Security Research Library

Hutchins, Cloppert, Amin (Lockheed Martin) · ICIW 2011

Introduced the Cyber Kill Chain framework — seven-phase adversary model (Recon → Weaponise → Deliver → Exploit → Install → C2 → Act) that underpins modern threat-informed defence.

Caltagirone, Pendergast, Betz · DTIC Technical Report

Defines a structured framework for analysing intrusions via four features — Adversary, Infrastructure, Capability, Victim — enabling pivot-based attribution and campaign clustering.

Strom, Applebaum, Miller, Nickels, Pennington, Thomas (MITRE) · MITRE Technical Report

Detailed methodology behind the ATT&CK framework — adversary behaviour taxonomy covering 14 tactics, hundreds of techniques, and the empirical methodology for populating the knowledge base from real intrusions.

Aleph One · Phrack Magazine #49

Foundational paper on stack-based buffer overflow exploitation — introduced the technique of overwriting the saved return address to redirect execution, forming the basis of a generation of exploit development.

Szekeres, Payer, Wei, Song · IEEE Security & Privacy 2013

Systematisation-of-Knowledge paper providing a unified taxonomy of memory safety vulnerabilities and their mitigations, evaluating why decades of proposed defences have not solved memory unsafety.

Roemer, Buchanan, Shacham, Savage · ACM TISSEC 2012

Comprehensive treatment of ROP — chaining existing code gadgets to achieve Turing-complete computation without injecting shellcode, bypassing W^X/DEP protections. Motivates CFI-based mitigations.

Ken Thompson · ACM Turing Award Lecture / CACM

Thompson's famous demonstration that a compiler can be trojanised to insert backdoors invisibly — even when compiling clean source — establishing the foundational trust-in-supply-chain problem.

Steve Bellovin · ACM SIGCOMM Computer Communication Review

Identified fundamental weaknesses in TCP/IP: IP spoofing, TCP sequence prediction, DNS poisoning, routing attacks. Many vulnerabilities described here remain relevant in legacy deployments.

de Ruiter, Poll · USENIX Security 2015

State machine learning infers TLS implementation behaviour through blackbox testing, uncovering protocol logic flaws in GnuTLS, the Java Secure Socket Extension, and OpenSSL.

Sommer, Paxson · IEEE Security & Privacy 2010

Landmark critique of applying ML to intrusion detection — identifying why high-accuracy lab results fail in real networks: non-stationarity, high cost of errors, and semantic gap.

Scaife, Carter, Traynor, Butler · IEEE ICDCS 2016

CryptoDrop — early-warning ransomware detector using file system activity monitoring and Shannon entropy measurements. Demonstrated detection of 14 real ransomware families with < 10 files lost.

Bhamare, Salman, Samaka, Erbad, Jain · IEEE Cloud Computing 2016

Empirical analysis of vulnerabilities across multi-tenant cloud deployments — side-channel attacks on co-located VMs, hypervisor escape paths, network segmentation failures in IaaS.

Nick Gregoire (Exploitee.rs) · Exploitee.rs Technical Report

Container escape technique via Linux kernel vulnerability — pivoting from Docker container to host via privilege escalation through unhandled kernel signal path. Motivates seccomp profiles and user namespaces.

Goodfellow, Shlens, Szegedy (Google Brain) · ICLR 2015

Introduced FGSM (Fast Gradient Sign Method) — single-step attack generating adversarial images indistinguishable from originals but misclassified with high confidence. Proposed adversarial training as defence.

Greshake, Abdelnabi, Mishra, Endres, Holz, Fritz · AISec @ CCS 2023

Demonstrated indirect prompt injection against LLM-integrated applications — attacker-controlled content retrieved via RAG/browsing injects instructions that manipulate the LLM's actions against the user.

Zou, Wang, Carlini, Nasr, Kolter, Fredrikson · arXiv 2023

GCG attack — automated generation of adversarial suffixes that cause aligned LLMs to produce harmful content, transferring across GPT-4, Claude, and Gemini despite safety fine-tuning.

Mathy Vanhoef, Frank Piessens (KU Leuven) · ACM CCS 2017

KRACK — demonstrated that WPA2's 4-way handshake can be manipulated to reinstall an already-in-use key, enabling decryption and injection of wireless traffic. Patched via IEEE 802.11 amendment.

Mathy Vanhoef, Eyal Ronen · IEEE Security & Privacy 2020

Side-channel and denial-of-service vulnerabilities in WPA3-SAE Dragonfly handshake — cache-based and timing attacks allowing offline dictionary attacks despite WPA3's forward secrecy guarantees.

Heninger, Durumeric, Wustrow, Halderman · USENIX Security 2012

Large-scale survey discovering that millions of RSA and DSA keys in network devices share prime factors due to insufficient entropy at first boot, allowing private key extraction at internet scale.

Clark, van Oorschot · IEEE Security & Privacy 2013

Systematisation of HTTPS/TLS ecosystem challenges — certificate authority trust model weaknesses, CT log limitations, HSTS and HPKP effectiveness, and path to a more trustworthy web PKI.