Pub Crawl - January 2024
Selections by dgoff
Pub Crawl summarizes, by hard problems, sets of publications that have been peer-reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
Acoustic couplers such as modems bridge the gap between analog voice and electronic communications. At this interface, there is a security gap. For the Science of Security community, this work is relevant to security of cyber-physical systems and to the hard problems of resilience, human behavior, and scalability.
Acoustic Fingerprints 2023 
(all)
Acoustic fingerprints can be used to identify an audio sample or quickly locate similar items in an audio database. As a security tool, fingerprints offer a modality of biometric identification of a user. Current research is exploring various aspects and applications, including the use of these fingerprints for mobile device security, antiforensics, use of image processing techniques, and client side embedding. For the Science of Security community, they are relevant to the problems of resiliency, human behavior and composability.
Cyber physical system security requires the need to build secure sensors and actuators. The research work here addresses the Science of Security hard problems of human behavior, resiliency, metrics and composability for actuator security.
As the power of digital signal processors has increased, adaptive filters are now routinely used in many devices as varied as mobile phones, printers, cameras, power systems, GPS devices and medical monitoring equipment. An adaptive filter uses an optimization algorithm in a system with a linear filter to adjust parameters that have a transfer function controlled by variable parameter. Because of the complexity of the optimization algorithms, most of these adaptive filters are digital filters. They are required for some applications because some parameters of the desired processing operation are not known in advance or are changing. The works cited here are articles about adaptive filtering as it relates to the Science of Security hard problems of scalability, resilience, and metrics.
Ad Hoc Network Security 2023 
(all)
Security is an important research issue for ad hoc networks (MANETs). For the Science of Security community, this work relates to the hard problems of resilience, metrics, and compositionality.
Advanced Persistent Threat 2023 (all)
Advanced persistent threats are the subject of considerable research of interest to the Science of Security community. Research areas address the hard problems of human behavior, scalability, resilience, and metrics.
The need to understand adversarial behavior in light of new technologies is always important. Using models to understand their behavior is an important element in the Science of Security, particularly in the context of threats to privacy—data privacy, location, privacy, and other forms. It relates to the hard problems of human behavior, resiliency, and scalability.
Air gaps—the physical separation of one computing system from another—is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
Science of Security 2022 
(all)
The Science of Security is the general topic for defining a rigorous systematic approach to addressing cybersecurity issues, including technical, policy, and human issues. It touches on all five of the Hard Problems.
6LoWPAN, IPv6 over Low power Wireless Personal Area Networks, is an architecture intended to allow low power devices to participate in the Internet of Things. The IEEE specification allows for operation in either a secure or non-secure mode. For the Science of Security community, the creation of secure process in low power and ad hoc environments relates to the hard problems of resilience and composability. In the IoT context, it also relates to cyber physical system security.
Explainable Artificial Intelligence (XAI) has become an area of interest in research community. Many state-of-the-art models for machine learning lack transparency and interpretability, a major drawback in many applications where the rationale for the model's decision is a requirement for trust. For the Science of Security community, XAI is relevant to resilience and scalability.
Zero Day Attacks and Defense 2023 (all)
Zero-day attacks exploit previously unknown vulnerabilities in software that programmers have not yet patched or fixed. For the Science of Security community, zero-day exploits related to predictive metrics, resiliency, and composability.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer-reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
The Principal Investigators (PIs) of the Science of Security Lablets in collaboration with NSA Research, developed the 5 Hard Problems as a measure to establish the beginnings of a common language and gauge progress. These 5 were selected for their level of technical challenge, their potential operational significance, and their likelihood of benefiting from emphasis on scientific research methods and improved measurement capabilities. The five are not intended to be all inclusive of everything that needs to be done in cybersecurity but rather five specific areas that need scientific progress. The five problems are: Scalability and Composability; Policy-Governed Secure Collaboration; Security Metrics Driven Evaluation, Design, Development, and Deployment; Resilient Architectures; and Understanding and Accounting for Human Behavior.
Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.