Skip to main content

Cybersecurity Research Papers

Master's degree candidates at SANS.edu conduct research that is relevant, has real world impact, and often provides cutting-edge advancements to the field of cybersecurity, all under the guidance and review of our world-class instructors.

Learn About the Master's Degree Program
Showing 12 of 792

What’s in a Name: The Impact of Domain Names on Honeypot Effectiveness

Research PaperDigital Forensics and Incident Response

Research honeypots are a foundational tool for collecting cyber threat intelligence and detecting novel threats.

  • 26 Oct 2026
  • Ian J. Goldin

Breaking the Silo: Turning Fragmented Hunts Into Operational Awareness With a Common Operating Picture

Research PaperDigital Forensics and Incident Response

Threat hunters frequently rely on fragmented notes and inconsistent case records, making it difficult to correlate weak signals, preserve prior analysis, and quickly determine the scope of an intrusion.

  • 26 Oct 2026
  • Timothy Tate

passwords.txt: Using Notepad and SmartScreen to Oracle Account Passwords

Research PaperOffensive Operations

Enhanced Phishing Protection (EPP) is designed to reduce credential theft by detecting unsafe password entry and providing additional security telemetry within Windows.

  • 20 Oct 2026
  • Derrick Shaw

When DLP Falls Short: Measuring Network Microsegmentation as a Compensating Control for AI Data Exfiltration

Research PaperArtificial Intelligence, Cyber Defense

Effective protection against AI-assisted data exfiltration requires a combination of advanced content-aware defenses and application-independent network-layer enforcement.

  • 19 Oct 2026
  • Travis Gullickson

Mitigating Multi-Factor Authentication Bypass Attacks: Enforcing Phishing-Resistant Authentication and Workload Identity Controls in Microsoft Entra ID

Research PaperCyber Defense

Modern cloud perimeter security relies on multi-factor authentication (MFA) to safeguard enterprise directories and protect administrative access.

  • 14 Oct 2026
  • Nitin Aggarwal

Bits and Chunks of Evidence with AI

Research PaperArtificial Intelligence

Digital forensic examiners are turning to locally run large language models (LLMs) for the data privacy and chain-of-custody guarantees that cloud AI cannot offer.

  • 14 Oct 2026
  • Michael Miglianti

Contextual Vulnerability Prioritization at Scale: Directing Limited Remediation Resources Through CVSS Environmental Scoring and AI-Assisted Remediation Bundling

Research PaperOffensive Operations

The research described in this paper evaluates a pipeline designed to close that gap. It applies CVSS v3.1 Environmental and Temporal attributes to vulnerability findings and recalculates the assigned severity to reflect the true risk a vulnerability poses to the business.

  • 12 Oct 2026
  • Carlos Raygada

Orbital Forensics: An Investigation into Forensics in a Simulated Space Environment

Research PaperArtificial Intelligence

This study represents the first systematic empirical measurement of the impact of forensic collection techniques on cFS real-time scheduling, providing evidence-based guidance for incident responders operating on systems where mission survival is essential.

  • 12 Oct 2026
  • Kenneth Zellmer

Quantifying Agentic Misalignment in Multi-Agent Systems

Research PaperOffensive Operations

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • Vasu Koduru

Invisible by Default: The Polyglot Smuggler

Research PaperOffensive Operations

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • John Porpora

Rethinking Full Packet Capture: Evaluating IDS-Triggered PCAP

Research PaperCyber Defense

Enterprise Network Security Monitoring (NSM) solutions generate massive volumes of traffic. However, most organizations cannot sustain full packet capture (PCAP) due to insufficient storage capacity, processing power, and administrative resources.

  • 28 Sep 2026
  • Zachary Gaster

DeScrypt: A Multi-Tool Framework for Automated Unpacking and Analysis of Malicious Scripts

Research PaperDigital Forensics and Incident Response, Cyber Defense

Scripting languages are increasingly dominant malware vectors that often employ layered obfuscation techniques to slow down manual analysis by reverse engineers and to prevent pattern recognition.

  • 28 Sep 2026
  • Daniel Schalla