Research Menu

Skip Search Box

The Next Wave | Vol. 19 | No. 4 | 2012

NSA sponsors science of cybersecurity lablets

NSA granted $2.5 million to North Carolina State University, the University of Illinois at Urbana-Champaign, and Carnegie Mellon University to fund research lablets devoted to developing a more scientific basis for the design and analysis of trusted cyber systems—a science of [cyber]security (SoS). NSA approved the schools' first research proposals for the lablets in December of 2011.

NSA's goal with these lablets is to create a unified body of knowledge in addition to analytics methods and tools that can serve as the basis of a trust engineering discipline, curriculum, and rigorous design methodologies. The results of SoS lablet research are to be extensively documented and widely distributed through the use of a new, network-based collaboration environment—the SoS virtual organization. The intention is for that environment to be the primary resource for learning about ongoing work in cybersecurity science and to be a place to participate with others in advancing the state of the art. For more information about the SoS virtual organization, click here.

The lablets' work will draw on several fundamental areas of computing research. Some ideas from fault-tolerant computing can be adapted to the context of security. Strategies from control theory will be extended to account for the high variation and uncertainty that may be present in systems when they are under attack. Game theory and decision theory principles will be used to explore the interplay between attack and defense. Formal methods will be applied to develop formal notions of resiliency. End-to-end system analysis will be employed to investigate resiliency of large systems against cyber attack. The lablets' work will draw upon ideas from other areas of mathematics and engineering as well.

Carnegie Mellon University SoS lablet

The broad goal of the Carnegie Mellon University (CMU) SoS lablet is to identify scientific principles that can lead to approaches to the development, evaluation, and evolution of secure systems at scale. The focus on scalability derives from a recognition that modern software-intensive systems have more components and a greater diversity of suppliers. The theme of scalability includes two principal areas of focus, which are composability and usability. Projects within the lablet may address diverse and possibly conflicting technical approaches in order to most effectively address the overall thematic goals.

Contributing technical areas include safe programming languages, binary and source code analysis, data-intensive systems analysis, self-healing and resilient architecture, assured API (application programming interface) and framework compliance, sociotechnical ecosystems, development environments, trusted computing, specification and verification, concurrent and distributed systems, requirements and policy, usable security and privacy, intrusion and malware detection, dynamic network analysis, model checking, secure coding practice, secure process separation, verification of cyber-physical systems, and others.

The lead principal investigator of the CMU SoS lablet is William Scherlis, professor in the School of Computer Science at CMU. He is the founding director of CMU's PhD Program in Software Engineering and director of CMU's Institute for Software Research in the School of Computer Science. His research relates to software assurance, software analysis, and assured safe concurrency.

The lablet's projects include:

    A language and framework for development of secure mobile applications,

    Architecture based self-securing systems,

    Improving the usability of security requirements by software developers through empirical studies and analysis,

    Learned resiliency: Secure multilevel systems,

    Secure composition of systems and policies,

    Security reasoning for distributed systems with uncertainties,

    Systematic testing of distributed and multithreaded systems at scale, and

    Validating productivity benefits of type-like behavioral specifications.

University of Illinois at Urbana-Champaign SoS lablet

The University of Illinois at Urbana-Champaign SoS lablet, which will be housed in the Information Trust Institute at Illinois, will leverage Illinois' expertise in resiliency, which in this context means a system's demonstrable ability to maintain security properties even during ongoing cyber attacks.

David M. Nicol, the lablet's principal investigator, explains, "The complexity of software systems guarantees that there will almost always be errors that can be exploited by attackers. We have a critical need for foundational design principles that anticipate penetrations, contain them, and limit their effects, even if the penetration isn't detected."

Nicol is a professor of electrical and computer engineering at Illinois and the director of the Information Trust Institute. The lablet's leadership is shared with coprincipal investigators William H. Sanders, who is an ECE professor and director of the Coordinated Science Laboratory at Illinois, and José Meseguer, a professor of computer science.

The lablet's projects include:

    Classification of cyber-physical system adversaries,

    End-to-end analysis of side channels,

    Enhancing cybersecurity through networks resilient to targeted attacks,

    From measurements to security science: Data-driven approach,

    Protocol verification: Beyond reachability properties,

    Quantitative assessment of access control in complex distributed systems,

    Quantitative security metrics for cyber-human systems,

    Scalable methods for security against distributed attacks,

    Secure platforms via stochastic computing,

    The science of summarizing systems: Generating security properties using data mining and formal analysis,

    Theoretical foundations of threat assessment by inverse optimal control,

    Toward a theory of resilience in systems: A game-theoretic approach,

    Towards a science of securing network forwarding, and

    Trust from explicit evidence: Integrating digital signatures and formal proofs.

North Carolina State University SoS lablet

The North Carolina State University (NC State) SoS lablet, which will be housed in the Institute for Next Generation IT Systems, will leverage NC State's expertise and experience in analytics, including the extensive expertise available in the NC State Institute of Advanced Analytics.

The coprincipal investigators for the NC State SoS lablet are Dr. Laurie Williams, professor of computer science, and Dr. Michael Rappa, director of the Institute of Advanced Analytics and professor of computer science.

"The security fortification technique of data encryption has a sound mathematical basis, providing a predictable and quantifiable level of security based upon the strength of the encryption algorithm," Williams says. "Conversely, the science behind other security techniques that provide vulnerability prevention, detection, and fortification is either rudimentary or does not exist. As a result, the principles of designing trustworthy systems often are not rooted in science. The three SoS lablets established by the NSA will research techniques to provide this scientific basis."

The lablet's projects include:

Full proposals

    An investigation of scientific principles involved in software security engineering,

    Attaining least privilege through automatic partitioning of hybrid programs,

    Argumentation as a basis for reasoning about security,

    Developing a user profile to predict phishing susceptibility and security technology acceptance,

    Empirical privacy and empirical utility of anonymized data,

    Improving the usability of security requirements by software developers through empirical studies and analysis,

    Security metrics, and

    Towards a scientific basis for user-centric security design.


    A science of timing channels in modern cloud environments,

    An adoption theory of secure software development tools,

    Multi-target visualizations for visual analytics,

    Normative trust toward a principled basis for enabling trustworthy decision making,

    Quantifying underpinnings for network analytics as components of composable security,

    Quantifying mobile malware threats,

    Spatiotemporal security analytics and human cognition, and

    Studying latency and stability of closed-loop sensing-based security systems.

View PDF version of this article (267 KB)


Date Posted: Jan 15, 2009 | Last Modified: May 9, 2012 | Last Reviewed: May 9, 2012