Trojans is a difficult problem. Current research is attempting to find ways to develop detection methods and processes and to automate the process. This research is relevant to cyber physical systems security, resilience and composability, as well as being an issue in supply chain security.
Ubiquitous Computing 2021 (all)
Ubiquitous computing is a concept in software engineering and computer science where computing is made to appear anytime and everywhere. In contrast to desktop computing, ubiquitous computing can occur using any device, in any location, and in any format. Incorporating all aspects of the cyber world, including the internet, the processor, the Cloud, and so on, ubiquitous computing has significant security challenges. The Science of Security community, the work cited here is relevant to scalability, metrics, human factors and resilience.
Underwater Networks Security 2021 (all)
Underwater networks have some unique security issues related to the environment they operate in. For the Science of security community, the research conducted and presented here is relevant to cyber-physical systems and work on resiliency, metrics, and scalability.
User Privacy in the Cloud 2021 (all)
Privacy is a major problem for distributed file systems, that is, in the Cloud. For the Science of Security community, this work is relevant to scalability, resilience, and metrics.
Video surveillance is a fast-growing area of public security. With it have come policy issues related to privacy. Technical issues and opportunities have also arisen, including the potential to use advanced methods to provide positive identification, abnormal behaviors in crowds, intruder detection, and information fusion with other data. For the Science of Security community, it is relevant to human behavior, metrics, and resiliency.
Virtual Machine Security 2021 (all)
Arguably, virtual machines are more secure than actual machines. This idea is based on the notion that an attacker cannot jump the gap between the virtual and the actual. The growth of interest in cloud computing suggest it is time for a fresh look at the vulnerabilities in virtual machines. In the articles presented below, security concerns are addressed in some interesting ways. For the Science of Security community, virtualization is related to composability, resiliency, cyber physical systems, and cryptography.
Visible Light Communications Security 2021 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Vulnerability Detection 2021 (all)
Vulnerability detection is a topic for which a great deal of research is being done. For the Science of Security community, vulnerability detection research is relevant to human behavior, resiliency, compositionality, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #63
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2021 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Coding Theory and Security 2021 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Cognitive Radio Security 2021 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Cryptojacking is a new method criminals are using to take over computers and using the hijacked processing power to earn cryptocurrency. For the Science of Security community, this new attack vector is relevant to resiliency, metrics, and human behavior.
Cryptology, the use of techniques for secure communication in the presence of adversaries, is one of the primary subjects of the Science of Security and impacts study into all of the hard problems.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
Cybersecurity Education 2021 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies. For the Science of Security community, these items are relevant to the areas of hard problems, privacy and cyber-physical systems.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include. It is relevant to the hard problems of scalability and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
False Data Detection 2021 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Homomorphic Encryption 2021 (all)
Homomorphic encryption shows promise but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
Honeypots are traps set up to detect, deflect, or in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers. With increased network size and complexity, the need for advanced methods is growing. Specifically, cloud and virtual security need advanced methods for malware detection and collection. For the Science of Security community, this work is relevant to resiliency, scalability, and human factors.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Human-in-the-loop (HITL) machine learning is a blend of supervised machine learning and active learning. A human influences the outcome in such a way that is difficult to reproduce. The practice of uniting human and machine intelligence to create effective machine learning algorithms is relevant to the Science of Security hard problems of Human Factors and Scalability.
Pervasive Computing Security 2021 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
QR codes are used to store information in two dimensional grids which can be decoded quickly. The work here deals with extending its encoding and decoding implementation for user authentication and access control as well as tagging. For the Science of Security community, the work is relevant to cyber physical systems, cryptography, and resilience.
Quantum Computing Security 2021 (all)
While quantum computing is still in its early stage of development, large-scale quantum computers promise to be able to solve certain problems much more quickly than any classical computer using the best currently known algorithms. Quantum algorithms, such as Simon's algorithm, run faster than any possible probabilistic classical algorithm. For the Science of Security, the speed, capacity, and flexibility of qubits over digital processing offers still greater promise and relate to the hard problems of resilience, predictive metrics and composability. To the Science of Security community, they are interest in terms of scalability.
Random Key Generation 2021 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Recommender Systems 2021 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Relational Database Security 2021 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability human behavior, and metrics.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #64
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Command Injection Attacks 2021 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Composability of security processes is one of the five hard problems for the Science of Security.
Compositionality of security processes is one of the five hard problems for the Science of Security.
Compressive Sampling 2021 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence 2021 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation, and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computing Theory and Trust 2021 (all)
The works cited here combine research into computing theory with research into trust between humans and humans, between humans and computers, and between computers. For the Science of Security community, this work relates to the hard problems of human factors, resiliency, and composability.
Object Oriented Security 2021 (all)
The use of common object-oriented design patterns as a mechanism for access control is called Object-Oriented Security. These mechanisms can be easier to use and more effective than traditional security models. For the Science of Security community, OOP security models are of interest relative to the hard problems of resiliency, composability, and metrics.
Operating Systems Security 2021 (all)
Operating systems security is a component of resiliency, composability, and an area of concern for predictive metrics.
Oscillating Behaviors 2021 (all)
Broadly speaking, signal processing covers signal acquisition and reconstruction, quality improvement, signal compression and feature extraction. Each of these processes introduces vulnerabilities into communications and other systems. The research articles cited here explore trust between networks, steganalysis, tracing passwords across networks, and certificates. They address the Science of Security hard problems related to privacy, resilience, metrics, and composability.
Outsourced Database Security 2021 (all)
The outsourcing of database security adds complexity and risk to the challenges of security. For the Science of Security community, the problems created are related to the hard problems of scalability, human behavior, predictive metrics, and resiliency.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability, and resilience.
Power Grid Vulnerability Analysis 2021 (all)
The primary value of published research in power grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Power grid vulnerability research is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Trusted Platform Modules 2021 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Trustworthy Systems 2021 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Two Factor Authentication (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers because it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #65
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Computing Theory and Resilience 2021 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability and compositionality.
Computing Theory and Security 2021 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of security metrics.
Computing Theory and Security Metrics 2021 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problem of security metrics.
Concurrency and Security 2021 (all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyberphysical systems in general.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Control Theory and Privacy 2021 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The research work presented here specifically addresses issues in privacy.
Control Theory and Resilience 2021 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
Control Theory and Security 2021 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in security. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
Controller Area Network Security 2021 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the internet of Things.
Conversational Agents 2021 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Coupled Congestion Control 2021 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Expert Systems and Privacy 2021 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2021 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Fog Computing and Security 2021 (all)
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. For the Science of Security community, it is relevant to the hard problems of resilience and scalability.
Forward Error Correction and Security 2021 (all)
Forward Error Correction, also known as Channel coding, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Fuzzy cryptology uses fuzzy set theory to be used as a tool in securing cryptosystems. For the Science of Security community, this topic is relevant to the hard problems of scalability, resilience, and metrics.
Fuzzy Logic and Security 2021 (all)
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Supply Chain Risk Assessment 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Risk Assessment 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Security 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Supply Chain Security 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Time Frequency Analysis and Security 2021 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trusted Platform Modules 2021 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Trustworthy Systems 2021 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Two Factor Authentication (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers because it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
Virtualization Privacy 2021 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #66
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Game Theoretic Security 2021 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Human Behavior and Cybersecurity 2021 (all)
Human behavior and its impact on cybersecurity is a hard problem in the Science of Security.
ICS Anomaly Detection 2021 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Identity Management 2021 (all)
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. For the Science of Security community, this research is relevant to scalability, resilience, and human behavior.
Information Theoretic Security 2021 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
I-O Systems Security 2021 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
The term Internet of Things (IoT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Location Privacy in Wireless Networks 2021 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Multifactor Authentication 2021 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Named Data Network Security 2021 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2020 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static Code Analysis 2020 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2020 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Steganography Detection 2021 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stochastic Computing Security 2020 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stochastic Computing Security 2021 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Supply Chain Risk Assessment 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Risk Assessment 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Security 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Supply Chain Security 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Time Frequency Analysis and Security 2021 (all)
Time-frequency analysis is a useful method that allows simultaneous consideration of both the time and frequency domains. It is useful to the Science of Security community for analysis in cyber-physical systems and toward solving the hard problems of resilience, predictive metrics, and scalability.
Trusted Platform Modules 2021 (all)
A Trusted Platform Module (TPM) is a computer chip that can securely store artifacts used to authenticate a network or platform. These artifacts can include passwords, certificates, or encryption keys. A TPM can also be used to store platform measurements that help ensure that the platform remains trustworthy. Interest in TPMs is growing due to their potential for solving hard problems in security such as composability and cyber-physical system security and resilience.
Trust routing schemes are a key component for building resilient architectures and for composable and scalable security systems.
Trustworthiness is created in information security through cryptography to assure the identity of external parties. They are essential to cybersecurity and to the Science of Security hard problem of composability.
Trustworthy Systems 2021 (all)
Trust is created in information security to assure the identity of external parties. Trustworthy systems are a key element in the security of cyber physical systems, resiliency, and composability.
Two Factor Authentication (all)
Two factor authentication or 2FA is regarded as a solution to common attacks. However, it sometimes becomes a form of bait for attackers because it is often used to secure high value information. For the Science of Security community, it is relevant to the hard problem of human factors.
Virtualization Privacy 2021 (all)
Virtualization is seen as a means of enhancing security by maintaining a gap between the end user and the host. But privacy or virtual data is a growing problem, especially when the virtual system is in the Cloud. For the Science of Security community, virtualization privacy is related to the hard problems of resilience, composability, metrics, and privacy, an issue in human behavior.
White Box Cryptography 2021 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Windows Operating System Security 2021 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #67
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Information Theoretic Security 2021 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
I-O Systems Security 2021 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Location Privacy in Wireless Networks 2021 (all)
Privacy services on mobile devices are a major issue in cybersecurity. For the Science of Security community, the problem relates to resiliency, metrics, human behavior, and compositionality.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Multifactor Authentication 2021 (all)
Multifactor authentication is of general interest within cryptography. For the Science of Security community, it relates to human factors, resilience, and metrics.
Named Data Network Security 2021 (all)
Named Data Networking (NDN) is one of five research projects funded by the U.S. National Science Foundation under its Future Internet Architecture Program. Its goal is to make it easier to develop, manage, secure, and use networks and the Internet. For the Science of Security community, these efforts are relevant to the hard problems of resilience, human behavior, and scalability.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2020 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Science of Security 2020 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Security by Default 2021 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Policies Analysis 2021 (all)
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Security Risk Management 2021 (all)
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static Code Analysis 2020 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static Code Analysis 2021 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2020 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Steganography Detection 2021 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stochastic Computing Security 2020 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stochastic Computing Security 2021 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Supply Chain Risk Assessment 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Risk Assessment 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at methods to analyze risk to the security of the supply chain from multiple perspectives in order to develop accurate predictive metrics.
Supply Chain Security 2020 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Supply Chain Security 2021 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #68
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Acoustic Fingerprints 2022 (all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, anti-forensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
Ad Hoc Network Security 2022 (all)
Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Artificial Intelligence Security 2022 (all)
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. For the Science of Security community, AI research has implications for resilience, composability, metrics, and human behavior.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Physical Layer Security 2021 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Resilient Security Architectures 2021 (all)
The development of resilient security architectures is one of the five hard problems for the Science of Security.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Visible Light Communications Security 2022 (all)
Visible light communication (VLC) offers an unregulated and free light spectrum and potentially could be a solution for overcoming overcrowded radio spectrum, especially for wireless communication systems, and doing it securely. For the Science of Security community, this work is relevant to resiliency, scalability, and metrics.
Web Browser Security 2022 (all)
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
White Box Cryptography 2022 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Windows Operating System Security 2022 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Windows operating system.
Wireless Mesh Networks 2022 (all)
With more than 70 protocols vying for preeminence over wireless mesh networks, the security problem is magnified. The work cited here relates to the Science of Security hard problems of resiliency, metrics, and composability.
Work Factor Metrics 2022 (all)
It is difficult to measure the relative strengths and weaknesses of modern information systems when the safety, security, and reliability of those systems must be protected. Developers often apply security to systems without the ability to evaluate the impact of those mechanisms to the overall system. Few efforts are directed at actually measuring the quantifiable impact of information assurance technology on the potential adversary. For the Science of Security community, this work is relevant to resilience and scalability.
Explainable Artificial Intelligence (XAI) has become an area of interest in research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero Day Attacks and Defense 2022 (all)
Zero day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero day exploits related to predictive metrics, resiliency, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #69
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security by Default 2022 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Heuristics 2022 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect "Zero Day" or previously unknown computer viruses and new variants of viruses already "in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Risk Management 2022 (all)
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Scalability 2022 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Security Situational Awareness 2022 (all)
Situational awareness in security systems is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Signature Based Defense 2022 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Smart Grid Consumer Privacy 2022 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources--is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency and metrics. The work cited here addresses privacy concerns.
Smart Grid Security 2022 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Sensors represent are a both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Smart Grid Situational Awareness 2022 (all)
Situational awareness is an important human factor for cyber security in all applications, including smart grids that impacts resilience, predictive metrics, and composability.
Supply Chain Security 2022 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Support Vector Machines 2022 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #70
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
Air gaps--the physical separation of one computing system from another--is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Pattern locks are best known as the access codes using a series of lines connecting dots. Primarily familiar to Android users, research into pattern locks shows promise for many more uses. For the Science of Security community, they are important relative to the hard problems of human behavior, scalability, and resilience.
Peer to Peer Security 2022 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
Pervasive Computing Security 2022 (all)
Also called ubiquitous computing, pervasive computing is the concept that all man-made and some natural products will have embedded hardware and software technology and connectivity. This evolution has been proceeding exponentially as computing devices become progressively smaller and more powerful. For the Science of Security community, work in this area is related to resilience, scalability, human factors, and metrics.
Phishing remains a primary method for social engineering access to computers and information. Much research work has been done in this area in recent years. For the Science of Security community, phishing is relevant to the hard problem of human behavior.
Physical Layer Security 2022 (all)
Physical layer security presents the theoretical foundation for a new model for secure communications by exploiting the noise inherent to communications channels. Based on information-theoretic limits of secure communications at the physical layer, the concept has challenges and opportunities related to designing of physical layer security schemes. The works presented here address the information-theoretical underpinnings of physical layer security and present various approaches and outcomes for communications systems. For the Science of Security community, physical layer security relates to resilience, metrics, and composability.
The Public Key Infrastructure (PKI) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several PKI trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Power Grid Vulnerability Analysis 2022 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Robot Operating System Security 2022 (all)
The Robot Operating System (ROS) is a widely adopted standard robotic middleware that is devoid of native security features. With the increased use of robots and the risk to both the machine and the interacting human, consideration of this topic has become important. To the Science of Security community, it is relevant to the hard problems of resilience, policy-based governance, and human factors.
The proliferation of robots in the form of personal assistants, medical support devices, and other applications has heighted awareness of security issues with them. Of particular interest here is trust--the confidence the human has that the machine has not been compromised, nor the ones it has been linked to are compromised. For the Science of Security community, this relates to the hard problems of resilience and of human factors.
Memory corruption attacks account for many security breaches afflicting software systems. Return-oriented programming (ROP) techniques are often used to bypass the most common memory protection systems. For the Science of Security community, this research is related to resilience, scalability, composability and human factors.
Router Systems Security 2022 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2022 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2022 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Scientific Computing Security 2022 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to scalability and resilience.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure. For the Science of Security community, software assurance is relevant to the hard problems of resilience and scalability.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
SQL Injection Detection 2022 (all)
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static Code Analysis 2022 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2022 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stochastic Computing Security 2022 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #71
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The Internet of Battlefield Things (IoBT) is distinct from the general Internet of Things due to the nature of the hardened specific networks employed under battlefield conditions. For the Science of Security community, this work is relevant to scalability, resilience, and human factors.
The proliferation and increased capability of "smart phones" has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple's iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
The term Internet of Things (IoT) refers to advanced connectivity of the Internet with devices, systems and services that include both machine-to-machine communications (M2M) and a variety of protocols, domains and applications. Since the concept incorporates literally billions of devices, the security implications are huge. For the Science of Security community, this work is relevant to the hard problems of resilience, composability, human behavior, and metrics.
Internet Protocol Version 6 is slowly being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Successful key management is critical to the security of any cryptosystem. It is perhaps the most difficult part of cryptography including as it does system policy, user training, organizational and departmental interactions, and coordination between all of these elements and includes dealing with the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, key management is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Kerberos supports authentication in distributed systems. Used in intelligent systems, it is an encrypted data structure naming a user and a service the user may access. For the Science of Security community, it is relevant to the broad issues of cryptography and to resilience, human behavior, and metrics.
Lightweight Ciphers 2022 (all)
Lightweight cryptography is a major research direction. The release of SIMON in June 2013 generated significant interest and a number of studies evaluating and comparing it to other cipher algorithms. To the Science of Security community, lightweight ciphers can support resilience and scalability, especially in cyber physical systems constrained with power and "weight" budgets.
Linux Operating System Security 2022 (all)
Operating system security is a component of resiliency, composability, and an area of concern for predictive metrics. This research focused on the Linux operating system.
Random Key Generation 2022 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
"Ransomware" is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Recommender Systems 2022 (all)
Recommender systems are rating systems filters used to predict a user's preferences for a particular item. Frequently they are used to identify related objects of interest based on a user's preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Reinforced Learning with Human Feedback 2019-2022 (all)
Reinforced Learning with Human Feedback (RLHF) is a new research area. Machines scan large volumes of data over the internet, then "learn" by interacting with humans in a feedback loop that helps hone their skill. For the Science of Security community, this area is relevant to human factors, resilience, and scalability.
Relational Database Security 2022 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability human behavior, and metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Resilience is one of the five hard problems for the Science of Security.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. This work is related to the Science of Security issues of resiliency and human behaviors.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Scientific Computing Security 2022 (all)
Scientific computing is concerned with constructing mathematical models and quantitative analysis techniques and using computers to analyze and solve scientific problems. As a practical matter, scientific computing is the use of computer simulation and other forms of computation from numerical analysis and theoretical computer science to solve specific problems such as cybersecurity. For the Science of Security community, it relates to predictive metrics, compositionality, and resilience.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to scalability and resilience.
Agent-based modeling of human social behavior is an increasingly important research area. Efficient, scalable and robust social systems are difficult to engineer, both from the modeling perspective and the implementation perspective. The work cited here addresses these problems. It is relevant to the Science of Security community relative to human factors and scalability.
Software assurance is an essential element in the development of scalable and composable systems. For a complete system to be secure, each subassembly must be secure. For the Science of Security community, software assurance is relevant to the hard problems of resilience and scalability.
Spam detection is a general problem in cybersecurity. For the Science of Security community, it is relevant to the problems of scalability, human behavior, and metrics.
SQL Injection Detection 2022 (all)
SQL injection is used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution to dump the database contents to the attacker. One of the most common hacker techniques, SQL injection is used to exploit security vulnerabilities in an application's software. It is mostly used against websites but can be used to attack any type of SQL database. Because of its prevalence and ease of use from the hacker perspective, it is an important area for research and of interest to the Science of Security community relative to human behavior, metrics, resiliency, privacy and policy-based governance.
The Secure Socket Layer (SSL) is designed to ensure the security of electronic transactions and the exchange of sensitive information through cryptographic keys and certificates. Several SSL trust models are proposed in the literature to model trust relationship and trust propagation. The research cited here looks at several of those models, particularly in the area of ad hoc networks. For the Science of Security community, this work is relevant to the hard problems of resiliency, scalability, human behavior, and metrics.
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Static Code Analysis 2022 (all)
Static code analysis is a standard method of testing software prior to production and marketing. Much of the work done in the Science of Security to look at code suggests that these analyses need to address security issues. Methods and practices cited in the research referenced here relate to human behavior, composability, and resiliency.
Steganography Detection 2022 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Stochastic Computing Security 2022 (all)
Although stochastic computing was historically considered a failure, it may still remain relevant for solving certain problems, including machine learning and control, stochastic decoding, which applies stochastic computing to the decoding of error correcting codes, and image processing tasks such as edge detection and image thresholding. For the Science of Security community, it is of interest relative to resilience and scalability.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #72
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Belief networks are Bayesian models that that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modelling beliefs in complex physical networks or systems and are important to the Science of Security.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Big Data Security in the Cloud 2022 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2022 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Biometric Encryption 2022 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues. For the Science of Security community, this work is relevant to resilience, scalability, and metrics.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
Black box attacks occur against "security of a cryptographic algorithm studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Black Box Encryption 2022 (all)
Black box encryption is "security of a cryptographic algorithm is studied in the 'black-box' model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext." For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Blockchain Security 2022 (all)
The blockchain is the "public ledger" of all Bitcoin transactions. It is a so-called "trustless" proof mechanism of all the transactions on the network. Access to it is public. Since the blockchain is the record of all Bitcoin transactions, it has a special need for security. For the Science of Security community, research into this problem is related to resiliency and scalability.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware, and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Brute Force Attacks 2022 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2022 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #73
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2022 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Coding Theory and Security 2022 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Cognitive Radio Security 2022 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Command Injection Attacks 2022 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can "correct" secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Composability of security processes is one of the five hard problems for the Science of Security.
Compressive Sampling 2022 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence and Security 2022 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computer Theory and Security 2022 (all)
The works cited here combine research into computing theory with research into the Science of Security hard problems.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Concurrency and Security 2022 (all)
Concurrency, that is, support for simultaneous access, is relevant to the Science of Security hard problems of resiliency, composability, and predictive metrics and to cyber physical systems in general.
Controller Area Network Security 2022 (all)
Controller area networks connect the main electrical units in automobiles. They are relevant to the Science of Security because of their relationship to cyber-physical systems, resiliency, and the Internet of Things.
Control Theory and Privacy 2022 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber physical systems. The research work presented here specifically addresses issues in privacy.
Control Theory and Resilience 2022 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in resiliency. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
Control Theory and Security 2022 (all)
In the Science of Security, control theory offers methods and approaches to potentially solve hard problems in security. The research work presented here broadly addresses issues in security, touching on the Science of Security hard problems of resiliency, scalability, and human factors.
Conversational Agents 2022 (all)
Conversational agents are being developed to allow for fully automated interactions between humans and computers using voice, gestures, and other attributes. For the Science of Security community, this work is relevant to the hard problems in human behavior, scalability, and metrics.
Coupled Congestion Control and Security 2022 (all)
Congestion control algorithms are used to quickly restore normal operation of a network when congestion occurs. For the Science of Security community, this work is relevant to resilience and scalability.
Covert Channels and Security 2022 (all)
A covert channel is a simple, effective mechanism for sending and receiving data between machines without alerting any firewalls or intrusion detectors on the network. In cybersecurity science, they have value both as a means for defense and attack. For the Science of Security community, this work is relevant to the hard problems of resilience, scalability and compositionality.
Ciphertext Policy Attribute Based Encryption (CP-ABE) techniques provide fine grained access control to securely share organizational data where role-based access rights are in use. For the Science of Security community, CP-ABE is related to policy-based governance and scalability.
CPS Modeling and Simulation 2022 (all)
Modeling and simulation of Cyber-physical systems is a way to develop resiliency, composability, and predictive metrics in a laboratory environment and then test against their algorithms against real world situations. The challenge, of course, is to develop models and simulations that are accurate and reliable.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #74
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2022 (all)
Chaos-based cryptography systems are gaining interest as a way to provide robust protection, especially against statistical attacks. For the Science of Security community, this approach is related to the hard problems of scalability, resilience, metrics.
The "clean slate" approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
The research work cited here looks at the Science of Security hard problem of human factors and privacy in the context of cyber physical systems.
The research work cited here looks at the Science of Security hard problem of Resiliency in the context of cyber physical systems.
The research work cited here looks at the general Science of Security hard problem of security in the context of cyber physical systems.
Cross Layer Security 2022 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
Cybersecurity Damage Assessment 2022 (all)
The ability to assess damage accurately and quickly is critical to resilience.
Cybersecurity Education 2022 (all)
As a discipline in higher education, cybersecurity is less than two decades old. But because of the large number of qualified professionals needed, many universities offer cybersecurity education in a variety of delivery formats--live, online, and hybrid. To date, much of the curriculum has been driven by NSTISSI standards written in the early 1990s. The articles cited here look at aspects of curriculum, methods, evaluation, and support technologies. For the Science of Security community, these items are relevant to the areas of hard problems, privacy and cyber-physical systems.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDOS Attack Detection 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Mitigation 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Prevention 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
Deep Packet Inspection 2022 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #75
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
The Dark Web, or Darknet, is a subset of the deep web that is not indexed and requires something special to access it. Much of the activity on it is extra- or illegal, pornographic, or otherwise unseemly. For the Science of Security community, understanding of the activities on the Dark Web related to human behavior issues.
Data deletion has many implications for security and for data structures. For the Science of Security community, the problem has implications for privacy and scalability.
For security researchers, privacy protection during data mining is a major concern. Sharing information over the Internet or holding it in a database requires methods of sanitizing data so that personal information cannot be obtained. For the Science of Security community, this work is relevant to human behavior and privacy, resilience, and compositionality.
DDOS Attack Detection 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Detection is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Mitigation 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Mitigation is a key step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
DDOS Attack Prevention 2022 (all)
Distributed Denial of Service Attacks continue to be among the most prolific forms of attack against information systems. Prevention is the first step in dealing the problem. For the Science of Security community, this research is related to the problems of resilience, composability, metrics, and human behavior.
Mathematical decomposition is often used to address network flows. For the Science of Security community, decomposition is a useful method of dealing with cyber physical systems issues, metrics, and compositionality.
"DeepFakes" are realistic but phony facial images produced by generative adversarial networks (GANs) with manipulated audio and/or video clips. There are many ways to use counterfeit contents for nefarious or unlawful purposes. For the Science of Security community, deepfakes are important to the hard problems of metrics, scalability, resilience, and human factors.
Deep Packet Inspection 2022 (all)
Deep Packet Inspection offers providers a new range of use cases, some with the potential to eavesdrop on non-public communication. Current research is almost exclusively concerned with raising the capability on a technological level, but critics question it with regard to privacy, net neutrality, and other implications. These latter issues are not being raised within research communities as much as by politically interested groups. For the Science of Security community, it is relevant to scalability and resilience.
The use of video for surveillance has created a need to be able to process very large volumes of data in very precise ways. Research into these methods is relevant to the Science of Security hard problems of scalability, resilience, and metrics.
Finding ways both technical and behavioral to provide disincentives to threats is a promising area of research. Since most cybersecurity is "bolt on" rather than embedded, and since detection, response, and forensics are expensive, time-consuming processes, discouraging attacks can be a cost-effective cybersecurity approach. The topic is relevant to the Science of Security hard problems of human behavior, scalability, and resilience.
Differential Privacy 2022 (all)
The theory of differential privacy is an active research area, and there are now differentially private algorithms for a wide range of problems. This research looks at big data and cyber physical systems, as well as theoretic approaches. For the Science of Security community, differential privacy relates to composability and scalability, resiliency, and human behavior.
A digital signature is one of the most common ways to authenticate. Using a mathematical scheme, the signature assures the reader that the message was created and sent by a known sender. But not all signature schemes are secure. The research challenge is to find new and better ways to protect, transfer, and utilize digital signatures. For the Science of Security community, this work is relevant to scalability and resilience.
DNA-based cryptography is a developing interdisciplinary area combining cryptography, mathematical modeling, biochemistry and molecular biology as the basis for encryption. For the Science of Security committee, it is relevant to the hard problems of human behavior, resilience, predictive metrics, and privacy.
Dynamical Systems Security 2021 (all)
Research into dynamical systems cited here focuses on non-linear and chaotic dynamical systems and in proving abstractions of dynamical systems through numerical simulations. Many of the applications studied are cyber-physical systems and are relevant to the Science of Security hard problems of resiliency, predictive metrics and composability.
Dynamic Networks and Security 2022 (all)
Since the Bell System introduced "dynamic routing" several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
Edge Detection and Security 2022 (all)
Edge detection is an important issue in image and signal processing. For the Science of Security community, the subject is relevant to issues in composability, scalability, predictive metrics, and resiliency.
Efficient Encryption 2022 (all)
The term "efficient encryption" generally refers to the speed of an algorithm, that is, the time needed to complete the calculations to encrypt or decrypt a coded text. The research cited here shows a broader concept and looks both at hardware and software, as well as power consumption. The research relates to cyber physical systems, resilience and composability.
Elliptic Curve Cryptography 2022 (all)
Elliptic curve cryptography is a major research area globally. It is relevant to solving the hard problems of interest to the Science of Security community of scalability, resilience, and metrics.
Embedded Systems Security aims for a comprehensive view of security across hardware, platform software (including operating systems and hypervisors), software development processes, data protection protocols (both networking and storage), and cryptography. Critics say embedded device manufacturers often lack maturity when it comes to designing secure embedded systems. They say vendors in the embedded device and critical infrastructure market are starting to conduct classic threat modeling and risk analysis on their equipment, but they've not matured to the point of developing formal secure development standards. Research is beginning to bridge the gap between promise and performance, as the articles cited here suggest. For the Science of Security, this research addresses resilience, composability, and metrics.
Encryption audits not only test the validity and effectiveness of protection schemes, they also potentially provide data for developing and improving metrics about data security. For the Science of Security community, this work is relevant to helping solve the hard problems of predictive metrics, compositionality and resilience.
The expansion of a network to more nodes creates security problems. For the Science of Security community, expandability relates to resilience and compositionality.
Expert Systems and Privacy 2022 (all)
Expert systems have potential for efficiency, scalability, and economy in systems security. The research work cited here looks at the problem of privacy. For the Science of Security community, the work is relevant to scalability and human factors.
Expert Systems and Security 2022 (all)
An expert system is an artificial intelligence (AI) application that uses a knowledge base of human expertise for problem solving. Its success is based on the quality of the data and rules obtained from the human expert. Some perform above and some below the level of humans. For the Science of Security, expert systems are relevant to the hard problems of scalability, human behavior, and resilience.
Exponentiation, the mathematical operations that underlie encryption and coding, is important to the Science of Security because complexity adds delay. In creating resilient architectures, for example, slow processing may make a security feature too heavy to include. It is relevant to the hard problems of scalability and resiliency.
Facial recognition tools have long been the stuff of action-adventure films. In the real world, they present opportunities and complex problems being examined by researchers. For the Science of Security community, their work relates to the hard problems of human behavior, metrics, and resilience.
False Data Detection 2022 (all)
False data injection attacks against electric power grids potentially have major consequences. For the Science of Security community, the detection of false data injection is relevant to resiliency, composability, cyber physical systems, and human behavior.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Fog Computing and Security 2022 (all)
Fog computing is a concept that extends the Cloud concept to the end user. As with most new technologies, a survey of the scope and types of security problems is necessary. Much of this research relates to the Internet of Things. For the Science of Security community, it is relevant to the hard problems of resilience and scalability.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #76
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
If malware creates a trust situation which is not real, that is, false, a series of security issues are created. For the Science of Security community, this situation is relevant to policy-based governance, scalability, and resilience.
Forward Error Correction 2022 (all)
Forward Error Correction, also known as Channel coding, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Fuzzy cryptology uses fuzzy set theory to be used as a tool in securing cryptosystems. For the Science of Security community, this topic is relevant to the hard problems of scalability, resilience, and metrics.
Fuzzy Logic and Security 2022 (all)
Fuzzy logic is being used to develop a number of security solutions for data security. The articles cited here include research into fuzzy logic-based security for software defined networks, industrial controls, intrusion response and recovery, wireless sensor networks, and more. They are relevant to cyber physical systems, resiliency, and metrics.
Game Theoretic Security 2022 (all)
Game theory has historically been the province of social sciences such as economics, political science, and psychology. Game theory has developed into an umbrella term for the logical side of science that includes both human and non-human actors like computers. It has been used extensively in wireless networks research to develop understanding of stable operation points for networks made of autonomous/selfish nodes. The nodes are considered as the players. Utility functions are often chosen to correspond to achieved connection rate or similar technical metrics. In security, the computer game framework is used to anticipate and analyze intruder and administrator concurrent interactions within the network. For the Science of Security community, it is relevant to human factors, predictive metrics, and scalability.
Generative Adversarial Learning 2022 (all)
AI and Machine Learning are being used to develop a wide range of applications including visual, audio, and text. The use of these methods has large security implications. Research into the security aspects is relevant to the Science of Security hard problems of resilience, predictive metrics, and scalability.
Hashing algorithms are used extensively in information security and forensics. Research focuses on new methods and techniques to optimize security. For the Science of Security community, this work is relevant to compositionality and resilience.
Homomorphic Encryption 2022 (all)
Homomorphic encryption shows promise but continues to demand a heavy processing load in practice. Research into homomorphism is focused on creating greater efficiencies, as well as elaborating on the underlying theory. For the Science of Security community, this work is relevant to resiliency, scalability, human factors, and metrics.
ICS Anomaly Detection 2022 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Identity Management 2022 (all)
The term identity management refers to the management of individual identities, their roles, authentication, authorizations and privileges within or across systems. For the Science of Security community, this research is relevant to scalability, resilience, and human behavior.
Intrusion detection systems defend communications, computer and other information systems against malicious attacks by identifying attacks and attackers. The topic relates to the Science of Security issues of resilience and composability.
Immersion systems, commonly known as "virtual reality", are used for a variety of functions such as gaming, rehabilitation, and training. These systems mix the virtual with the actual, and have implications for cybersecurity because attackers may make the jump from virtual to actual systems. For the Science of Security community, this work is relevant to resilience, human factors, cyber physical systems, privacy, and composability.
Industrial Control Systems 2022 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Information Assurance 2022 (all)
The term "information Assurance" was adopted in the late 1990's to cover what is often now referred to generically as "cybersecurity." Many still use the phrase, particularly in the U.S. government, both for teaching and research. Since it is a rather generic phrase, there is a wide area of coverage under this topic. As such, it touches all of the hard problems in the Science of Security.
Information Centric Networks 2022 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
I-O Systems Security 2022 (all)
Management of I/O devices is a critical part of the operating system. Entire I/O subsystems are devoted to its operation. These subsystems contend both with the movement towards standard interfaces for a wide range of devices to makes it easier to add newly developed devices to existing systems, and the development of entirely new types of devices for which existing standard interfaces can be difficult to apply. Typically, when accessing files, a security check is performed when the file is created or opened. The security check is typically not done again unless the file is closed and reopened. If an opened file is passed to an untrusted caller, the security system can, but is not required to prevent the caller from accessing the file. The research is relevant to the Science of Security problem of scalability.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
Pub Crawl #77
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Industrial Control Systems 2022 (all)
Industrial control systems are a vital part of the critical infrastructure. Anomaly detection in these systems is requirement to successfully build resilient and scalable systems. The work cited here addresses these two hard problems in the Science of Security.
Information Centric Networks 2022 (all)
The move from host-centric to information-centric network security has major implications for the Science of Security community relative to scalability and resilience.
Information Forensics 2022 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Information Reuse and Security 2022 (all)
The objective of information reuse is to maximize the value of information by creating simple, rich, and reusable knowledge representations and integrating it into systems and applications. With reuse comes inherent security risk. For the Science of Security community, this problem is relevant to compositionality and resiliency.
Information Theoretic Security 2022 (all)
A cryptosystem is said to be information-theoretically secure if its security derives purely from information theory and cannot be broken even when the adversary has unlimited computing power. For example, the one-time pad is an information-theoretically secure cryptosystem proven by Claude Shannon, inventor of information theory, to be secure. Information-theoretically secure cryptosystems are often used for the most sensitive communications such as diplomatic cables and high-level military communications, because of the great efforts enemy governments expend toward breaking them. Because of this importance, methods, theory and practice in information theory security also remains high. It is fundamentally related to the concept of Science of Security and all the hard problems.
Insider threats are a difficult problem. The research cited here looks at both intentional and accidental threats, including the effects of social engineering, and methods of identifying potential threats. For the Science of Security, insider threat relates to human behavior, as well as metrics, policy-based governance, and resilience.
Intellectual Property Security 2022 (all)
Intellectual Property protection continues to be a matter of major research interest. The topic is related to the Science of Security regarding resilience, policy-based governance, and composability.
Intelligent Data and Security 2022 (all)
The term "intelligent data" refers to data that directly feeds decision-making processes. It has real time critical importance and therefore needs a high degree of integrity. For the Science of Security community, it is important to the Hard Problems of resilience, scalability, and compositionality.
Internet of Vehicles Security 2022 (all)
The term "Internet of Vehicles" refers to a system of the Internet of Things related to automobiles and other vehicles. It may include Vehicular Ad-hoc Networks (VANETs). For the Science of Security community, it is important relative to cyber physical systems, resilience, human factors and metrics.
Internet-scale Computing Security 2022 (all)
Addressing security at Internet scale relates to all of the Hard Problems of the Science of Security.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the "learned" or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Malware analysis, along with detection and classification, is a major issue cybersecurity. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Malware Analysis and Graph Theory 2022 (all)
Malware analysis is generally signature based. Graph theory has the potential to provide more rigor in analyzing malware as a tool for mining large data sets. For the Science of Security community, malware classification is related to privacy, predictive metrics, human behavior and resiliency.
Science of Security 2021 (all)
Many more articles and research studies are appearing with "Science of Security" as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.
