Browse All

Researchers developed a predictive model to identify which people are most vulnerable to online scams by analyzing personality traits and other characteristics. The study, published in November 2026, used cross-validation (a technique where a model is tested on different sets of data to ensure it works reliably) to build a model that can help predict susceptibility to scams before they happen. This research could help protect people by identifying who might need extra education or awareness about scam tactics.

This research paper introduces HFAMA (Heuristics Framework for Authenticating Mobile Applications), a method designed to improve security in mobile apps by using pattern-based rules to verify that applications are legitimate and trustworthy. The framework aims to create a more resilient cybersecurity environment by helping protect mobile devices from fraudulent or malicious applications.

This academic paper presents a new model for IT audit risk assessment that combines bow-tie analysis (a visual diagram showing how failures can happen and their consequences) with fuzzy Bayesian networks (a statistical method that handles uncertain or imprecise information to calculate probabilities). The model aims to help organizations better identify and evaluate security risks during IT audits by combining these two analytical approaches.

This academic paper discusses extending ATT&CK (a framework that catalogs adversary tactics and techniques used in real attacks) coverage within logical attack graphs (visual models showing how attackers could chain multiple steps together to compromise a system). The research, published in November 2026, appears to focus on improving how security professionals can map and understand attack paths using this framework.

This academic paper describes a method for protecting closed-source drivers (software that controls hardware devices) by using a multidimensional domain switch (a technique that isolates code execution across different security contexts). The research was published in November 2026 in the journal Computers & Security and proposes a protective approach for drivers that manufacturers keep proprietary.

SAFARI is a framework designed to investigate ransomware (malicious software that encrypts files and demands payment) in an air-gapped environment (a computer system isolated from networks for security). The framework automates the process of analyzing how ransomware behaves and spreads, making it easier to study these threats safely without risking network infection.

Researchers discovered that STUN (Session Traversal Utilities for NAT, a protocol that helps devices communicate through network firewalls) can be misused as a covert channel by hiding secret data in optional message attributes that receivers can ignore. The study describes how this attack works, shows a working proof-of-concept implementation, and presents methods to detect when STUN is being used this way.

This academic paper proposes a new security strategy that hides network structure (the way computers are connected) and adds intentional delays to defend against side-channel attacks (methods where attackers gain information by observing patterns like timing or power usage rather than directly breaking encryption). The approach combines network obfuscation (hiding network details) with delay characteristics to make it harder for attackers to extract sensitive information through indirect observations.

ROPSpy is a tool designed to reduce false positives (incorrect security warnings) in static ROP attack detection (analyzing code without running it to find return-oriented programming attacks, where attackers chain existing code fragments to bypass security). The paper presents this as a cost-effective solution to a problem in security analysis where too many false alarms make it hard for developers to identify real threats.

This academic paper presents a design science approach for building security operations centers (SOCs, centralized facilities that monitor and respond to security threats) that are appropriately sized and modular for government agencies. The research, published in November 2026, focuses on making SOCs more flexible and scalable rather than one-size-fits-all, allowing agencies to adjust their security monitoring capabilities based on their specific needs.

This research study examines how people's cultural backgrounds affect whether they fall for phishing attacks (deceptive emails or messages tricking users into revealing sensitive information) and how well they can spot them. The study was conducted across multiple countries to understand if culture influences both phishing victimization rates and people's ability to recognize phishing attempts.

CleanStack is a new dual-stack defense system designed to protect against stack-based memory corruption attacks (exploits that manipulate a program's call stack to gain unauthorized control). Published in November 2026, this research presents an architectural approach to mitigate vulnerabilities where attackers overwrite data on the stack to crash programs or execute malicious code.

RSAFL is a new method for testing communication protocols (sets of rules that allow different systems to talk to each other) by using runtime state data (information about what the protocol is doing at any moment) to guide fuzzing (a testing technique where you send random or malformed data to find bugs). This approach helps security researchers discover vulnerabilities in protocol implementations more efficiently than traditional fuzzing methods.

This academic paper from November 2026 examines attacks on game resource localization, which is the process of adapting games for different languages and regions. The research appears to focus on statistical modeling of the effort required to execute such attacks, though the provided content does not include specific details about the attack methods or findings.

This research paper discusses M-LITO, a security method that protects location information in maritime edge networks (computing systems deployed on ships or near coastal areas) from side-channel attacks. The study focuses on two types of attacks: offloading-based inference (where attackers deduce location by monitoring which tasks a device sends to remote servers) and RSSI-based inference (where attackers use signal strength measurements to estimate a device's position). M-LITO aims to make a device's location appear different from its actual position, making these inference attacks ineffective.

This academic paper discusses intelligent asset parameterisation for risk-based moving target defence, a security technique that changes system configurations unpredictably to make it harder for attackers to find and exploit vulnerabilities. The research focuses on using AI to intelligently decide which system parameters to modify and when, based on risk assessment. The paper was published in Computers & Security journal in November 2026.

Researchers introduced HMM-MET, a method that uses hidden Markov models (a statistical technique for analyzing sequences of hidden states) to detect covert channels (hidden communication methods that exploit unintended system features) by tracking electromagnetic (EM) emissions at the interval level. The work focuses on improving detection of these stealthy communication paths through more granular monitoring of EM signals from computer hardware.

Researchers have developed a method to detect microburst attacks (sudden floods of data packets sent to overwhelm network equipment) in real time using sketch-based queue monitoring (a memory-efficient technique that tracks network traffic patterns) on programmable switches (network devices that can be reconfigured to run custom software). This approach allows networks to identify and respond to these attacks as they happen rather than after the damage occurs.

This academic paper describes a method for improving security in ICS (Industrial Control Systems, which manage critical infrastructure like power plants and factories) by using fuzzing (automatically sending random or malformed inputs to find bugs). The approach uses automated protocol inference (figuring out communication rules without documentation) and response-driven exploration (testing based on how systems react) to discover vulnerabilities in ICS equipment that might otherwise go undetected.