Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
This academic paper proposes a new security strategy that hides network structure (the way computers are connected) and adds intentional delays to defend against side-channel attacks (methods where attackers gain information by observing patterns like timing or power usage rather than directly breaking encryption). The approach combines network obfuscation (hiding network details) with delay characteristics to make it harder for attackers to extract sensitive information through indirect observations.
ROPSpy is a tool designed to reduce false positives (incorrect security warnings) in static ROP attack detection (analyzing code without running it to find return-oriented programming attacks, where attackers chain existing code fragments to bypass security). The paper presents this as a cost-effective solution to a problem in security analysis where too many false alarms make it hard for developers to identify real threats.
This academic paper presents a design science approach for building security operations centers (SOCs, centralized facilities that monitor and respond to security threats) that are appropriately sized and modular for government agencies. The research, published in November 2026, focuses on making SOCs more flexible and scalable rather than one-size-fits-all, allowing agencies to adjust their security monitoring capabilities based on their specific needs.
This research study examines how people's cultural backgrounds affect whether they fall for phishing attacks (deceptive emails or messages tricking users into revealing sensitive information) and how well they can spot them. The study was conducted across multiple countries to understand if culture influences both phishing victimization rates and people's ability to recognize phishing attempts.
CleanStack is a new dual-stack defense system designed to protect against stack-based memory corruption attacks (exploits that manipulate a program's call stack to gain unauthorized control). Published in November 2026, this research presents an architectural approach to mitigate vulnerabilities where attackers overwrite data on the stack to crash programs or execute malicious code.
RSAFL is a new method for testing communication protocols (sets of rules that allow different systems to talk to each other) by using runtime state data (information about what the protocol is doing at any moment) to guide fuzzing (a testing technique where you send random or malformed data to find bugs). This approach helps security researchers discover vulnerabilities in protocol implementations more efficiently than traditional fuzzing methods.
This academic paper from November 2026 examines attacks on game resource localization, which is the process of adapting games for different languages and regions. The research appears to focus on statistical modeling of the effort required to execute such attacks, though the provided content does not include specific details about the attack methods or findings.
This research paper discusses M-LITO, a security method that protects location information in maritime edge networks (computing systems deployed on ships or near coastal areas) from side-channel attacks. The study focuses on two types of attacks: offloading-based inference (where attackers deduce location by monitoring which tasks a device sends to remote servers) and RSSI-based inference (where attackers use signal strength measurements to estimate a device's position). M-LITO aims to make a device's location appear different from its actual position, making these inference attacks ineffective.
This academic paper discusses intelligent asset parameterisation for risk-based moving target defence, a security technique that changes system configurations unpredictably to make it harder for attackers to find and exploit vulnerabilities. The research focuses on using AI to intelligently decide which system parameters to modify and when, based on risk assessment. The paper was published in Computers & Security journal in November 2026.
Researchers introduced HMM-MET, a method that uses hidden Markov models (a statistical technique for analyzing sequences of hidden states) to detect covert channels (hidden communication methods that exploit unintended system features) by tracking electromagnetic (EM) emissions at the interval level. The work focuses on improving detection of these stealthy communication paths through more granular monitoring of EM signals from computer hardware.
Researchers have developed a method to detect microburst attacks (sudden floods of data packets sent to overwhelm network equipment) in real time using sketch-based queue monitoring (a memory-efficient technique that tracks network traffic patterns) on programmable switches (network devices that can be reconfigured to run custom software). This approach allows networks to identify and respond to these attacks as they happen rather than after the damage occurs.
This academic paper describes a method for improving security in ICS (Industrial Control Systems, which manage critical infrastructure like power plants and factories) by using fuzzing (automatically sending random or malformed inputs to find bugs). The approach uses automated protocol inference (figuring out communication rules without documentation) and response-driven exploration (testing based on how systems react) to discover vulnerabilities in ICS equipment that might otherwise go undetected.
This academic paper presents a taxonomy, or classification system, of different economic models used in cybersecurity. Rather than discussing a specific vulnerability or threat, it organizes and categorizes the various ways that security costs, risks, and incentives work in the real world.
CRISP is a system designed to help enterprises comply with the Right to Be Forgotten (RTBF, a legal right allowing people to request deletion of their personal data) using permissioned blockchains (distributed ledgers where only authorized participants can access and modify records). The research addresses how organizations can securely delete or remove personal information from blockchain systems while maintaining the integrity and immutability that blockchains are designed to provide.
This academic paper from December 2026 examines the effectiveness of a cybersecurity training program based on threat avoidance theory (a psychological framework that explains how people decide whether to protect themselves from risks). The researchers conducted an experimental evaluation to test whether this theory-based training approach helps people better understand and respond to cybersecurity threats.
This research paper examines how the design of consent interfaces and user cynicism influence the privacy choices people make when interacting with AI systems and software. The study suggests that not all user agreements are equally meaningful, and factors like interface design and user skepticism significantly shape whether people actually protect their privacy or just accept default settings.
This research article examines security issues in BLE (Bluetooth Low Energy, a wireless communication standard used in IoT devices) pairing mechanisms within the context of modern regulations. The study uses BLE pairing as a case study to understand how Internet of Things (IoT) devices establish secure connections and the regulatory frameworks that govern their security.
This academic paper examines CAS (computer-aided services, systems that help automate tasks), particularly in AI contexts, and analyzes what happens when the service providers running these systems act maliciously or cannot be fully trusted. The research provides formal analysis (mathematical proof of security properties) to help organizations understand the risks and design safer deployments when they cannot completely trust the service provider.
PRISM-SE is a framework for measuring and assessing the risk of social engineering attacks (attempts to manipulate people into revealing secrets or performing unsafe actions) in a more accurate way by using non-circular proxies (measurable factors that don't depend on each other in a circular way). The research, published in December 2026, proposes a calibrated approach to better understand and quantify how vulnerable an organization or individual might be to social engineering threats.
This research examines how phishing detectors (AI systems trained to identify fraudulent emails and messages) perform when they encounter new types of attacks generated by generative AI (AI models that create text and content). The study looks at whether these detectors remain reliable and whether humans can understand how they make their decisions when facing AI-generated phishing attempts that differ from their training data.