Anonymity is a basic right and a core aspect of Internet. Recently, there has been tremendous interest in anonymity and privacy in social networks, motivated by the natural desire to share one’s opinions without the fear of judgment or personal reprisal (by parents, authorities, and the public). We propose to study the fundamental questions associated with building such a semi-distributed, anonymous messaging platform, which aims to keep anonymous the identity of the source who initially posted a message as well as the identity of the relays who approved and propagated the message.

• Community Development - The goal is to build an extended and vibrant interdisciplinary community of science of security researchers, research methodologists, and practitioners (Carver, Williams).
• Community Resources - To create and maintain a repository of defensible scientific methods for security research (Carver, Williams).
• Oversight for the Application of Defensible Scientific Research Methodologies - To encourage the application of scientifically defensible research through various methods of consultation and feedback (Carver).
• Usable Data Sharing - To enable open, efficient, and secure sharing of data and experimental results for experimentation among SoS researchers (Al-Shaer).

• Contributions to Developing a Science of Security - We will design and implement an evaluation process for assessing the effectiveness and impact of the Lablet's research and community development activities (McGowen, Stallings, & Wright).
• Contributions to Security Science Research Methodology - We will examine both the impact of Lablet work on the maturity of the SoS field and the methodological rigor of the Lablet research projects themselves (McGowen, Carver).
• Development of a Community of Practice for the Science of Security - We will develop methods to assess whether Lablet activities are contributing to the development of a sustainable community of practice for the SoS field (McGowen, Stallings, Carver, & Wright).

The patterns and characteristics of security incidents are a significant driver of security technology innovation. Patterns are detected by analyzing repositories of malware/viruses/worms, incidents affecting control/SCADA systems, general security alerts and updates, and data breaches. For most types of privacy incidents there are no repositories. Privacy incidents that do not involve a security breach, such as cyber-bullying/slander/stalking, revenge porn, social media oversharing, data reidentification and surveillance, are not represented in the current repositories.  Our project is building the first comprehensive encyclopedia and database of privacy incidents. This publicly-accessible repository will enable tracking of incident rates and characteristics such as involved entities and incident root causes. The repository will provide a resource for privacy researchers to investigate the patterns of a broad range of privacy incidents, and the incident patterns surfaced by the database will help inform privacy technology development globally.

Security-Metrics-Driven-Evaluation, Design, Development and Deployment. Our research evaluates security pattern selection and application by designers in response to attack patterns. The evaluation is based on formal models of attack scenarios that are used to measure security risk and promote risk reduction strategies based on assurance cases constructed by the analyst. The aim is to improve the usability of formal methods for studying security design and composition.

Understanding and Accounting for Human Behavior. Our research is based on theory in psychology concerning how designers comprehend and interpret their environment, how they plan and project solutions into the future, with the aim of better understanding how these activities exist in designing more secure systems. These are not typical models of attackers and defenders, but models of developer behavior, including our ability to influence that behavior with interventions.

In highly configurable software systems the configuration space is too big for (re-)certifying every configuration in isolation. In this project, we combine software analysis with network analysis to detect which configuration options interact and which have local effects. Instead of analyzing a system as Linux and SELinux for every combination of configuration settings one by one (>10^2000 even considering compile-time configurations only), we analyze the effect of each configuration option once for the entire configuration space.

CPS employ Networked Control Systems (NCS) to facilitate real-time monitoring and control. Security of the NCS infrastructure is a large problem due to (1) the wide deployment of commercial-off-the-shelf (COTS) computing devices, (2) the connectivity of NCS with the Internet, and (3) the existence of organized motivated attackers. Traditional IT security solutions are used in NCS, they cannot prevent all cyber attacks. Our goal is to complement IT security with resilient algorithms for monitoring and control in order to reduce NCS security risks. Our framework aims at developing algorithms that ensure that the system will be able to continue operation possibly with degraded performace even in the presence of successful attacks.

With the increased use of cyber physical systems in current defense, medical, and energy applications, it is critical for the infrastructure to remain secure. As such, it is important to identify potential security flaws early in the design process in order to produce a consistent, secure and reliable system with minimal fabrication costs. This task can be accomplished using threat modeling. Threat modeling can be separated into two diverse fragments, asset centric and attack centric threat modeling. Asset centric threat modeling takes the point of view of the defender in order to focus on all of ways that a system can be protected from an attack. Attack centric threat modeling on the other hand focuses on the point of view of the attacker, coming up with all of the possible combinations of actions that can result in the compromise of the system. With the interaction of these two perspectives of threat modeling, the system can be tested against possible attack sequences before fabrication, ensuring a high expectation of system security and reliability after development.

This project focuses on developing an attack centric threat modeling tool using the Generic Modeling Environment (GME). The modeling environment is first developed in a consistent manner to a STRIPS planning problem, and then transformed into a single state machine model using the GReAT tool, allowing for the user modeling interface to be integrated with an external planning library. After integrating the model with the Fast Downward Planning library using the GME DSML C# interpreter api, an action plan can be returned, allowing the modeler to identify the possible methods of compromising the system. Furthermore, this attack centric threat modeling tool will be integrated with an asset centric threat modeling tool currently under development, allowing for a full scale threat modeling testbed.