Skip to main content

Cybersecurity Research Papers

Master's degree candidates at SANS.edu conduct research that is relevant, has real world impact, and often provides cutting-edge advancements to the field of cybersecurity, all under the guidance and review of our world-class instructors.

Learn About the Master's Degree Program
Showing 12 of 788

Mitigating Multi-Factor Authentication Bypass Attacks: Enforcing Phishing-Resistant Authentication and Workload Identity Controls in Microsoft Entra ID

Research PaperCyber Defense

Modern cloud perimeter security relies on multi-factor authentication (MFA) to safeguard enterprise directories and protect administrative access.

  • 14 Oct 2026
  • Nitin Aggarwal

Bits and Chunks of Evidence with AI

Research PaperArtificial Intelligence

Digital forensic examiners are turning to locally run large language models (LLMs) for the data privacy and chain-of-custody guarantees that cloud AI cannot offer.

  • 14 Oct 2026
  • Michael Miglianti

Contextual Vulnerability Prioritization at Scale: Directing Limited Remediation Resources Through CVSS Environmental Scoring and AI-Assisted Remediation Bundling

Research PaperOffensive Operations

The research described in this paper evaluates a pipeline designed to close that gap. It applies CVSS v3.1 Environmental and Temporal attributes to vulnerability findings and recalculates the assigned severity to reflect the true risk a vulnerability poses to the business.

  • 12 Oct 2026
  • Carlos Raygada

Orbital Forensics: An Investigation into Forensics in a Simulated Space Environment

Research PaperArtificial Intelligence

This study represents the first systematic empirical measurement of the impact of forensic collection techniques on cFS real-time scheduling, providing evidence-based guidance for incident responders operating on systems where mission survival is essential.

  • 12 Oct 2026
  • Kenneth Zellmer

Quantifying Agentic Misalignment in Multi-Agent Systems

Research PaperOffensive Operations

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • Vasu Koduru

Invisible by Default: The Polyglot Smuggler

Research PaperOffensive Operations

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • John Porpora

Rethinking Full Packet Capture: Evaluating IDS-Triggered PCAP

Research PaperCyber Defense

Enterprise Network Security Monitoring (NSM) solutions generate massive volumes of traffic. However, most organizations cannot sustain full packet capture (PCAP) due to insufficient storage capacity, processing power, and administrative resources.

  • 28 Sep 2026
  • Zachary Gaster

DeScrypt: A Multi-Tool Framework for Automated Unpacking and Analysis of Malicious Scripts

Research PaperDigital Forensics and Incident Response, Cyber Defense

Scripting languages are increasingly dominant malware vectors that often employ layered obfuscation techniques to slow down manual analysis by reverse engineers and to prevent pattern recognition.

  • 28 Sep 2026
  • Daniel Schalla

Evaluating the Impact of Log Configuration on Lateral Movement Detection Using Windows Event Logs

Research PaperCyber Defense

These findings demonstrate that effective endpoint logging depends not only on the amount of telemetry collected but also on the configuration and filtering strategy.

  • 22 Sep 2026
  • Michael Dobbs

Bot or Not? Detecting AI-Driven Web Traffic Using Network Metadata Analysis

Research PaperCyber Defense, Artificial Intelligence

This detection method is lightweight, non-intrusive, and easily integrated into existing security toolsets, offering defenders a scalable alternative to traditional bot detection and mitigation techniques.

  • 22 Sep 2026
  • William Hatfield

Continuous Enforcement vs Out-of-Band Validation: Mitigating Configuration Drift on Windows Server 2022 with Automated Remediation Loops

Research PaperCyber Defense

This paper examines the persistent issue of configuration drift within enterprise data centers, where routine administration, patches, and user activity silently degrade established security postures between scheduled audits.

  • 22 Sep 2026
  • Christopher Sandoval

WAFstat: External Verification of WAF Enforcement Posture: Measuring Observable WAF Enforcement Beyond Presence Fingerprinting

Research PaperCyber Defense

This study presents WAFstat, a lightweight external verification method that combines a fixed, versioned marker corpus with response-shape baselines, configuration validation, and immutable provenance.

  • 22 Sep 2026
  • Tiago Kiill