Research
Through its core and affiliated labs, including the Wolfpack Security and Privacy Research (WSPR) Lab, the Secure Software Supply Chain Center (S3C2), the HECTOR Lab for hardware cyberthreats, and the new BRAINSPEC Lab exploring brain-inspired AI for secure computing, SCI is advancing research in software supply chain resiliency, quantum-resistant cryptography, AI/ML hardware security, IoT protection, federated learning defenses, and privacy-preserving blockchain technologies.
Backed by multi-million-dollar grants from the NSA, NSF, and industry partners, SCI is expanding the scientific foundations of cybersecurity and driving solutions into practice for national security and global markets.
SCI’s research ecosystem directly enriches education at NC State, shaping curriculum design, creating new courses, and offering students hands-on research experiences with real-world partners. This integration of cutting-edge research and workforce development ensures that SCI graduates enter the workforce ready to tackle emerging threats.
Through interdisciplinary collaboration, groundbreaking innovation, and a commitment to societal impact, the Secure Computing Institute has established itself as a national leader in cybersecurity research and education. SCI advances technologies and practices that protect our digital future.
Research Overview
Research Areas
AI & Agent Security
SCI research studies the security and trust challenges created by modern AI systems, as well as ways AI can support security analysis. This area includes current and emerging directions across agentic systems, AI-assisted vulnerability discovery, adversarial use of AI, federated learning defenses, and AI components in software and hardware supply chains.
AI for Security
SCI researchers study how AI systems can support security analysis, including LLM-assisted detection of malicious packages, scams, vulnerable functions, hardware security weaknesses, and security or privacy concerns in software and user-facing ecosystems.
Agentic Systems Security
SCI research explores emerging security questions around AI agents and AI-enabled workflows, including tool use, delegated actions, software development support, trust boundaries, transparency, and misuse-resistant system design.
Offensive & Adversarial AI
SCI research considers how adversaries can use or attack AI systems, including AI-enabled scams, malicious automation, adversarial machine learning, and the security implications of generated code, content, and software artifacts.
Federated Learning
Federated learning allows users or organizations to improve learning performance with peers without exposing their own datasets. SCI research focuses on resilient federated learning schemes that defend against tampering, Byzantine attacks, and model inversion attacks while maintaining learning performance.
Software Supply Chain Security
SCI highlights software supply chain security through the Secure Software Supply Chain Center (S3C2), an NSF-funded, multi-institution research effort focused on securing how software is packaged, built, distributed, deployed, and maintained. SCI researchers develop methods, tools, metrics, and data formats that help practitioners manage supply chain risk while accounting for the human workflows of open source maintainers, developers, and downstream users.
Open Source Security
SCI research studies the security and trust challenges of open source ecosystems, including dependency management, contributor trust, vulnerability metadata, package repositories, reproducible builds, and the human workflows that shape software maintenance and response.
Dependency & Build Security
SCI research studies security risks in dependencies, package repositories, build systems, and deployment pipelines. This includes malicious package detection, pairing security advisories with vulnerable code, dependency risk analysis, build integrity, reproducible packaging, and defenses that help prevent compromised software components from reaching downstream projects.
Software Provenance & Transparency
SCI research develops methods for understanding where software components come from and how they change from source through deployment. This work includes software bills of materials, build attestations, package and vulnerability metadata, reproducibility, and transparency mechanisms that help organizations evaluate software integrity and supply chain risk.
Systems & Software Security
SCI systems and software security research focuses on the platforms, applications, and runtime environments that people and organizations depend on. This work spans cloud infrastructure, operating systems, mobile platforms, IoT environments, program analysis, isolation, and practical defenses for deployed software.
Cloud Security
A significant amount of computation and storage is outsourced to public clouds. SCI research designs security architectures that add new security capabilities to cloud environments, including hypervisor-based cloud introspection for enhanced forensics and elastic cloud defenses that improve resiliency against network-based attacks.
Platform & OS Security
SCI research examines security mechanisms in operating systems, application platforms, and runtime environments, including access control, isolation, program analysis, reverse engineering, and platform-level protections for applications and users.
Vulnerability Analysis
SCI research uses static and dynamic analysis to discover vulnerabilities in software applications and platforms. Efforts include reverse engineering, formal modeling of security requirements, vulnerability prediction, security metrics, exploitability assessment, and large-scale studies of software ecosystems.
Mobile Security
Mobile devices are a primary computing platform for many users. SCI research has advanced mobile platform and application security through static and dynamic analysis tools for Android applications, reverse engineering and formal modeling of platform access control, generalized security frameworks for Android, and methods for incorporating strong Information Flow Control guarantees.
IoT Security
Internet of Things devices pose security challenges because of their heterogeneity, scale, and resource constraints. SCI research includes network-based defenses for smart home users, frameworks for transparency and protection, and studies of design flaws in how smart home devices report telemetry and state.
Network, Web & Communications Security
SCI research in network, web, and communications security studies the connected systems that carry modern computation, communication, identity, and measurement. This area includes Internet and telephone networks, web platforms, browser behavior, large-scale attacks, and security risks in critical communications infrastructure.
Cellular and Telephone Network Security
The world relies on cellular and telephone systems for secure communication and identity establishment. SCI researchers study security risks in telephony systems, ranging from robocalls to insecure VoIP systems, using expertise from signal processing, digital communications, data science, machine learning, statistics, cryptography, program analysis, reverse engineering, and Internet and telephone networks. Example work includes privacy-preserving telephone call traceback systems that can help investigators identify abusive call origins while limiting exposure of call parties and carrier-sensitive information.
Network Security
SCI research seeks to better understand network security through empirical measurements and network architectural defenses. Example efforts include using Software Defined Networking to build distributed information flow protections for enterprises and new models for adaptively isolating IoT smart home devices.
Web Security and Privacy
SCI research seeks to understand how the web works, how it evolves, and how it can be made safer for users. Efforts range from secure browser architectures to measuring large-scale Internet attacks and building instrumented browsers for studying how online trackers evolve.
Critical Infrastructure Security
SCI research addresses security risks in systems that society depends on, including telecommunications, cloud services, open-source software infrastructure, build and deployment pipelines, and other computing foundations used by critical organizations. This area connects existing SCI work in vulnerability discovery, measurement, secure system design, and practical defenses for infrastructure-scale environments.
Hardware Security
SCI research studies how hardware roots of trust can be compromised and how computing systems can be protected. This work includes processors, microarchitecture, embedded systems, firmware, AI accelerators, memory systems, hardware/software interfaces, post-quantum implementations, and secure implementations for resource-constrained systems.
Microarchitecture & Processor Security
SCI research studies security risks in processor microarchitecture, memory systems, hardware accelerators, and hardware/software interfaces, including vulnerabilities that affect confidentiality, integrity, performance, and power efficiency.
Side Channels & Fault Injection
SCI research investigates side-channel leakage, fault injection attacks, physical attacks, and defenses for hardware and embedded systems, including secure design methods and verification techniques.
Secure AI/ML Hardware
SCI research investigates secure and efficient hardware support for AI and machine learning, including AI accelerators, hardware-aware model security, side-channel and fault-injection resistance, and architectures that balance security, performance, and power efficiency.
Privacy & Human-Centered Security
SCI privacy research spans mobile devices, Internet of Things systems, web tracking, voice assistants, VR, online tracking, fingerprinting, traffic analysis, inference attacks, anonymity networks, and user-facing transparency. This work includes privacy-sensitive data use and defenses that improve user control.
Digital Safety
SCI research studies security, privacy, and safety risks in emerging user-facing ecosystems, including voice assistants, VR, generative AI applications, scams, and technologies that shape how people understand and control personal data.
Web Tracking & Fingerprinting
SCI research measures and mitigates online tracking, browser fingerprinting, traffic analysis, and other web privacy risks, including how trackers adapt as browser platforms and privacy defenses evolve.
AI Privacy
SCI research studies privacy risks in AI-enabled systems, including inference attacks, model inversion, data leakage, user transparency, and the ways generative AI changes privacy expectations in deployed computing systems.
Developer-Centered Security
SCI research studies how software professionals design, build, maintain, and deploy secure systems. This work examines developer workflows, security tools, open source maintenance, vulnerability response, and the practical constraints that shape secure software engineering.
Usable Security & Privacy
SCI research investigates how security and privacy mechanisms interact with real users, workflows, constraints, and decision making. This includes transparency, control, privacy notices, software expert behavior, and security or privacy experiences in emerging technologies.