Pub Crawl #69
Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view the corresponding list of publications. Submissions and suggestions are welcome.
John McCarthy, coined the term "Artificial Intelligence" in 1955 and defined it as "the science and engineering of making intelligent machines." (as quoted in Poole, Mackworth & Goebel, 1998) AI research is highly technical and specialized, and has been characterized as "deeply divided into subfields that often fail to communicate with each other." (McCorduck, Pamela (2004), Machines Who Think (2nd ed.) These divisions are attributed to both technical and social factors. The research cited here looks at the privacy implications of artificial intelligence. For the Science of Security community, AI is relevant to human factors, scalability, and resilience.
Air gaps—the physical separation of one computing system from another—is a classical defense mechanism based upon the assumption that data is safe if it cannot be touched electronically. However, air gaps may not be designed with adequate consideration for electronic emanations, thermal radiation, or other physical factors that might be exploited. For the Science of Security community, this research is relevant to the hard problems of composability, resilience, human behavior, and metrics.
Adversaries have an incentive to manipulate artificial intelligence (AI) and machine learning (ML) to their advantage. One way is through a poisoning attack in which the adversary feeds carefully crafted poisonous data points into the training set. For the Science of Security community, poisoning attacks are relevant to the hard problems of scalability, resilience, and human behavior.
The proliferation and increased capability of “smart phones” has also increased security issues for users. For the Science of Security community, these small computing platforms have the same hard problems to solve as main frames, data centers, or desktops. The research cited here looked at encryption issues specific to the Android operating system. For the Science of Security community, this research is relevant to scalability, human behavior, metrics, and resilience.
Science of Security 2021 (all)
Many more articles and research studies are appearing with “Science of Security” as a keyword. The articles cited here discuss the degree to which security is a science and various issues surrounding its development, ranging from basic approach to essential elements. The articles cited here address the fundamental concepts of the Science of Security.
The ability to conduct automated security audits rapidly and accurately helps to reduce the time between attack and its detection, hopefully reducing the consequences of the attack. Research into security audit methods and techniques supports addressing the hard problem of human behavior, as well as resiliency and scalability.
Security by Default 2022 (all)
One of the broad goals of the Science of Security project is to understand more fully the scientific underpinnings of cybersecurity. With this knowledge, the potential for developing systems that, if following these scientific principles, are presumed secure. In the meantime, security by default remains a topic of interest and some research. For the Science of Security community, this work relates directly to scalability and resilience.
Security Heuristics 2022 (all)
Heuristic analysis is a method employed by many computer antivirus programs designed to detect “Zero Day” or previously unknown computer viruses and new variants of viruses already “in the wild." It is an expert-based analytic method that uses various decision rules or weighing methods. For the Science of Security community, it is relevant to the hard problems of resilience, scalability, and predictability.
Measurement and metrics are one of the five hard problems in the Science of Security.
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Risk Management 2022 (all)
Managing security risk in cyberphysical systems is a complex process. The work cited here approaches the problem relative to the Science of Security hard problems of human factors, scalability, resilience, and metrics.
Security Scalability 2022 (all)
Scalability, along with compositionality, is one of the five hard problems for the Science of Security community.
Security Situational Awareness 2022 (all)
Situational awareness in security systems is an important human factor for cyber security that impacts resilience, predictive metrics, and composability.
Signature Based Defense 2022 (all)
Research into the use of malware signatures to inform defensive methods is a standard research exercise for the Science of Security community. This work addresses issues related to scalability and resilience.
Smart Grid Consumer Privacy 2022 (all)
Concerns about consumer privacy and electric power usage have impacted utilities fielding of smart meters. Securing power meter readings in a way that addresses while protecting consumer privacy is a concern of research designed to help alleviate those concerns. For the Science of Security community, privacy is a core topic.
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources--is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency and metrics. The work cited here addresses privacy concerns.
Smart Grid Security 2022 (all)
The primary value of published research in smart grid technologies--the use of cyber-physical systems to coordinate the generation, transmission, and use of electrical power and its sources-- is because of its strategic importance and the consequences of intrusion. Smart grid is of particular importance to the Science of Security and its problems embrace several of the hard problems, notably resiliency, scalability, and metrics.
Sensors represent are a both a point of vulnerability in the Smart Grid and a means of detection of intrusions. For the Science of Security community, research work into these industrial control systems is relevant to resiliency, compositionality, and human factors.
Smart Grid Situational Awareness 2022 (all)
Situational awareness is an important human factor for cyber security in all applications, including smart grids that impacts resilience, predictive metrics, and composability.
Supply Chain Security 2022 (all)
Threats to the supply chain in terms of delivery, integrity, content and the provenance of components and parts appear to be growing. The research cited here looks at the security in the supply chain from multiple perspectives, including resilient architectures.
Support Vector Machines 2022 (all)
The Support Vector Machine (SVM) algorithm has been used to analyze data for classification and to perform regression analysis. For the Science of Security community, SVM is related to machine learning and relevant to solving the hard problems of composability, resilience and predictive metrics.
Swarm Intelligence is a concept using the metaphor of insect colonies to describe decentralized, self-organized systems. The method is often used in artificial intelligence, and there are about a dozen variants ranging from ant colony optimization to stochastic diffusion. For cybersecurity, these systems have significant value both offensively and defensively. For the Science of Security, swarm intelligence relates to composability and compositionality.
A Sybil attack occurs when a node in a network claims multiple identities. The attacker may subvert the entire reputation system of the network by creating a large number of false identities and using them to gain influence. For the Science of Security community, these attacks are relevant to resilience, metrics, and composability.
System recovery following an attack is a core cybersecurity issue. Current research into methods to undo data manipulation and to recover lost or extruded data in distributed, cloud-based or other large scale complex systems is discovering new approaches and methods. For the Science of Security community, it is an essential element of resiliency.
Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests for removal via email of the links or modifications to specific citations. Please include the URL of the specific citation in your correspondence.
Pub Crawl contains bibliographical citations, abstracts if available, links on specific topics, and research problems of interest to the Science of Security community.
How recent are these publications?
These bibliographies include recent scholarly research on topics that have been presented or published within the stated year. Some represent updates from work presented in previous years; others are new topics.
How are topics selected?
The specific topics are selected from materials that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are also chosen for their usefulness for current researchers.
How can I submit or suggest a publication?
Researchers willing to share their work are welcome to submit a citation, abstract, and URL for consideration and posting, and to identify additional topics of interest to the community. Researchers are also encouraged to share this request with their colleagues and collaborators.
What are the hard problems?
Select a hard problem to retrieve related publications.
- - Scalability and Composability: Develop methods to enable the construction of secure systems with known security properties from components with known security properties, without a requirement to fully re-analyze the constituent components.
- - Policy-Governed Secure Collaboration: Develop methods to express and enforce normative requirements and policies for handling data with differing usage needs and among users in different authority domains.
- - Security Metrics Driven Evaluation, Design, Development, and Deployment: Develop security metrics and models capable of predicting whether or confirming that a given cyber system preserves a given set of security properties (deterministically or probabilistically), in a given context.
- - Resilient Architectures: Develop means to design and analyze system architectures that deliver required service in the face of compromised components.
- - Understanding and Accounting for Human Behavior: Develop models of human behavior (of both users and adversaries) that enable the design, modeling, and analysis of systems with specified security properties.