Cybersecurity Commons^™

Graph-Theoretic Analysis Of Function Call Graphs Using L-Moments For Malware Detection, Anthony J. Rose, Wayne C. Henry, Scott R. Graham, Christine M. Schubert Kabban, Christopher M. Rondeau

Faculty Publications

Most malware detection continues to rely on signature matching, which struggles with obfuscated or novel variants. This research presents a malware detector that instead relies on the static structure of function call graphs, summarized using L-moments of the degree, betweenness, closeness, and clustering measures into compact, interpretable descriptors that persist across malware variants. Evaluated on 175,633 binaries spanning many families under balanced, natural-prevalence, and prevalence-weighted training regimes, ensemble methods achieved Area Under the Curve (AUC) values up to 0.98 on the full-corpus random split, while a feed-forward neural network remained robust across regimes with AUC 0.92–0.95. Linear baselines were far …

Future Trends In Cybersecurity: A Meta-Review, Yara Mohammed, Manar Alsaid, Gahangir Hossain

Faculty Publications

The increasing importance of cybersecurity in protecting digital assets, data and infrastructures necessitates a reevaluation of research priorities within the discipline. As of today, numerous emerging cybersecurity topics are gaining significant importance in both academic research and industry applications. To identify recent trends in cybersecurity topics, this study extracts scholarly articles from two prestigious academic databases, the ACM Digital Library, and Google Scholar, covering the period from early 2015 to late 2024.Through a systematic identification of trends and focal points in cybersecurity research, a comprehensive analysis is facilitated, including Latent Dirichlet Allocation (LDA), Biterm Topic Modeling (BTM), keyword frequencies, and …

Better Digital Contracts With Prosocial Friction-In-Design, Brett Frischmann, Moshe Y. Vardi

Faculty Publications

Contract law is supposed to enable people to reach genuine agreements and cooperate. If this ideal was ever a reality, the rise of mass market contracts and boil­erplate rendered it pure fiction. Modern consumer contracts are incomprehensible to most people. No one reads them anyway.

Digital contracting involves design features that amplify traditional boilerplate harms and create others. For example, digital contracting is too cheap; low marginal costs lead to overexpansion in scale and scope. To make matters worse, the loss of autonomy from repeat engagement with digital contracting systems is pernicious. People become increasingly predictable and programmable as digital …

Microarchitectural Malware Detection Via Translation Lookaside Buffer (Tlb) Events, Cristian Agredo, Daniel F. Koranek, Christine M. Schubert Kabban, Jose R. Gutierrez Del Arroyo, Scott R. Graham

Faculty Publications

Prior work has shown that Translation Lookaside Buffer (TLB) data contains valuable behavioral information. Many existing methodologies rely on timing features or focus solely on workload classification. In this study, we propose a novel approach to malware classification using only TLB-related Hardware Performance Counters (HPCs), explicitly excluding any dependence on timing features such as task execution duration or memory access timing. Our methodology evaluates whether TLB data alone, without any timing information, can effectively distinguish between malicious and benign programs. We test this across three classification scenarios: (1) A binary classification problem involving distinguishing malicious from benign tasks, (2) a …

Exploring The Translation Lookaside Buffer (Tlb) For Low-Level Task Differentiation And Classification, Cristian Agredo, Daniel F. Koranek, Christine M. Schubert, Jose A. Gutierrez Del Arroyo, Tor J. Langehaug, Scott R. Graham

Faculty Publications

The primary focus of modern Central Processing Unit (CPU) technologies is performance improvement, with security often considered a secondary concern. As a result, vulnerabilities within the system are overlooked. While significant research, both offensive and defensive, has been conducted on CPU caches, relatively little attention has been given to the Translation Lookaside Buffer (TLB) due to its perceived lack of data granularity. Prior studies have typically combined multiple Hardware Performance Counters (HPCs) or relied on timing analysis to extract meaningful insights. In contrast, this study introduces a novel methodology that leverages only TLB related HPCs for multi-task classification, without incorporating …

Incentivizing Cyber Security Investment In The Power Sector Using An Extended Cyber Insurance Framework, Jack P. Rosson, Mason J. Rice, Juan Lopez Jr., R. David Fass

Faculty Publications

Collaboration between the DHS Cybersecurity and Infrastructure Security Agency (CISA) and public-sector partners has revealed that a dearth of cyber-incident data combined with the unpredictability of cyber attacks have contributed to a shortfall in first-party cyber insurance protection in the critical infrastructure community. This research explores the foundations of insurance theory and adopts behavioral manipulation methods to incentivize cyber-security investment. We validate the model by applying power industry performance data from 2013-2015 to assess risk facing the industry. Results show that the model can successfully discriminate between individual power companies as well as geographic regions on the basis of risk …

Using Timing-Based Side Channels For Anomaly Detection In Industrial Control Systems, Stephen Dunlap, Jonathan W. Butts, Juan L. Lopez Jr., Mason J. Rice, Barry E. Mullins

Faculty Publications

The critical infrastructure, which includes the electric power grid, railroads and water treatment facilities, is dependent on the proper operation of industrial control systems. However, malware such as Stuxnet has demonstrated the ability to alter industrial control system parameters to create physical effects. Of particular concern is malware that targets embedded devices that monitor and control system functionality, while masking the actions from plant operators and security analysts. Indeed, system security relies on guarantees that the assurance of these devices can be maintained throughout their lifetimes. This paper presents a novel approach that uses timing-based side channel analysis to establish …

Design And Analysis Of A Dynamically Configured Log-Based Distributed Security Event Detection Methodology, Michael R. Grimaila, Justin M. Myers, Robert F. Mills, Gilbert L. Peterson

Faculty Publications

Military and defense organizations rely upon the security of data stored in, and communicated through, their cyber infrastructure to fulfill their mission objectives. It is essential to identify threats to the cyber infrastructure in a timely manner, so that mission risks can be recognized and mitigated. Centralized event logging and correlation is a proven method for identifying threats to cyber resources. However, centralized event logging is inflexible and does not scale well, because it consumes excessive network bandwidth and imposes significant storage and processing requirements on the central event log server. In this paper, we present a flexible, distributed event …

An Empirical Analysis Of The Cascade Error Reconciliation Protocol For Quantum Key Distribution, Timothy I. Calver, Michael R. Grimaila, Jeffrey W. Humphries

Faculty Publications

Modern cryptography provides the means to securely communicate data between authorized entities by using mathematical transformations which require pre-shared cryptographic keys. The need to share key material with authorized entities in a secure, cost efficient and timely manner has driven efforts to develop new key distribution methods. A promising method is Quantum Key Distribution (QKD) which is considered to be “unconditionally secure” because it relies upon the immutable laws of quantum physics rather than computational complexity as the basis for its security. An important component of any QKD system is the error reconciliation protocol which is used to identify and …