Pub Crawl #14
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the hard problems of human behavior, resiliency, metrics and composability.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Advanced Persistent Threats 2017 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security for addressing human behavior, scalability, resilience and metrics.
Air gaps—the physical separation of one computing system from another—is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Analogical Transfer 2017 (all)
Analogical transfer is a theory in psychology concerned with overcoming fixed ways of viewing particular problems or objects. In security, this problem is manifested in one example by system developers and administrators overlooking critical security requirements due to lack of tools and techniques that allow them to tailor security knowledge to their particular context. The works cited here use analogy and simulations to achieve break-through thinking. The topic relates to the hard problem of human factors in the Science of Security.
Attribute-based Encryption 2017 (all)
In an attribution-based encryption system, the decryption of a ciphertext should be possible only if the set of attributes of the user key matches the attributes of the ciphertext. The two types of attribute-based encryption schemes are key-policy attribute-based encryption and ciphertext-policy attribute-based encryption. For the Science of Security community, this research is relevant to the hard problems of scalability, human behavior, and policy-based governance.
Black Box Encryption 2017 (all)
Black box encryption is “security of a cryptographic algorithm is studied in the ‘black-box’ model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext.” For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Coding Theory and Security 2017 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Command Injection Attacks 2017 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Composability is one of the five hard problems for the Science of Security.
Compositionality is one of the five hard problems in the Science of Security.
Physical systems, particularly critical infrastructure, are increasingly dependent upon cyber systems. Risks to those cyber systems create potential adverse consequences for the physical systems. Research exploring these problems is growing and is of interest to the Science of Security community relative to the hard problems of compositionality and scalability, human factors, resiliency, and metrics.
Dynamic Networks and Security 2017 (all)
Since the Bell System introduced “dynamic routing” several decades ago using the SS-7 signaling system, dynamic networks have been an important tool for network management and intelligence. For the Science of Security community, dynamic methods are useful toward the hard problems of resiliency, metrics, and composability.
Information Forensics 2017 (all)
Forensics is an important tool for tracking and evaluating past attacks and using the information gained to resolve hard problems in the Science of Security related to resilience, metrics, human behavior, and scalability.
Internet-scale Computing Security 2017 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
The proliferation and increased capability of “smart phones” has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to Apple’s iOS operating system. For the Science of Security community, this work is relevant to the hard problems of compositionality, human factors, resiliency, and metrics.
Internet Protocol Version 6 is gradually being adopted as the replacement for version 4. Touted as a more secure protocol with increased address space, portability, and greater privacy, research into this and other related protocols has increased, particularly in the context of smart grid, mobile communications, and cloud computing. For the Science of Security community, it is relevant to resiliency, composability, metrics, and policy-based governance.
Keystrokes are a basis for behavioral biometrics. The rhythms and patterns of the individual user can become the basis for a unique biological identification. Research into this area of computer security is growing. For the Science of Security, keystroke analysis is relevant to the hard problems of human behavior factors and predictive metrics.
Machine learning offers potential efficiencies and is an important tool in data mining. However, the “learned” or derived data must maintain integrity. Machine learning can also be used to identify threats and attacks. Research in this field relates to the Science of Security hard problems of resilient architectures, composability, and privacy.
Peer to Peer Security 2017 (all)
Peer-to-peer systems pose considerable challenges for computer security. Like other forms of software, P2P applications can contain vulnerabilities, but what makes security particularly dangerous for P2P software is that peer-to-peer applications act as servers as well as clients, making them more vulnerable to remote exploits. For the Science of Security community, this work is relevant to the hard problems of scalability, resilience, metrics, and human factors.
“Ransomware” is the name given to malicious software that locks a computer until an extorted fee or ransom is paid for the key to unlock it. This ransom is usually paid in bitcoin. For the Science of Security community, there are implications for resiliency, composability, and metrics.
Secure File Sharing 2017 (all)
Data leakage while file sharing continues to be a major problem for cybersecurity, especially with the advent of cloud storage. Secure file sharing is relevant to the Science of Security community hard topics of resilience, composability, metrics, and human behavior.
Self-healing Networks 2017 (all)
Self-healing networks are an important goal for cyber physical systems. The Science of Security community hard problems of resiliency and composability are essential elements.
Stylometry is a method of tracking user behavior across platforms and using techniques such as writing style and keystrokes. If holds some promise as a tool for insider threat detection. For the Science of Security community, it is relevant to human behavior issues and predictive metrics.
White Box Encryption 2017 (all)
Open devices such as PCs, tablets or smartphones are extremely vulnerable to attacks, since the attacker has complete control over the execution platform and the software implementation itself in the form of a white box attack. The goal of white-box encryption is to create a successful cryptographic algorithm so that assets remain secure even while under white-box attacks. For the Science of Security community, the subject is relevant to composability, resilience, and metrics.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.