As cyber threats grow more sophisticated by the day, UC Riverside researchers are making computing safer thanks to research that targets some of the internet’s most pressing security challenges.

UCR computer science and engineering students and faculty in the Marlan and Rosemary Bourns College of Engineering are developing tools to expose hidden vulnerabilities, protect private data, and strengthen the digital defenses that safeguard everything from personal communications to national infrastructure.

Their work is on the forefront of cybersecurity innovation—and underscores the critical role of federal investment in higher education research.

“Cybersecurity impacts every aspect of our lives, from personal privacy to national security. At UC Riverside, with support from federal grants, we’re training the next generation of computer scientists and engineers who are already making the internet and IT systems safer for everyone,” said Amit Roy-Chowdhury, a Bourns professor and co-director of the UC Riverside Artificial Intelligence Research and Education (RAISE) Institute.

Here are examples of computer security innovations published and presented at conferences this year:

Protecting data in AI learning

As artificial intelligence spreads into health care, finance, and government, privacy is paramount. But UCR graduate student Hasin Us Sami discovered that even methods designed to keep sensitive information safe can be compromised.

His paper, “Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning”, posted to the arXiv preprint server, shows that adversaries can reconstruct private images from a training process called federated learning that was thought to be safer. Federated learning lets users train AI models on their own devices without sharing raw data.

For example, several hospitals may want to team up to develop AI models that detect diseases from patient tissue image scans. The research found that attackers could reverse-engineer data from the information that is shared and demonstrated how malicious servers could retrieve private images during training from state-of-the-art learning architectures, underscoring the urgent need for stronger defenses. The work was recognized at the 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition, one of the top gatherings of AI researchers.

His paper was co-authored by graduate student Swapneel Sen, professors Amit K. Roy-Chowdhury and Srikanth V. Krishnamurthy, and assistant professor Basak Guler.

Unmasking firewall weaknesses

Research by graduate student Qing Deng focused on firewalls that millions rely on for protection. In the paper “Beyond the Horizon: Uncovering Hosts and Services Behind Misconfigured Firewalls,” published in the 2025 IEEE Symposium on Security and Privacy (SP), Deng and colleagues revealed that small configuration mistakes could open the door to cyber intruders.

By scanning the internet for unusual access points, Deng uncovered more than 2 million hidden services exposed by misconfigured firewalls—ranging from outdated servers to vulnerable home routers. These flaws, though overlooked for years, create what the team calls an “expanded observable internet,” a larger attack surface than security experts previously realized. The paper was co-authored by graduate students Juefei Pu, Zhaoweo Tan, and professors Zhiyun Qian and Srikanth V. Krishnamurthy.

Detecting invisible network flaws

For doctoral student Keyu Man, the threat of invisible “side-channel” attacks is a high priority. These attacks exploit subtle quirks in network protocols to allow hackers to hijack connections in a commonly used kind of server.

Known as “domain name system” servers, these computers translate human-friendly domain names into machine-readable IP addresses, allowing devices to find and connect to the right server.

Man co-authored the paper “SCAD: Towards a Universal and Automated Network Side-Channel Vulnerability Detection,” also published in the 2025 IEEE Symposium on Security and Privacy (SP), which introduces a tool called Side-ChAnnel Detector, or SCAD, to automatically uncover weaknesses in widely used operating systems like Linux and FreeBSD. Unlike previous methods that required weeks of painstaking manual work, SCAD can identify flaws in a single day of analysis.

Man’s research revealed 14 vulnerabilities—seven previously unknown—that could have been exploited for devastating cyberattacks. By automating the process, SCAD could change how industry protects critical online infrastructure.

The co-authors of this study include graduate students Zhongjie Wang, Yu Hao, Shenghan Zheng, Xin’an Zhou, Yue Cao, and professor Zhiyun Qian.

A report produced for the government has today set out nine core recommendations for how the UK can strengthen its burgeoning cyber security sector to fuel resilience and growth across the economy.

Written by experts at Imperial College London (ICL) and the University of Bristol, and drawing on consultations with nearly 100 members of the cyber community, the UK cyber growth action plan slots into the government’s Modern Industrial Strategy, and will feed into an ongoing refresh of the National Cyber Strategy.

The report says that although the UK’s cyber sector remains on an upward trajectory, with jobs and revenue both rising by over 10% and gross value added (GVA) by over 20% in the past 12 months, taken as a whole, cyber is still undervalued. It describes “significant untapped potential” to go further still.

“The cyber security sector in the UK has significant growth potential, and there are clear roles for both government and the private sector identified … to contribute to tapping into that potential,” said Nigel Steward, director of the Centre for Sectoral Economic Performance (CSEP) at ICL.

“Supporting the sector isn’t just an economic opportunity, it’s essential for our national security and the resilience of businesses, so we at CSEP are very happy to have been able to produce this independent report in partnership with the University of Bristol to support the government’s Modern Industrial Strategy.”

Guy Poppy, pro vice-chancellor for research and innovation at the University of Bristol, added: “The UK’s cyber sector is a driver of innovation, resilience and economic growth. This action plan provides a timely roadmap, recognising how emerging technologies will shape future challenges and opportunities for stakeholders. It sets out a framework for research, skills and collaboration to turn innovation into growth and nationwide impact.

“By combining academic excellence with enterprise and policy engagement, we can help build a stronger, more resilient cyber ecosystem.”