Academic Centre of Excellence in Cyber Security Research - University of Southampton

网络安全最终与设备和人有关，它们共同构成了网络和系统的“网络空间”。漏洞来自硬件、软件和人为因素，但通常是它们的任何组合。我们的跨学科方法为我们提供了大量此类组合的专业知识。我们提供广泛的相互交织的研究，从电子（纳米）设备到（物理和网络）生物识别，通过使用行为和认知心理学的世界领先的网络支持基础设施研究，并部署正式和实验方法。我们致力于安全硬件设备，如数据安全的可消毒存储器，嵌入式安全和可信硬件，它们的安全正式设计和验证，以及在我们最先进的洁净室中制造。这链接到（关键任务，多权限）软件系统，其设计和验证建立在我们在基于语言的安全方面的专业知识。数学模型和静态分析技术也用于隐私系统，其最终目标是驱动数据限制和隐私增强web应用程序，在线协议和分析工具的设计。我们对信任和声誉模型的研究具有类似的目标驱动性质，旨在利用代理社区中的相互信任机制，在缺乏可靠信息的情况下实现协作目标。代理系统通过先进的网络连接到安全服务和信息风险管理，并为态势感知的前沿研究提供基础。后者扩展到实际操作相关的特设网络，例如人-代理团队的集成。这与我们的行为和认知科学家建立了协同作用，他们专注于分析网络行为和群体决策和风险行为的模式。我们在关键基础设施安全方面的工作涉及网络物理和工业控制系统，金融交易和网络。它包括物联网、电网、楼宇自动化、云、分布式账本、网络控制分析以及影响金融交易市场网络攻击响应时间的人为因素。我们还关注访问控制，攻击可视化，关联数据（去）匿名和来源。一个日益重要的主题是用户（网络）身份。这建立在加密协议的基础工作之上，并在我们的计算机和社会科学研究人员之间提供了强有力的联系，特别是通过（不可链接的）身份、超级身份以及隐私和网络犯罪立法方面的工作。最后，我们提到了我们在基于物理和网络个体特征的访问控制生物识别方面的开创性工作。目前的建议旨在为该中心争取一笔支助补助金。具体来说，我们寻求资金来支持主任组织和中心的日常运作；举办一系列有关网络安全的研讨会；促进多学科活动；参加与其他ACE-CSR的交流活动，并主办一次全国ACE-CSR研讨会；开展外联、公众参与和行业联络活动；改进我们的门户网站；印刷和分发小册子和宣传材料。

Cyber security is ultimately about devices and people, which together give rise to a 'cyberspace' of networks and systems. Vulnerabilities arise from hardware, software and human factors, but typically from any combination of them. Our interdisciplinary approach affords us expertise over a significant number of such combinations. We deliver a wide spectrum of interwoven research ranging from electronic (nano) devices to (physical and cyber) biometrics, passing through world-leading research on cyber-enabling infrastructures using behavioural and cognitive psychology, and deploying both formal and experimental methods.We work on secure hardware devices such as data-secure sanitisable memories, embedded security and trusted hardware, their secure formal design and verification, and fabrication in our state-of-the-art cleanrooms. This links to (mission-critical, multi-clearance) software systems, whose design and validation builds on our expertise in language-based security. Mathematical models and static analysis techniques are also used for privacy systems, whose ultimate goal is to drive the design of data-confinement and privacy-enhancing web applications, online protocols and analysis tools. Of a similar goal-driven nature is our research on trust-and-reputation models, aimed at exploiting mutual trust mechanisms in agent communities to meet collaborative goals in the absence of reliable information.Agents systems link to secure services and information risk management over advanced networks and provide the basis for cutting-edge research on situational awareness. The latter extends to ad-hoc networks of practical operational relevance, such as the integration of human-agent teams. This establishes a synergy with our behavioural and cognitive scientists, who focus on the analysis of patterns of cyber-behaviour and group decision-making and risk behaviour.Our work on the security of critical infrastructures concerns cyber-physical and industrial control systems, financial trading, and the web. It includes IoT, the power grid, building automation, clouds, distributed ledgers, the analysis of cyber controls and of human factors affecting response time to cyber-attacks in financial trading markets. We also focus on access control, attack visualisation, linked-data (de-)anonymisation and provenance. A theme of growing importance concerns users' (web) identities. This builds on foundational work on cryptoprotocols, and provides a strong connection between our computer and social sciences researchers, in particular through the issues of (un-linkable) identities, super-identities, and the work on privacy and cyber-crime legislation. Finally, we mention our seminal work on biometrics for access control based on physical and cyber individual characteristics.The present proposal aims at securing a support grant for the centre. Specifically, we seek funds to: support the Director in the organisation and daily running of the centre; run a series of seminars in Cyber Security; foster multidisciplinary activities; participate in networking events with other ACE-CSRs and host a national ACE-CSR workshop; run outreach, public engagement and industrial liaison events; revamp our web portal; print and distribute brochures and publicity material.