Pub Crawl #16
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Internet-scale Computing Security 2017 (all)
Addressing security at Internet scale relates to all of the hard problems of the Science of Security.
Policy Based Governance 2017 (all)
Policy-based governance of security is one of the five hard problems for the Science of Security community.
Power Grid Vulnerability Analysis 2017 (all)
Cyber-Physical Systems such as the power grid are complex networks linked with cyber capabilities. The complexity and potential consequences of cyber-attacks on the grid make them an important area for scientific research. For the Science of Security community, this research is relevant to composability, resilience, and predictive metrics.
Privacy Models and Measurement 2017 (all)
Measurement is one of the five hard problems in the Science of Security. The research work cited here looks at the development of metrics in the area of privacy.
The technical implementation of privacy problems is fraught with challenges. For the Science of Security community, this research is relevant to the hard problems of scalability and to human behavior.
Protocol Verification 2017 (all)
Verifying the accuracy of security protocols is a primary goal of cybersecurity. Research into the area has sought to identify new and better algorithms and to identify better methods for verifying security protocols in myriad applications and environments. Verification has implications for compositionality and composability and for policy–based collaboration, as well as for privacy alone.
The term “provable security” refers to those security methods which can be confirmed mathematically through a formal process. For the Science of Security community, these methods are important to solving the problems of resiliency, predictive metrics, and compositionality.
Random Key Generation 2017 (all)
Random and pseudorandom numbers can be used for the generation, exchange, storage, use, and replacement of keys, key servers, cryptographic protocols, and user procedures. For researchers, random key generation is a challenge to create larger scale and faster systems to operate within the cloud and other complex environments, while ensuring validity and not adding weight to the process. For the Science of Security community, it is relevant to scalability, resilience, metrics, and human behavior.
Recommender Systems 2017 (all)
Recommender systems are rating systems filters used to predict a user’s preferences for a particular item. Frequently they are used to identify related objects of interest based on a user’s preference to market similar items. As such they create a problem for cybersecurity and privacy related to the hard problems of human factors, scalability, and resilience.
Relational Database Security 2017 (all)
A majority of enterprises store their most sensitive data in relational databases, including personally identifiable information (PII), financial records, and supply chain information. These databases are also the most frequently hacked. For the Science of Security community, relational database security is important for resilience, composability, human behavior, and metrics.
Magnetic remanence is the property that allows an attacker to recreate files that have been overwritten. For the Science of Security community, it is a topic relevant to the hard problems of resilience and compositionality and has major implications for the Internet of Things and other cyber physical systems.
Repudiation and non-repudiation are core topics in cybersecurity. For the Science of Security community, they relate to resilience, human behavior, metrics, and composability.
Resiliency is one of the hard problems for the Science of Security.
Radio frequency identification (RFID) has become a ubiquitous identification system used to provide positive identification for items as diverse as cheese and pets. Research into RFID technologies continues and the security of RFID tags is being increasingly questioned. The work is related to the Science of Security issues of resiliency and human behaviors.
Router Systems Security 2017 (all)
Routers are among the most ubiquitous electronic devices in use. Basic security from protocols and encryption can be readily achieved, but routing has many leaks. For the Science of Security community, they are related to the hard problems of resiliency and predictive metrics.
Coding standards encourage programmers to follow a set of uniform rules and guidelines determined by the requirements of the project and organization, rather than by the programmer's personal familiarity or preference. Developers and software designers apply these coding standards during software development to create secure systems. The development of secure coding standards is a work in progress by security researchers, language experts, and software developers. The articles cited here cover topics related to the Science of Security hard problems of resilience, metrics, human factors, and policy-based governance.
Sandboxing is an important tool for the Science of Security, particularly with regard to developing composable systems and policy-governed systems. To many researchers, it is a promising method for preventing and containing damage. Sandboxing, frequently used to test unverified programs that may contain malware, allows the software to run without harming the host device.
SCADA Systems Security 2017 (all)
SCADA system security issues have been identified as a problem for more than a decade. The work cited here addresses the issue relevant to the Science of Security hard problems of resiliency, compositionality, and human behavior.
Scalability is one of the hard problems in the Science of Security. Applied to larger data sets, increases in interoperability, and greater computing capacity, particularly in critical infrastructures and the Internet of Things, the development of effective automated scalable systems is compounded.
Scalable Verification 2017 (all)
Verification of software and its security features can be done statically or dynamically. A challenge is to conduct verifications at scale to determine whether all the features do what they are intended to do. For the Science of Security community, scalable verification relates to scalability and compositionality, resilience, and predictive metrics.
Science of Security 2017 (all)
Many more articles and research studies are appearing with “Science of Security” as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Software Defined Network (SDN) architectures have been developed to provide improved routing and networking performance for broadband networks by separating the control plain from the data plain. This separation also provides opportunities and challenges for SDN as a security element in IoT and cyberphysical systems. For the Science of Security community, it is relevant to resilience, and scalability.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security by Default 2017 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Heuristics 2017 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect “Zero Day” or previously unknown computer viruses and new variants of viruses already “in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Policy-based access controls and security policies are intertwined in most commercial systems. Analytics use abstraction and reduction to improve policy-based security. For the Science of Security community, policy-based governance is one of the five Hard Problems.
Steganography Detection 2017 (all)
Digital steganography detection is one of the primary areas or science of security research. For the Science of Security community, it is relevant to the hard problems are privacy, metrics and composability.
Supply Chain Security 2017 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. For the Science of Security community, supply chain security is relevant to resilient architectures, scalability, and human behavior issues.
Support Vector Machines 2017 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
Taint analysis is an important method for analyzing software to determine possible paths for exploitation. As such, it relates to the problems of composability and metrics.
Tamper resistance is an important element for composability of software systems and for security of cyber physical system resilience. For the Science of Security community, it is also relevant to scalability, metrics, and human factors.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.