ESSOS is accepting submissions of abstracts until the 25th and of research papers until October 2nd. We are happy to announce that both David Basin and Karsten Nohl will be presenting as invited speakers! Also, for the first time in the security community, ESSOS this year will offer a voluntary artifact evaluation! Read more in the full CFP below.
International Symposium on Engineering Secure Software and Systems (ESSoS)
April 6 – 8, 2016, Royal Holloway, London, UK
In cooperation with (pending): ACM SIGSAC and SIGSOFT
Context and motivation
Trustworthy, secure software is a core ingredient of the modern world. So is the Internet. Hostile, networked environments, like the Internet, can allow vulnerabilities in software to be exploited from anywhere. High-quality security building blocks (e.g., cryptographic components) are necessary but insufficient to address these concerns. Indeed, the construction of secure software is challenging because of the complexity of modern applications, the growing sophistication of security requirements, the multitude of available software technologies and the progress of attack vectors. Clearly, a strong need exists for engineering techniques that scale well and that demonstrably improve the software’s security properties.
Goal and setup
The goal of this symposium, which will be the eighth in the series, is to bring together researchers and practitioners to advance the states of the art and practice in secure software engineering. Being one of the few conference-level events dedicated to this topic, it explicitly aims to bridge the software engineering and security engineering communities, and promote cross-fertilization. The symposium will feature two days of technical program including two keynote presentations. In addition to academic papers, the symposium encourages submission of high-quality, informative industrial experience papers about successes and failures in security software engineering and the lessons learned. Furthermore, the symposium also accepts short idea papers that crisply describe a promising direction, approach, or insight.
Topics
The Symposium seeks submissions on subjects related to its goals. This includes a diversity of topics including (but not limited to):
– Cloud security, virtualization for security
– Mobile devices security
– Automated techniques for vulnerability discovery and analysis
– Model checking for security
– Binary code analysis, reverse-engineering
– Programming paradigms, models, and domain-specific languages for security
– Operating system security
– Verification techniques for security properties
– Malware: detection, analysis, mitigation
– Security in critical infrastructures
– Security by design
– Static and dynamic code analysis for security
– Web applications security
– Program rewriting techniques for security
– Security measurements
– Empirical secure software engineering
– Security-oriented software reconfiguration and evolution
– Computer forensics
– Processes for the development of secure software and systems
– Security testing
– Embedded software security
Important dates
Abstract submission: September 25, 2015 (anywhere on earth)
Paper submission: October 2, 2015 (anywhere on earth)
Paper notification: December 7, 2015
Artifact evaluation submission: December, 16, 2015
Artifact evaluation notification: January, 6, 2016
Paper camera-ready: January 8, 2016
Submission and format
The proceedings of the symposium are published by Springer-Verlag in the Lecture Notes in Computer Science Series (http://www.springer.com/lncs). Submissions should follow the formatting instructions of Springer LNCS. Submitted papers must present original, unpublished work of high quality.
Two types of papers will be accepted:
Full papers (max 14 pages without bibliography/appendices)
Such papers may describe original technical research with a solid foundation, such as formal analysis or experimental results, with acceptance determined mostly based on novelty and validation. Or they may describe case studies applying existing techniques or analysis methods in industrial settings, with acceptance determined mostly by the general applicability of techniques and the completeness of the technical presentation details.
Idea papers (max 8 pages with bibliography)
Such papers may crisply describe a novel idea that is both feasible and interesting, where the idea may range from a variant of an existing technique all the way to a vision for the future of security technology. Idea papers allow authors to introduce ideas to the field and get feedback, while allowing for later publication of complete, fully-developed results. Submissions will be judged primarily on novelty, excitement, and exposition, but feasibility is required, and acceptance will be unlikely without some basic, principled validation (e.g., extrapolation from limited experiments or simple formal analysis). In the proceedings, idea papers will clearly identified by means of the “Idea” tag in the title.
Artifact evaluation
For possibly the first time at a security conference, ESSOS’16 will offer a voluntary artifact evaluation. Artifact evaluation is meant to encourage the submission and publication of proven, reusable research artifacts. Authors of accepted papers will be able to apply their artifacts (software, datasets, etc.) to be examined by the Artifact Evaluation Committee (AEC). Artifacts will be submitted after paper notification. If all artifacts perform to the satisfaction of the committee, in particular if they allow for the paper’s results to be reproduced, then the paper will be recognized with the Artifact Evaluation Award and the authors will enjoy the following benefits:
- Authors will be able to mention the award on the paper’s front page, in the form of a virtual award plaque.
- Awarded artifacts will be recognized on the conference web page.
- Authors can use one additional page in the proceedings, which can be used to describe their artifacts.
- Authors will be able to briefly present their awarded artifacts in a dedicated artifact session (in addition to their usual paper presentation).
Artifact evaluation submissions will be mainly evaluated based on two criteria: (1) Artifact packaging and reproducibility. (2) Artifact implementation and usability.
More information is available on the ESSOS web page. More information about previous artifact evaluations can be found at: http://www.artifact-eval.org/
Important dates:
Artifact evaluation submission: December 16, 2015
Artifact evaluation notification: January 6, 2016
Confirmed invited speakers
Apart from technical presentations, the following invited speakers have confirmed their participation in ESSOS:
- David Basin, ETH Zürich
- Karsten Nohl, Security Research Labs
Steering committee
Jorge Cuellar (Siemens AG)
Wouter Joosen (Katholieke Universiteit Leuven) – chair
Fabio Massacci (Università di Trento)
Gary McGraw (Cigital)
Bashar Nuseibeh (The Open University)
Daniel Wallach (Rice University)
Organizing committee
General chair: Lorenzo Cavallaro (Royal Holloway University of London)
Program co-chairs: Eric Bodden (Fraunhofer SIT & TU Darmstadt), Juan Caballero (IMDEA Software Institute)
Artifact evaluation co-chairs: Alessandra Gorla (IMDEA Madrid), Jacques Klein (SnT Luxembourg)
Publication chair: Elias Athanasopoulos (FORTH)
Publicity chair: Raoul Strackx (KU Leuven)
Web chair: Ghita Saevels (Katholieke Universiteit Leuven)
Program committee
Javier Alonso, Universidad de Leon & Duke University
Michele Bugliesi, Università Ca’ Foscari Venezia
Werner Dietl, University of Waterloo
Michael Franz, University of California, Irvine
Flavio Garcia, University of Birmingham
Christian Hammer, CISPA, Saarland University
Marieke Huisman, University of Twente
Martin Johns, SAP Research
Stefan Katzenbeisser, Technische Universität Darmstadt
Johannes Kinder, Royal Holloway University of London
Andy King, University of Kent
Jacques Klein, University of Luxembourg
Andrea Lanzi, University of Milan
Wenke Lee, Georgia Institute of Technology
Zhenkai Liang, National University of Singapore
Ben Livshits, Microsoft Research
Heiko Mantel, Technische Universität Darmstadt
Nick Nikiforakis, Stony Brook University
Martin Ochoa, Singapore University of Technology and Design
Mathias Payer, Purdue University
Frank Piessens, KU Leuven
Alexander Pretschner, Technische Universität München
Awais Rashid, Lancaster University
Mark Ryan, University of Birmingham
Gianluca Stringhini, University College London
Pierre-Yves Strub, IMDEA Software Institute
Helmut Veith, Vienna University of Technology
Santiago Zanella, Microsoft Research – INRIA
Cross-posted from SEEBlog
I was just able to confirm Karsten Nohl as an invited speaker for 
At this year Black Hat Europe conference, we will talk about our Backend-As-A-Service investigation, which we 
Yesterday our center was visited by the two federal ministers Wanka (minister of education and research) and De Maiziere (minister of the interior). They spent a few hours, discussing IT-security research in Darmstadt’s – as they coined it – “security valley”, and also educated themselves through a range of exhibits we had prepared on the security of the Internet of Things, but also mobile security, encryption etc. 
