PETRAS Internet of Things hub

January 2016 - January 2021

Software and Systems Security Research Group

January 2015 - December 2020

Alan Turing Institute

December 2014 - December 2020

The Human Cybercriminal Project

September 2014 - September 2020

VOX-Pol Network of Excellence

January 2014 - December 2019

Hub for Networked Quantum Information Technologies (NQIT)

December 2014 - November 2019

PROTECTIVE: Proactive Risk Management through Improved Cyber Situational Awareness

August 2016 - August 2019

Date:	August 2016 - August 2019
Project leader:	Jassim Happa (Oxford leader: 10 partners coordinated via Dublin)

PROTECTIVE is designed to improve an organisations ongoing awareness of the risk posed to its business by cyber security attacks. PROTECTIVE makes two key contributions to achieve this enhanced situational awareness. Firstly it increases the computer security incident response team’s (CSIRT) threat awareness through improved security monitoring and increased sharing of threat intelligence between organisations within a community. Secondly it ranks critical alerts based on the potential damage the attack can inflict on the threatened assets and hence to the organisations business. High impact alerts that target important hosts will have a higher priority than other alerts. Through the combination of these two measures organisations are better prepared to handle incoming attacks, malware outbreaks and other security problems and to guide the development of the prevention and remediation processes.
The PROTECTIVE system is designed to provide solutions for public domain CSIRTs and SME’s who both have needs outside the mainstream of cyber security solution provision. Public CSIRTs needs arise in part because commercial tools do not address their unique requirements. This has created a shortfall, clearly articulated by ENISA, of tools with the required analytical and visualisation capabilities to enable public CSIRTs provide optimised services to their constituency. SME’s also are vulnerable to cybercrime as they have limited resources to protect themselves and often a limited understanding of what needs to be done. Two pilots will be conducted to evaluate and validate the PROTECTIVE outcomes with CSIRTs from 3 National Research and Educational Networks (NRENs) and with SMEs via a managed security service provider (MSSP).
The PROTECTIVE consortium is constituted of 3 NRENs, 3 academic and four commercial partners from 8 countries so as to maximise the technical and commercial impact of the outputs and the dissemination and uptake of the results. http://cordis.europa.eu/project/rcn/202674_en.html

Steganography and Steganalysis Research Group

January 2009 - February 2019

Post-Quantum Cryptography

September 2014 - September 2018

UnBias: Emancipating Users Against Algorithmic Biases for a Trusted Digital Economy

September 2016 - August 2018

Date:	September 2016 - August 2018
Project leader:	Marina Jirotka

In an age of ubiquitous data collecting, analysis and processing, how can citizens judge the trustworthiness and fairness of systems that heavily rely on algorithms? News feeds, search engine results and product recommendations increasingly use personalization algorithms to help us cut through the mountains of available information and find those bits that are most relevant, but how can we know if the information we get really is the best match for our interests?

There is no such thing as a neutral algorithm. As anyone who has ever created something knows, even something as simple as a meal, the act of creating inevitably involves choices that will affect the properties of the final product. Despite this truism recommendations and selections made by algorithms are commonly presented to consumers as if they are inherently free from (human) bias and ‘fair’ because the decisions are ‘based on data’. During the recent controversy about possible political bias in Facebook’s Trending Topics for instance the focus was almost exclusively on the role of the human editors even though 95% or more of the news selection process is done by algorithms. Human judgements however are ultimately also based on data.

The EPSRC funded project “UnBias: Emancipating Users Against Algorithmic Biases for a Trusted Digital Economy” looks at all of the issues above in much greater detail. A large part of this work will include user group studies to understand the concerns and perspectives of citizens. UnBias aims to provide policy recommendations, ethical guidelines and a ‘fairness toolkit’ co-produced with young people and other stakeholders that will include educational materials and resources to support youth understanding about online environments as well as raise awareness among online providers about the concerns and rights of young internet users. The project is relevant for young people as well as society as a whole to ensure trust and transparency are not missing from the internet. The results will be widely disseminated to a variety of audiences ranging from academic peer-review journals to community groups of interest such as secondary schools and youth clubs.

Learn more at http://unbias.wp.horizon.ac.uk

5G Ensure

November 2015 - October 2017

Trusted Cloud Knowledge Transfer Partnership

June 2015 - May 2017

Date:	June 2015 - May 2017
Project leader:	David Wallom

The EPSRC MyTrustedCloud project (2011) was highly successful with aspects of this work are being taken forward directly in an InnovateUK funded Knowledge Transfer Project. The original project investigated how this integration of trusted and cloud computing could be used in a practical scenario. The usecase supported trusted data exchange and application attestation to manage communication between the Distribution and transmission networks using cloud computing as the data exchange vehicle. The project created a detailed threat analysis of using IaaS cloud systems and the specific countermeasures that trusted platform allow within the system, an exemplar software framework in which energy researchers are able to start making use of commercially sensitive information while at the same time make full use of cloud computing.

The Trusted Cloud Knowledge Transfer Partnership (2015-17) will develop this substantially further bringing verifiable data privacy and security to production public cloud computing. This project, working with corporate partner 100PercentIT, will build a production trusted cloud which will be certified by NCSC and include digital key management technologies to ensure isolation of user certificates from the cloud provider. Through the developed Porridge remote attestation service it will enable multiple business models rooted in cryptographically verifiable trust. A cloud user will be able to verify the identity and configuration of any remote system in a scaleable and resiliant manner building from the cloud storage and physical infrastructure through to a full chain of trust capability of any virtual instance started within the cloud. This will support software whitelisting within all of the computational systems and trusted application or software signing through the trusted storage. The KTP has stated aims of doubling the profitability of the commercial partner who already has over 20 current and potential customers interested in this new capability and who have stated they would pay for it as soon as available and certified.

Global Cyber Security Capacity Centre

April 2013 - March 2017

Date:	April 2013 - March 2017
Project leader:	Sadie Creese, Ian Brown, Michael Goldsmith, David Upton

The Global Cyber Security Capacity Centre (GCSCC) is a leading international centre for research on efficient and effective cybersecurity capacity building. It has created the National Cybersecurity Capacity Maturity Model (CMM), the first-of-its-kind model to review a country’s cybersecurity capacity maturity. Together with key strategic international partners, such as the World Bank, the Organization of American States (OAS), the Commonwealth Telecommunications Organisation, and the International Telecommunication Union, the Capacity Centre has since 2015 successfully deployed the CMM in over 40 countries around the world, and significantly underpinned a regional study in Latin America and the Caribbean through collaboration with the OAS. The review processes and the resulting reports, drafted by the GCSCC, enabled the governments to benchmark national cybersecurity policy and strategies, cybersecurity culture, knowledge development, legal and regulatory frameworks, and risk controls. The results and recommendations enabled nations to better plan national strategies, facilitate international and regional collaboration and cooperation, and set priorities for strategic investment and capacity development. To foster global knowledge exchange and transfer of expertise gained in the global community, the GCSCC also runs the publicly-available Cybersecurity Capacity Portal, a global online resource for good practice and knowledge in cybersecurity capacity building, which also includes a mapping of international and regional capacity building efforts by the various actors in the field. [www.sbs.ox.ac.uk/cybersecurity-capacity/]
The deployment of the model has been in itself an effective capacity-building exercise and has been informing the thinking of the global community. The deployment of the CMM has also become part of two global and regional initiatives by the Global Forum on Cyber Expertise (GFCE). The GCSCC encourages the further uptake of the model by other countries and international community actors and has constant conversations with regional organisations, governments, private companies and other research institutions who work on this issue. It also has recently established its first regional partnership with the Oceania Cybersecurity Centre, which will be the focal point for cybersecurity capacity building in that region.

Rather than evaluating the country’s policies only, they look at the its maturity in addressing a wide range of questions, including: how well do the various stakeholders work together to create and revise policies, make decisions, and assess whether strategies are working? The resultant review allows countries to understand their strengths and weaknesses, and target their resources to develop cybersecurity capacity according to their national priorities.

This methodology has been endorsed by the Organization of American States, the World Bank, and the Commonwealth Telecommunications Organisation, and has been used to assess over 40 countries, including Bhutan, Jamaica, Uganda, the UK, and 32 members of the Organisation of American States (link). The model is a living document which continues to be revised and refined.

The Capacity Centre is also developing a model for Understanding Cyber Harm, moving beyond simple measures of financial harm to address complex issues of reputational, psychological, physical harm etc. Together the Capacity Maturity Model and the future HARM Model will enable nation states and/or organisations to make better informed decisions when it comes to financial investments in cybersecurity capacity building.

The Capacity Centre also hosts the Cybersecurity Capacity Portal, a global resource for expertise and knowledge on cybersecurity capacity building. This publicly-available online platform provides access to all of the tools, models and best cases, includes and inventory of international, regional and national cyber capacity building initiatives underway, and aggregates a number of other resources in the field.

More details at:
http://www.oxfordmartin.ox.ac.uk/cybersecurity

SmartSociety: hybrid and diversity-aware collective adaptive systems

January 2013 - January 2017

FastPass: A Harmonized, Modular Reference System for all European Automatic Border Crossing Points

January 2013 - December 2016

Digital Wildfire: (Mis)information flows, propagation and responsible governance

November 2014 - May 2016

Governance for Responsible Innovation (GREAT)

February 2014 - January 2016

Digital Citizenship and Surveillance Society: UK State-Media-Citizen relations after the Snowden Leaks

January 2015 - January 2016

Richer Picture

April 2015 - September 2015

Trustworthy Remote Entities

October 2011 - June 2015

Date:	October 2011 - June 2015
Project leader:	Andrew Paverd, Andrew Martin, Ian Brown

How do you communicate with someone you don't trust? How do you share data with an untrusted system without compromising your privacy? How do you do this using today's technology? These questions are becoming increasingly important as networked computer systems become an integral part of our daily lives through developments like the smart energy grid and the Internet of Things.

The archetypal solution to these privacy challenges is to introduce a some type of intermediary into the communication path to perform privacy-enhancing information processing, such as data aggregation or filtering. However, this approach is usually dismissed because we lack guarantees of this intermediary's trustworthiness – we don't want to introduce a so-called trusted third party.

But what if we had a system we could trust – a system that is trustworthy? In this research endeavour we are designing, building and testing the Trustworthy Remote Entity (TRE), a highly-specialized networked system that can process data whilst providing a very high level of assurance. Unlike a trusted third party, users do not blindly trust the TRE. Instead, the TRE uses tools and techniques from the field of Trusted Computing, such as remote attestation and the Trusted Platform Module (TPM), to provide technical guarantees of its trustworthiness. This architecture allows us to use today's well-established cryptographic techniques and widely deployed hardware, such as the TPM, to perform Secure Multi-party Computation (SMC) cheaply and efficiently and use this to enhance privacy in the smart energy grid and other emerging application domains.

More details at:
https://www.cs.ox.ac.uk/people/andrew.paverd/tre/

Network of Excellence in Internet Science (EINS)

December 2015 - May 2015

Identity Security in Cyberspace

December 2013 - April 2015

SID: An Exploration of Super-Identity

October 2011 - March 2015

Global Model and Observatory for International Responsible Research and Innovation Coordination (RESPONSIBILITY)

February 2013 - February 2015

MetaVis

June 2014 - January 2015

FRESNEL: Federated Secure Sensor Network Laboratory

January 2010 - August 2014

Framework for Responsible Research & Innovation in ICT (FRRIICT)

September 2011 - August 2014

CyberVis

May 2013 - August 2014

Future Home Networks and Services

May 2011 - May 2014

Trust Enabling Augmented-Reality Support for Information-Environments (TEASE)

October 2011 - March 2014

Trust Domains – A framework for modelling and designing e-service infrastructures for controlled sharing of information

April 2011 - March 2014

Date:	April 2011 - March 2014
Project leader:	Andrew Martin

Ensuring flows of information to the right people over multiple collaborating organisations is becoming increasingly important for both business and government. There are, however, trade-offs between the productivity and functional gains from sharing information, on the one hand, and the risks of leakage and opening up IT systems, on the other. Recent developments in trusted computing and virtualization can address these trade offs in a flexible manner, as they allow for the creation of policy controlled IT systems with configurable security properties. Collaborative, secure sharing solutions can be realized through the creation of dynamic 'Trust Domains' -- a notion that we propose to explore at and between all levels of the policy-service-infrastructure stack -- that enforce information flow and configuration policies. We created a customer-driven project starting from examples of information sharing within police forces and agencies they work with. Based on a practical understanding of the required flows and policies, we developed an abstract framework for qualifying types of and flows of information and a corresponding model of the associated risks. This allows process owners to describe their requirements and concerns. We researched how to qualify and map information flows to Trust Domain configurations, derived guidelines and templates for supporting solution architects in building IT services, and extended our set of analytics and modelling tools to help stakeholders gain an understanding of the risks associated with information flows and enforcement mechanisms.There are business opportunities for creating and operating new e-services with enhanced trust and security properties based on new methodologies and toolsets. The framework we created takes a business-driven approach to risk, trust and security and covers aspects of process and system analysis, design, configuration, security policy, human roles, and operational management. We create a value proposition by having the models, tools and methodologies that allows us to bridge the current gap between business level risk and system configuration and policy design. Hence mapping service needs onto trusted platforms, domains, and infrastructure. The project complements and expands ongoing, TSB-funded work on trust economics as well as on complexity, risk, and resilience management pioneered and exploited by HP's UK Enterprise Services. Both HP Enterprise Services and HP Labs, Bristol believe that bridging high-level incentive models and systems design for trust domains would be a unique global differentiator, not only aligned with US-NITRD 'game-changing' themes, but ahead of them in suggesting an integrated approach. The academic components of this project contributed the following developments in support of this programme: - The concept of Trust Domain, at and between the various levels of the socio-technical system stack (policy-service-infrastructure); - Mathematical systems modelling technologies to support tools and methodologies for reasoning about the properties, dynamics, and applications of the Trust Domain concept; - A thorough taxonomy of technical, design, and architectural properties which give rise to different trust characteristics in deployed services; - Modelling the quality of trust and expectations among components, to the extent of being able to make a meaningful comparison of solutions based on different architectural paradigms, within a given context.Targeted market: intra-corporate and intra-governmental data centres and 'clouds' whose stringent information flow control requirements cannot be met by today's providers.

Non-standard Authentication

January 2010 - December 2013

Digital Personhood: Being There: Humans and Robots in Public Spaces (HARPS)

October 2013 - September 2013

TClouds

October 2010 - September 2013

webinos: Secure WebOS Application Delivery Environment

September 2010 - August 2013

Ethical Privacy Guidelines for Mobile Connectivity Measurements

May 2013 - August 2013

SATURN: Self-organizing Adaptive Technology Underlying Resilient Networks

November 2009 - October 2012

MyTrustedCloud

February 2011 - October 2011

Ensuring Consent and Revocation (EnCoRe)

June 2008 - October 2011

Evaluating Usability, Security, and Trustworthiness of Ad-hoc Collaborative Environments (EUSTACE)

May 2012 - October 2011

Privacy Value Networks

October 2008 - September 2011

Security Protocols for ad hoc networks

October 2007 - January 2010

Early-Careers Researchers

Ongoing

Secure Enterprise Companion Device (SECD)

Ongoing

Corporate Insider Threat Detection: Cyber Security Inside and Out

Ongoing

Smart Oxford

Ongoing

Cryptography Research Group

Ongoing

Information Security group

Ongoing

DIET: A Different Approach to Smart Meter Data Insight against Energy Theft

Ongoing

Date:	Ongoing
Project leader:	David Wallom, Andrew Martin

In collaboration with British Gas, G4S, EDMI Smart Meters, The DIET project supports the development of new services to investigate coordinated analysis streams of consumption and logging data produced by smart meters.

Building on the EPSRC Advanced Dynamic Energy Pricing & Tariffs (ADEPT) and the 'Working with Infrastructure Creation of Knowledge Energy strategy Development (WICKED) projects we have developed a number of different analytic techniques from which we can match consumption to customer behaviour at the whole premises scale as well as full understand the different resolutions of data required for different levels of insight. Building on these two projects we are working through InnovateUK funding on the Data Insight against Energy Theft (DIET, 15-17) which also takes forward the established relationship with the energy sector, to develop an approach using smart meter logging and error messages alongside meter consumption data to identifying potential energy theft and faulty equipment by examining changes in data through time. The project will analyse data collected from a pool of SME electricity meters with a view to developing a reusable method for the domestic market operation.

These streams of meter status and error messages that are not normally retrieved give details on the physical environment of the meters and in conjunction with consumption data will enable creation of richer and more in-depth knowledge of system behaviour. The primary aim of these analytics are to discover and then recognise signatures for two different classes of events, possible meter failure scenarios and warnings on the occurrence of patterns indicative of meter attack/tamper.

Read more at .

http://www.oerc.ox.ac.uk/projects/diet-different-approach-smart-meter-data-insight-against-energy-theft

“Automated Verification” research theme

Ongoing

“Security” research theme

Ongoing

Continuous user authentication and behavioural biometrics

Ongoing

Next-generation Airspace Security

Ongoing

Changing Character of War Centre

Ongoing

Trustworthy Digital Systems

Ongoing

Systems Verification research group

Ongoing

Picosec

Ongoing

Creating a safe, secure and prosperous cyberspace through internationally leading research and educational programmes

Research activities