Pub Crawl #41
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Keeping the attack surface as small as possible is a basic security measure. That attack surface is the sum of the different points where an adversary or unauthorized user can attempt to access in order to try to enter data to or extract data. For the Science of Security community, attack surface is a key concept for scalability, resilience, and metrics.
Attack vectors are paths or means by which an adversary can gain access to a computer or network server to deliver malware. Attack vectors enable exploitation of system vulnerabilities, including the human element. For the Science for Security community, this problem is related to resiliency and scalability, as well as human behavior.
Attribution of the source of an attack or the author of malware is a continuing problem in computer forensics. For the Science of Security community, it is an important issue related to human behavior, metrics, and composability.
Augmented Reality (AR) offers a combination of physical and virtual objects. It differs from virtual reality by allowing users to sight the real world enhanced with virtual objects. In certain applications, security breaches could morph those enhancements into liabilities. For the Science of Security community, research into this subject is relevant to the hard problems of scalability, resilience, privacy, and human behavior.
Automated Response Actions 2019 (all)
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
A recurring problem in cybersecurity is the need to automate systems to reduce human effort and error and to be able to react rapidly and accurately to an intrusion or insertion. The articles cited here describe a number of interesting approaches related to the Science of Security hard topics, including resilience and composability.
Belief networks are Bayesian models that that represent sets of random variables and their conditional dependencies through a directed acyclic graph (DAG). These networks are used for modelling beliefs in complex physical networks or systems and are important to the Science of Security.
Privacy issues related to Big Data are a growing area of interest for researchers. The work presented here addresses methodologies to protect personal information using both technical and policy solutions. For the Science of Security community, this work is relevant to human factors, resilience, scalability, and metrics.
Big Data Security in the Cloud 2019 (all)
Big data security in the Cloud is a growing area of interest for cybersecurity researchers. The work presented here ranges from cyber-threat detection in critical infrastructures to privacy protection. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and metrics.
Big Data Security Metrics 2019 (all)
Measurement is a hard problem in the Science of Security. Applied to Big Data, the problems of measurement in security systems are compounded. Scalability and resilience are also impacted.
Biometric Encryption 2019 (all)
The use of biometric encryption to control access and authentication is well established. New concerns about privacy create new issues for biometric encryption, however. The increased use of Cloud architectures compounds the problem of providing continuous re-authentication. The research cited here examines these issues. For the Science of Security community, this work is relevant to resilience, scalability, and metrics.
Recent revelations that processors have had long-standing vulnerabilities have triggered a greater interest in relooking at firmware in general. Research into Basic Input Output Operations Systems (BIOS) has produced some work relevant to the Science of Security issues of human factors, resilience, metrics, and scalability.
Bitcoin is the allegedly secure electronic currency used for both open and nefarious purposes such as ransomware transactions. It does have security issues, however. For the Science of Security community, this research is relevant to human behavior and scalability.
Black Box Encryption 2019 (all)
Black box encryption is “security of a cryptographic algorithm is studied in the ‘black-box’ model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext.” For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Black box encryption is “security of a cryptographic algorithm is studied in the ‘black-box’ model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext.” This research looks at how to protect the black box itself separate from the encryption problem. For the Science of Security community, back box cryptography is important to composability, metrics, and resilience.
Bluetooth is a standard for short-range wireless interconnection of cellular phones, computers, and other electronic devices. In common use, it is important to the Science of Security because of its relevance to human behavior, resilient architectures, cyber physical systems, and composability.
Botnets, a common security threat, are used for a variety of attacks: spam, distributed denial of service (DDOS), ad and spyware, scareware and brute forcing services. Their reach and the challenge of detecting and neutralizing them is compounded in the cloud and on mobile networks. For the Science of Security community, research in this area is related to resiliency, compositionality, and metrics.
Browser Security 2019 Web browsers are vulnerable to a range of threats. To the Science of Security community, they are often the first vector for attacks and are relevant to the issues of compositionality, resilience, predictive metrics, and human behavior.
Brute Force Attacks 2018 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
Brute Force Attacks 2019 (all)
Brute force attacks are a method of comprehensively scanning log-in directories to find possibilities for compromising an authentication system. A common form of attack, research into the problem is relevant primarily to the Science of Security hard problems of human factors and policy-based governance.
CAPTCHA (the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart) technology has become a standard security tool. In the research presented here, some novel uses are presented, including use of Captchas as graphical passwords, motion-based captchas, and defeating a captcha using a gaming technique. For the Science of Security community, they are relevant to human behavior and composability.
Adversaries look for ways to combine multiple exploits into one large attack. To be effective, the attacker must think outside the box, know many different technologies, and chain together a number of attacks to achieve his goal. For the Science of Security community, such attacks relate to the hard problems of scalability and resilience.
Channel coding, also known as Forward Error Correction, are methods for controlling errors in data transmissions over noisy or unreliable communications channels. For cybersecurity, these methods can also be used to ensure data integrity, as some of the research cited below shows. The work cited here relates to the Science of Security problems of metrics, resiliency, and composability.
Chaotic Cryptography 2019 (all)
Adding chaos theory to cryptography allows the development of lighter, stronger and more efficient methods. For the Science of Security community, work in this area relates to resiliency, composability, and predictive metrics.
The “clean slate” approach looks at designing networks and internets from scratch, with security built in, in contrast to the evolved Internet in place. The research presented here covers a range of research topics, and includes items of interest to the Science of Security, including human behavior, resilience, metrics, and policy governance.
Composability of security processes is one of the five hard problems for the Science of Security.
Coding Theory and Security 2019 (all)
Coding theory examines the properties of codes and their aptness for a specific application. For the Science of Security, coding theory is relevant to compositionality, resilience, cryptography, and metrics.
Cognitive Radio Security 2019 (all)
Cognitive radio (CR) is a form of dynamic spectrum management--an intelligent radio that can be programmed and configured dynamically to use the best wireless channels near it. Its capability allows for great network resilience.
Command Injection Attacks 2019 (all)
Command or shell injection is one of the most critical vulnerabilities. To the Science of Security community, command injection attacks impact cyber physical systems and are related to composability, resiliency, and metrics.
Much of software security focuses on applications, but compiler security should also be an area of concern. Compilers can “correct” secure coding in the name of efficient processing. The works cited here look at various approaches and issues in compiler security. For the Science of Security community, this work relates to resilience, scalability and compositionality, and metrics.
Compressive Sampling 2019 (all)
Compressive sampling (or compressive sensing) is an important theory in signal processing. It allows efficient acquisition and reconstruction of a signal and may also be the basis for user identification. For the Science of Security, the topic has implications for resilience, cyber-physical systems, privacy, and composability.
Computational Intelligence 2019 (all)
Computational intelligence includes such constructs as artificial neural networks, evolutionary computation and fuzzy logic. It embraces biologically inspired algorithms such as swarm intelligence and artificial immune systems and includes broader fields such as image processing, data mining, and natural language processing. Its relevance to the Science of Security is related to composability and compositionality, as well as cryptography.
Computer Theory and Trust 2019 (all)
The work cited here combine research into computing theory with research into the Science of Security hard problem of composability and compositionality.
In photonics, confinement is important to loss avoidance. In quantum theory, it relates to energy levels. Containment is important in the contexts of cyber-physical systems, privacy, resiliency, and composability.
Control Theory and Privacy 2019 (all)
Control theory offers a way to address the Science of Security hard problems of scalability, resilience, and human behavior, particularly as they relate to cyber-physical systems. The research work presented here specifically addresses issues in privacy.
Cross Layer Security 2019 (all)
Protocol architectures traditionally followed strict layering principles to ensure interoperability, rapid deployment, and efficient implementation. But a lack of coordination between layers limits the performance of these architectures. More important, the lack of coordination may introduce security vulnerabilities and potential threat vectors. For the Science of Security community, this work is relevant to the problems of resiliency and composability.
Science of Security 2019 (all)
Many more articles and research studies are appearing with “Science of Security” as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.