Research

This is a systematic literature review, which is a research method that carefully examines and summarizes all existing studies on a topic, that looks at frameworks for managing information security risk, which is the process of identifying and reducing potential harm to computer systems and data. The authors used mixed-methods, meaning they combined both numerical data analysis and detailed case studies, to understand how organizations can better protect their information by planning for security problems.

This academic paper describes a case study using threat modeling (identifying potential attacks on a system) combined with penetration testing (simulating attacks to find weaknesses) to improve the design and testing of industrial control systems, specifically focusing on a microgrid (a small-scale electrical grid that can operate independently). The research bridges the gap between how these critical infrastructure systems are designed and how they are tested for security vulnerabilities.

FABRICS is a framework that uses Bayesian methods (statistical techniques for updating beliefs based on new evidence) to help organizations calculate financial costs of cyber risks in a more systematic way. The framework appears designed to quantify how much money a company might lose from security incidents, though the abstract provided does not detail specific implementation steps or findings.

This research paper presents methods for detecting and identifying hardware Trojans (malicious circuits intentionally hidden in FPGA designs, which are reconfigurable computer chips) in network descriptions of chip layouts. The work focuses on making these detection methods explainable, meaning users can understand why the system flagged a particular area as suspicious rather than just getting a yes/no answer.

Researchers examined the security risks in Android Automotive OS by using firmware reverse engineering (a technique to analyze compiled software by converting it back into human-readable form) to study the software supply chain (all the components and vendors involved in building the final software). The study, published in August 2026, assessed vulnerabilities in how Android Automotive OS software is developed and distributed, particularly focusing on potential weaknesses introduced through third-party components and dependencies.

This academic paper examines how inadequate monitoring systems can create conditions where the fit between tasks and technology (how well a tool matches what users need to do) becomes exploited for illegal purposes like dark-web money laundering. The research suggests that when oversight mechanisms fail, organizations may unknowingly enable their systems to be used for criminal activities.

This is a survey paper that reviews existing datasets used to study software vulnerabilities (security weaknesses in code), examines the challenges researchers face when using these datasets, and discusses future research directions in the field. The paper was published in August 2026 in the journal Computers & Security and provides an overview of available resources for software security research rather than addressing a specific security issue.

This academic paper proposes STAC-IoT, a security framework designed to control who can access what in IoT-edge computing systems (networks of small internet-connected devices that process data locally rather than sending everything to a central server). The framework uses task-based access control, meaning it grants permissions based on specific jobs or functions rather than just user roles, to protect data and operations in these distributed systems.

This academic paper, published in September 2026, presents a collaborative audit scheme designed to verify that IoT (internet of things, or connected devices like sensors and smart home devices) data remains accurate and unaltered as it moves through fog computing (processing that happens on devices or local servers rather than in distant data centers). The scheme appears to address security concerns around data integrity in distributed computing environments where multiple parties need to verify information together.

This academic paper from September 2026 examines how valuable leaked data from online social networks can be to attackers and malicious actors. The research, published in Computers & Security, analyzes the characteristics and potential uses of personal information that gets exposed when social media platforms experience breaches or data leaks.

This academic paper describes a system that combines fog computing (processing data closer to where it's generated rather than in distant cloud servers) with data integrity auditing (checking that stored files haven't been corrupted or tampered with) and deduplication (removing duplicate copies of the same data to save storage space) for cloud storage. The research proposes a scheme that performs these three functions together to improve security and efficiency when storing data in the cloud.

This is an academic survey article that catalogs 120 domain-specific languages (DSLs, which are specialized programming languages designed for particular problem areas) related to security. The article appears to be a comprehensive review published in a major computer science journal, covering the landscape of security-focused languages rather than describing a specific vulnerability or problem.

This research paper presents a method for detecting living-off-the-land reverse shells (attacks where hackers use built-in system tools already present on a computer to create a backdoor connection back to their own machine) at a large scale by using data synthesis (artificially creating training examples rather than collecting real attack data). The approach aims to improve security detection systems' ability to identify these sneaky attacks that are hard to catch because they blend in with normal system activity.

This research presents OptFuzz, a tool for finding bugs in JavaScript JIT compilers (just-in-time compilers, which convert JavaScript code into machine code for faster execution) by testing different optimization paths rather than just code coverage. OptFuzz guides its testing by tracking which optimizations are triggered in the compiler's intermediate representation (IR, an internal code format), allowing it to discover bugs that occur when the compiler makes incorrect assumptions about the input code.

This research proposes a new framework for secure data sharing in the Internet of Vehicles (IoV, a network of connected vehicles that communicate with each other) that can resist quantum computing attacks while maintaining auditability (the ability to verify and track who accessed data). The framework uses a quantum-resistant puncturable signature algorithm (QRPPRFS, a method for digitally signing data that remains secure even against quantum computers) combined with blockchain (a distributed ledger technology) and commitment proofs (cryptographic mechanisms that bind parties to their statements) to ensure privacy and transparency.

This research proposes EGuardSQL, a system that allows fine-grained access control at the individual data-element level for encrypted SQL databases using CP-ABE (ciphertext-policy attribute-based encryption, a method where access rules are embedded in encrypted data). The system improves efficiency by using an optimized reusable sub-policy mechanism that reduces the computational work needed for encrypting and decrypting data while maintaining security protections against collusion attacks (where multiple unauthorized users combine their access to break security).

This paper presents GASE (Generative Adaptable Segmentation Evolution), a framework that uses generative adversarial networks (GANs, a type of AI that learns by having two neural networks compete with each other) to automatically segment, or identify and outline, structures in medical images like MRI scans. GASE addresses two major problems: the lack of labeled training data and the difficulty in understanding why AI models make their predictions, which is critical for doctors using these tools. The system learns to adapt to different scanning methods and patient types while also explaining its confidence in its predictions, making it more trustworthy for use in hospitals.

This paper presents OABE-VPUDA, a new encryption scheme designed to protect sensitive data in Digital Twins (DTs, virtual digital replicas of physical systems) while allowing flexible access control. The scheme uses CP-ABE (ciphertext-policy attribute-based encryption, a method that encrypts data based on specific attributes or characteristics) combined with blockchain technology to enable secure data sharing, allow owners to update access policies, and manage user permissions that expire over time, while reducing the computational burden on data owners.

Malicious actors can now manipulate recorded speech using AI tools through techniques like copy-move forgery and splicing (inserting audio segments), creating fake voices and spreading misinformation. Researchers developed an integrated detection framework (IDF), a system combining multiple deep neural networks (computer models inspired by how brains learn) to both detect when speech has been tampered with and identify what type of tampering was used, achieving over 95% accuracy across multiple languages.