Young Researchers´ Day @ ICT Security Conference 2026 – Recap

A group of dedicated young researchers presented their work at the 22st ICT Security Conference on 16 and 17 September 2026, which was organized by the Austrian Armed Forces.

They impressed the audience with their research work as part of their final theses. The OCG IT Security Working Group, headed by Ingrid Schaumüller-Bichl and Edgar Weippl, organized the presentations of the young researchers in cooperation with us again this year. The YRD successfully demonstrates the continuous efforts to ensure security in all areas.

1st Conference Day

Evaluation of Drone Radio Security: ExpressLRS Protocol Analysis Using Low-Cost SDR

Philipp-Sebastian Vogt (AIT)

This thesis investigates how psychological and behavioral topics can be integrated into IT security degree programs at Austrian higher education institutions in order to effectively address the human factor in information security. The study is based on the finding that the human factor plays a central role in information security, yet is often insufficiently addressed in the curricula of such degree programs. A mixed-methods approach was employed, comprising a quantitative analysis of curricula, a qualitative content analysis of expert interviews, and the development of a competency framework. The results show that social competencies account for an average of only 3.59% of the ECTS credits in these degree programs, while awareness-specific content is even less represented, accounting for only approximately 0.45%.

The interview findings indicate that, among other factors, a lack of interdisciplinarity, limited resources, and the low perceived value of social competencies constitute significant barriers to their integration. Based on these findings, a competency model was developed to serve as a guideline for higher education institutions seeking to systematically integrate social competencies into IT security degree programs. The thesis concludes with recommendations for a practice-oriented approach to teaching these competencies in order to optimally prepare graduates for the challenges of information security.

The Advances in Intellectual Property Protection in Open Data Sharing

Tanja Šarčević (SBA Research)

The growing value of structured data creates a need for mechanisms that protect ownership and enable accountability after authorised sharing. Digital fingerprinting addresses this by embedding recipient-specific information into distributed datasets so that leaked copies can later be traced to their source. For tabular data, however, this is difficult because datasets contain different data types, limited redundancy, and relationships that may be damaged by small changes. This dissertation examines how such fingerprints can remain reliable without reducing the usefulness of the data. It develops a consistent way to assess whether fingerprints can be detected correctly, whether data remains accurate and useful, and whether protection survives modification. It also introduces NCorr-FP, a method designed to preserve meaningful relationships within mixed-type datasets. Finally, the dissertation studies how users might try to remove or hide fingerprints and proposes ways to strengthen protection. Together, these contributions support safer, more accountable sharing of structured data, the cornerstone of the modern data analysis.

A Decentralized IDS for Detecting Stealthy Industrial Process Cyber Attacks

Olaf Saßnick (FH Salzburg)

Stealthy cyber attacks targeting industrial processes are challenging to detect because they are often initiated from trusted devices and consist of low-frequency, carefully planned interactions that nearly disappear in normal system operation. Existing published intrusion detection approaches mainly focus on anomaly detection in multivariate time-series data. While this is effective for identifying deviations in physical process behavior, like mechanical degradation, such methods often detect only the early consequences of a cyber attack that has already started. Unlike traditional IT environments, operational technology (OT) systems exhibit highly deterministic communication patterns, where interactions follow predefined sequences and timing constraints. Learning both the communication sequences and their associated timing characteristics enables the identification of small communication deviations introduced by stealthy attacks, even when the communicated messages themselves are valid and originate from trusted devices. The idea at core is a decentralized, lightweight intrusion detection system (IDS) embedded directly within OPC UA servers deployed on industrial controllers. Operating at the semantic communication layer, the IDS observes decrypted OPC UA interactions and learns both communication sequences and the timing of events. This way it provides an early detection for low-frequency attacks that are hardly visible for conventional network- and timeseries-based detection mechanisms. Additionally, the decentralized deployment architecture improves scalability and introduces only a low overhead on each device.

2nd Conference Day

User Simulation and Traffic Generation in Cyber Ranges

Christoph Dorner (USTP)

The generation of realistic background activity and user behavior remains a persistent challenge in the design of cyber exercises, as limited realism can reduce the validity of training and evaluation environments. This paper investigates the feasibility of different approaches for simulating user interactions and generating representative network traffic, ranging from deterministic Python-based automation to adaptive agent-driven workflows supported by large language models

Secure Embedded Sensor Systems with Remote Attestation

Maximilian Arthofer (JKU)

With the most populous countries on the planet relying on biometric identity systems (e.g. China, India) and a push towards digital identities within the EU (e.g. EUID), it is important to consider how and where the data linked to these digital identities is handled. Centralized sets of identifying data lend them- selves to abuse, necessitating their decentralized storage. This is exactly what Project Digidow aims to provide: a distributed, scalable biometric authentica- tion system. To offer its services, Digidow relies on a fleet of sensors which users have to present their biometric profiles to. Implicitly trusting that these sensors are trustworthy is potentially dangerous because sensitive data could be passed to malicious actors. This thesis aims to bridge this gap, by enabling the sensors to perform remote attestation. Using this process, they gain the ca- pability of providing evidence to users and their agents, that they are currently in a known state. Based on this, sensor manufacturers can provide reference values for trustworthy sensor states, which users can then use to derive trust from the evidence they received. This thesis shows how attestation can be done using off-the-shelf hardware like a Raspberry Pi, while also highlighting the inherent limitations of such an implementation and how to potentially over- come them. The practical output provides all the necessary code changes and additions to existing Digidow components to run such an attestation in a secure and trustworthy manner.

Invisible Watermarks for the Detection and Attribution of Generated Images

Yana Sakhnovych (University of Vienna/TU Vienna)

Advances in generative AI are making synthetic images increasingly realistic, making them more difficult to distinguish from authentic photographs. While this development opens up many exciting opportunities, it also introduces significant risks, including disinformation, deepfakes, and attacks on biometric authentication systems such as Face ID. Consequently, reliable methods for detecting and attributing generated content are becoming increasingly important.

Existing approaches can be divided into two categories: reactive methods, which distinguish real from synthetic content based on artifacts or other unintended characteristics introduced during the generation process, and proactive methods, which deliberately embed invisible watermarks into images, either during or after generation.

Watermarks offer two major advantages over reactive detection methods. First, reactive approaches may lose their effectiveness in the long term as generative models continue to improve and characteristic artifacts increasingly disappear or are deliberately minimized. Second, certain watermarking methods allow additional provenance information to be embedded, such as the model used, the generating instance, or the user responsible for an image generation service, thereby enabling the content to be traced back to its source.

Side-Channel Attacks and Defenses beyond Capability Reduction

Stefan Gast (TU Graz)

Modern computer systems and networks implement various security mechanisms to protect secret and privacy-sensitive information from unauthorized access. Despite these measures, attackers can still extract sensitive information via side channels. In a side-channel attack, an attacker infers secret information from metadata that is observable as a side-effect of processing that information, such as energy consumption, timing differences and network traffic shapes. To mitigate these attacks, current systems often attempt to make the side channel more difficult to observe, by restricting potential attackers from accessing certain interfaces or by blocking code execution. However, despite these capability reductions, attackers can still obtain useful meta information by measuring the side channel more indirectly, as the root cause of the side-channel is still present.

In this talk, we demonstrate why capability reductions can be insufficient to mitigate side-channel attacks. Focusing on our own research results, we cover a large spectrum common threat models in side channels attacks and give examples of how attackers with varying privileges can obtain sensitive information, ranging from powerful attackers controlling a malicious hypervisor, over attacks from native and sandboxed code, to fully remote attacks. As a case in point for a weak low-privilege attacker, we demonstrate a fully remote website- and video-fingerprinting attack via only a TCP connection, working without any attacker code on the victim system and without an attacker-in-the-middle. Additionally, we discuss how the attacker can use this for targeted, automated attacks without requiring any user interaction and how these attacks can be mitigated.

It is encouraging to see that with the YRD, young people are demonstrating their intense work to ensure our collective security.

We extend our heartfelt thanks to the OCG IT Security Working Group and the ICT Security Conference administration for their unwavering support of these young researchers and their contributions.

We also want to express our gratitude to all the participating universities for sending their top talents to the conference. Thanks to their support, many security experts will be able to witness firsthand the significant impact that research has on the field and how it helps to address new challenges in the IT sector.

All pictures © SBA Research.