Historically, the high latency of storage devices masked the impact of software overheads in the storage stack. However, with the advent of microsecond-scale storage devices, the performance cost of adding new software layers has become more significant. In particular, integrating cryptographic operations into file systems that run on low-latency devices poses substantial challenges. This paper investigates the application of ahead-of-time and speculative encryption techniques to in-kernel file systems, tailored for modern storage devices. Our experimental results demonstrate that these techniques significantly improve both latency and throughput, outperforming current cryptographic file systems.
As the importance of software security escalates, identifying and addressing source code vulnerabilities becomes essential to maintaining robust and trustworthy systems. Static Application Security Testing (SAST) tools play a vital role in detecting potential weaknesses, yet their high false-positive rates often burden developers with time-consuming manual verification–risking both inefficiencies and unintended functional changes during remediation. This research introduces LogiSec of Thoughts, a novel, prompt-driven reasoning framework designed to improve the triage of vulnerabilities identified by SAST tools. Rooted in the classical Reductio ad Absurdum method, LogiSec of Thoughts guides a Large Language Model (LLM) through a structured four-step reasoning process to evaluate the plausibility of each vulnerability. By attempting to refute the existence of the vulnerability and reasoning through contradictions, the model is prompted to critically assess whether the issue is logically and contextually sound. This methodology operates independently of external expert systems and is adaptable for integration into secure development pipelines. By reducing false positives and improving the prioritization of actionable security issues, LogiSec of Thoughts offers a promising step toward intelligent, automated code security assessment.
The growing adoption of programmable network architectures, such as ONF’s SD-Fabric, has introduced new levels of flexibility, automation, and control into modern infrastructures. Leveraging P4-programmable data planes, centralized SDN control, and in-band telemetry, these architectures are well-suited to meet the stringent requirements of dynamic, cloud-native, and edge computing environments. However, ensuring service reliability, performance, and compliance with strict Service Level Agreements (SLAs) remains a complex challenge, particularly under high traffic dynamics and resource variability. Within this context, this paper presents a PhD research project that proposes a Forecasting-Oriented Management framework for SD-Fabric environments, combining in-band telemetry, AI-based forecasting, and a hierarchical distributed control strategy to anticipate and mitigate SLA violations. The solution proactively identifies network risks, such as failures, bottlenecks, and resource constraints, enabling intelligent decisions on traffic engineering and resource reallocation. Initial experiments, conducted in an emulated environment using P4-programmed switches and a simulated control layer, allowed comprehensive testing under varied traffic and failure scenarios. These preliminary results demonstrate the potential of the proposed approach to enhance SLA compliance and improve the resilience and efficiency of programmable network fabrics.
Recently proposed consensus protocols make use of the network layer to ensure agreement, while the application layer is still used for termination. Those protocols employ the network layer as a sequencer that delivers ordered messages facilitating agreement. However, tolerating a malicious sequencer is a challenging task. For instance, a malicious sequencer can assign the same sequence number to different messages and send them to different replicas. To avoid this problem, the NeoBFT consensus protocol adds an additional communication step at the replicas. Although this approach mitigates the problem, it negatively impacts system performance by requiring an additional synchronization step among replicas before executing requests. This work proposes NsoBFT (Network Secure Ordered BFT), a consensus protocol that uses a secure message ordering service implemented with USIG (Unique Sequential Identifier Generator), a secure component in the network layer. Thus, no additional synchronization step is necessary for the replicas to execute requests. Experimental results comparing NsoBFT with related work show the advantage of this strategy, in particular confirming that NsoBFT outperforms NeoBFT.
Virtual machine introspection (VMI) has been widely used for stealthy monitoring of guest systems. However, context switching between monitoring system and monitored target introduces considerable overhead, especially for tracing common system calls, and deployment of VMI-based setups is complex. This work investigates whether extended Berkeley Packet Filter (eBPF) based tracing, a low-overhead kernel-level monitoring technique, can serve as an alternative. We compare the two paradigms in terms of performance, stealthiness, and practical applicability. Using micro-benchmarks and a prototype high-interaction SSH honeypot, we evaluate the capabilities and limitations of eBPF-based monitoring in adversarial settings. Our results highlight advantages and limitations of both, providing insights for the design of future security monitoring systems.
