Committed to society.
Ubiquitous computing, AI, and sophisticated cyber threats? We can handle it. Cybersecurity spans the full spectrum from cryptographic foundations and formal verification to web, mobile, cloud, and network security, malware detection, trustworthy AI, blockchain technologies, privacy-enhancing technologies, and cyber-physical systems.
Strengthened by the interdisciplinary Cybersecurity Center (CySec), we develop methods that embed security and privacy by design rather than treating them as an afterthought. Our research expertise includes internationally recognized formal security and blockchain assurance, with ERC-backed research on mathematically guaranteed blockchain security. Our cryptographic research contributes to international standardization and privacy-enhancing technologies, while award-winning AI security research advances malware, vulnerability, and defense.
Powered by community.
We do not just excel in making systems secure. We build the theory, technologies, and expertise needed to make security hold.
Professors
Scientific Staff
Federico Valbusa F. Valbusa
Privacy Enhancing Technologies
PreDoc Researcher
Thomas Neubauer T. Neubauer
Data Science
PostDoc Researcher
Markus Fleischmann M. Fleischmann
Software Engineering
PreDoc Researcher
Dedicated to excellence.
Big questions deserve high standards. Our award-winning research shows that we are pushing the limits. Here is what we have been working on.
Below is some of our recent work.
Want more?
Head over to our research unit pages!
Recent Projects
- 2026 – 2030 / Vienna Science and Technology Fund (WWTF)
- 2026 – 2030 / Audi AG I/EI-23
- 2025 – 2030 / European Commission / Publications (4)
- 2024 – 2030 / Vienna Science and Technology Fund (WWTF) / Publications (7)
- 2026 – 2029 / Vienna Science and Technology Fund (WWTF) / Publications (2)
- 2025 – 2029 / Intel Corporation
- 2025 – 2029 / Protocol Labs Inc.
- 2020 – 2029 / Vienna Science and Technology Fund (WWTF) / Website / Publications (19)
- 2025 – 2027 / Google Ireland Limited
- 2023 – 2027 / Vienna Science and Technology Fund (WWTF) / Publications (13)
- 2020 – 2027 / SBA Research gemeinnützige GmbH / Publications (11)
- 2020 – 2026 / Christian Doppler Research Association (CDG) / Website / Publications (30)
- 2023 – 2025 / European Commission / Website
- 2020 – 2025 / Vienna Science and Technology Fund (WWTF) / Publications (26)
- 2022 – 2024 / ABC Research GmbH / Publications (2)
- 2018 – 2024 / European Research Council (ERC) / Website / Publications (33)
- 2019 – 2023 / Austrian Science Fund (FWF) / Website / Publications (22)
- 2019 – 2023 / Vienna Business Agency (WAW) / Website / Publications (22)
- 2018 – 2021 / Austrian Research Promotion Agency (FFG) / Publications (8)
- 2018 – 2020 / Chaincode Labs Inc
Recent Publications
- Tagliaro, C., Komsic, M., Anselmi, G., Mandalari, A. M., Lindorfer, M. (2027). Bridging Devices and Apps: A Joint Analysis of IoT Privacy and Communication. In A. Spognardi, K. Sun, F. De Gaspari, L. V. Mancini (Eds.), Computer Security – ESORICS 2026 : 31st European Symposium on Research in Computer Security, Rome, Italy, September 14–18, 2026, Proceedings, Part III (pp. 588–607). Springer Cham.
- Schärmer, A., Landauer, M., Skopik, F., Wurzenberger, M., Squarcina, M. (2027). Let the Alerts Speak: LLM-Based IDS Alert Interpretation for SOC Triage. In Z. Afzal, P. Kochberger, B. Atli, M. Asplund (Eds.), Availability, Reliability and Security. ARES 2026 International Workshops : ARES 2026 International Workshops, Linköping, Sweden, August 24–27, 2026, Proceedings, Part II (pp. 346–364). Springer. Peer-reviewed.DOI: 10.1007/978-3-032-35579-9_19 / Download: PDF
- Aumayr, L., Avarikioti, Z., Woll, R. L., Maffei, M., Pelosi, A., Stefo, C., Zamyatin, A. (2026). BitVM: Quasi-Turing Complete Computation on Bitcoin. In A. Kiayias M. Kyropoulou (Eds.), 8th Conference on Advances in Financial Technologies (AFT 2026). Schloss Dagstuhl – Leibniz-Zentrum für Informatik.
- Calzavara, S., Casarin, S., Squarcina, M., Maffei, M. (2026). From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques. In G. Acar R. Jansen (Eds.), Proceedings on Privacy Enhancing Technologies 2026 (pp. 305–320). Peer-reviewed.
- Chow, T., D’Onghia, M., Linhardt, L., Kan, Z., Arp, D., Cavallaro, L., Pierazzi, F. (2026). Beyond the Tesseract: Trustworthy Dataset Curation for Sound Evaluations of Android Malware Classifiers. In 2026 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) (pp. 829–848). IEEE Computer Society. Peer-reviewed.
- Paracha, M. T., Posluns, K., Borgolte, K., Lindorfer, M., Choffnes, D. (2026). Hallucinating Certificates: Differential Testing of TLS Certificate Validation Using Generative Language Models. In ICSE 2026 : 2026 IEEE/ACM 48th International Conference on Software Engineering (pp. 3698–3710). IEEE/ACM.
- Alwen, J., Fuchsbauer, G., Mularczyk, M., Riepel, D. (2026). Lattice-Based Updatable KEM for Group Messaging. In N. Heninger M. Rosulek (Eds.), Advances in Cryptology – CRYPTO 2026 : 46th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17–20, 2026, Proceedings, Part X (pp. 168–199). Springer. Peer-reviewed.
- Breuer, N. O., Linhardt, L., Normann, P., Arp, D. (2026). Towards Explaining Classification Models in Security with Sparse Autoencoders. In 2026 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 278–289). IEEE. Peer-reviewed.DOI: 10.1109/EuroSPW72509.2026.00041 / Project: BREADS
- Beer, P., Roth, S., Lindorfer, M., Squarcina, M. (2026). Plain Text, Plain Risks: Measuring HTTP Inclusion in Android WebViews at Scale. In Proceedings of the 35th USENIX Security Symposium (pp. 2685–2704). Peer-reviewed.
- Przymus, P., Happe, A., Cito, J. (2026). Adversarial Bug Reports as a Security Risk in Language Model-Based Automated Program Repair. In MSR ’26: Proceedings of the 23rd International Conference on Mining Software Repositories (pp. 212–223). Association for Computing Machinery. Peer-reviewed.
- Saha, A., Lindorfer, M., Caballero, J. (2026). Kitten or Panda? Measuring the Specificity of Threat Group Behaviors in Public CTI Knowledge Bases. In M. Agrawal, I. Molloy, V. Pandit, D. Mukhopadhyay, K. Paterson (Eds.), ASIA CCS ’26: Proceedings of the ACM Asia Conference on Computer and Communications Security (pp. 1356–1370). The Association for Computing Machinery.
- Weninger, A., Andreeva, E. (2026). PUE Schemes: Efficient Updatable Encryption With Robust Security From Symmetric Primitives. In M. Agrawal, I. Molloy, V. Pandit, D. Mukhopadhyay, K. G. Paterson (Eds.), ASIA CCS ’26: Proceedings of the ACM Asia Conference on Computer and Communications Security (pp. 277–293). Association for Computing Machinery. Peer-reviewed.
- Katz, J., Sefranek, M. (2026). Issuer Hiding for BBS-Based Anonymous Credentials. In S. Bai E. Persichetti (Eds.), Public-Key Cryptography – PKC 2026 : 29th IACR International Conference on Practice and Theory of Public-Key Cryptography, West Palm Beach, FL, USA, May 25–28, 2026, Proceedings, Part III (pp. 437–465). Springer. Peer-reviewed.
- Gerhart, P. C., Li Calsi, D., Russo, L., Schröder, D. (2026). Fully-Adaptive Two-Round Threshold Schnorr Signatures from DDH. In J. Daemen E. Thomé (Eds.), Advances in Cryptology – EUROCRYPT 2026 : 45th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Rome, Italy, May 10–14, 2026, Proceedings, Part II (pp. 251–283). Springer. Peer-reviewed.
- Aumayr, L., Avarikioti, Z., Maffei, M., Scaffino, G., Zindros, D. (2026). Blink: An Optimal Proof of Proof-of-Work. In C. Garman Pedro Moreno-Sanchez (Eds.), Financial Cryptography and Data Security : 29th International Conference, FC 2025, Miyakojima, Japan, April 14–18, 2025, Revised Selected Papers, Part II (pp. 173–190). Springer. Peer-reviewed.DOI: 10.1007/978-3-032-07035-7_11 / Project: CDL-BOT
- Fuchsbauer, G., Regen, F., Hoeteck, W. (2026). Round-Optimal Threshold Blind Signatures Without Random Oracles. In N. Heninger M. Rosulek (Eds.), Advances in Cryptology – CRYPTO 2026 : 46th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 17–20, 2026, Proceedings, Part VII (pp. 555–587). Springer, Cham. Peer-reviewed.
- Avarikioti, G., Fuchsbauer, G., Keer, P., Maffei, M., Regen, F. (2026). A Composable Game-Theoretic Framework for Blockchains. In 2026 IEEE 39th Computer Security Foundations Symposium (CSF) (pp. 513–528). IEEE. Peer-reviewed.
- Lamarca, R., Beer, P., Squarcina, M. (2026). AutoFail: Breaking Web Boundaries using Android’s Autofill Framework. In Proceedings of the 35th USENIX Security Symposium (pp. 2601–2620). Peer-reviewed.
- Woll, R. L., Aumayr, L., Avarikioti, Z., Maffei, M., Pelosi, A., Thyfronitis Litos, O. S., Stefo, C., Tse, D., Zamyatin, A. (2026). Bridging Bitcoin to Second Layers via BitVM2. In Proceedings of the 35th USENIX Security Symposium (pp. 969–988).
- Landauer, M., Alton, L., Lindorfer, M., Skopik, F., Wurzenberger, M., Hotwagner, W. (2025). Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity. Digital Threats: Research and Practice, 6(4), Article 33. Peer-reviewed.DOI: 10.1145/3770085 / Download: PDF
Recent Presentations
- Sefranek, M. (2026, October 29). Plonk Without Random Oracles [Keynote Presentation]. TUM Blockchain Conference 26, Munich, Germany.
- Fuchsbauer, G., Sefranek, M. (2026, May 9). Plonk Without Random Oracles [Conference Presentation]. ZKProof 8, 2026, Rom, Italy.
- Sefranek, M. (2026, January 26). Sparkle Revisited: Proving Tight Adaptive Security of a Simple Schnorr Threshold Scheme [Conference Presentation]. MPTS 2026: NIST Workshop on Multi-Party Threshold Schemes 2026, Unknown.
- Sefranek, M. (2025, January 27). Hash functions in the context of PIOP-based SNARKs [Conference Presentation]. Algebraic Aspects in the Design and Cryptanalysis of Modern Symmetric Cryptography (ALPSY 2025), Obergurgl, Austria.
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2023, September 6). Breaking and Fixing Virtual Channels: Domino Attack and Donner [Presentation]. VISA Research - external research talks, Palo Alto, United States of America (the). Invited.
- Aumayr, L., Sri AravindaKrishnan Thyagarajan, Giulio Malavolta, Moreno-Sanchez, P., Maffei, M. (2023, August 30). Sleepy Channels: Bitcoin-Compatible Bi-directional Payment Channels without Watchtowers [Conference Presentation]. The Science of Blockchain Conference 2023, Stanford, United States of America (the).
- Aumayr, L., Abbaszadeh, K., Maffei, M. (2023, August 30). Thora: Atomic and Privacy-Preserving Multi-Channel Updates [Conference Presentation]. The Science of Blockchain Conference 2023 (SBC’23), Stanford University, United States of America (the).
- Aumayr, L., Abbaszadeh, K., Maffei, M. (2023, February 28). Thora: Atomic and Privacy-Preserving Multi-Channel Updates [Poster Presentation]. Network and Distributed System Security Symposium (NDSS) 2023, San Diego, United States of America (the).
- Aumayr, L., Sri AravindaKrishnan Thyagarajan, Giulio Malavolta, Moreno-Sanchez, P., Maffei, M. (2023, February 28). Sleepy Channels: Bi-directional Payment Channels without Watchtowers [Poster Presentation]. Network and Distributed System Security Symposium (NDSS) 2023, United States of America (the).
- Aumayr, L., Kasra Abbaszadeh, Maffei, M. (2022, October 31). Thora: Atomic And Privacy-Preserving Multi-Channel Updates [Poster Presentation]. Crypto Economics Security Conference, Berkeley, United States of America (the).
- Aumayr, L., Sri AravindaKrishnan Thyagarajan, Giulio Malavolta, Moreno-Sanchez, P., Maffei, M. (2022, October 31). Sleepy Channels: Bi-directional Payment Channels without Watchtowers [Poster Presentation]. Crypto Economics Security Conference, Berkeley, United States of America (the).
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2022, August 31). Blitz: Secure Multi-Hop Payments Without Two-Phase Commits [Conference Presentation]. The Science of Blockchain Conference 2022, Stanford, United States of America (the).
- Aumayr, L., Oguzhan Ersoy, Erwig, A., Faust, S., Hostáková, K., Maffei, M., Moreno-Sanchez, P., Riahi, S. (2022, August 30). Generalized Channels from Limited Blockchain Scripts and Adaptor Signatures [Conference Presentation]. The Science of Blockchain Conference 2022, Stanford, United States of America (the).
- Fuchsbauer, G. (2022, June 27). The security of Mimblewimble [Keynote Presentation]. 22nd Central European Conference on Cryptography, Smolenice, Slovakia. Invited.HDL: 20.500.12708/153193 / Project: COnFIDE
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2021, September 7). Donner: UTXO-Based Virtual Channels Across Multiple Hops [Presentation]. Bitcoin Sydney Socratic Seminar, Australia. Invited.HDL: 20.500.12708/152979
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2021, May 26). Blitz: Secure Multi-Hop Payments Without Two-Phase Commits [Conference Presentation]. Theory and Practice of Blockchains, Unknown.HDL: 20.500.12708/153230
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2021, April 27). Blitz: Secure Multi-Hop Payments Without Two-Phase Commits [Presentation]. Bitcoin Sydney Socratic Seminar, Australia. Invited.HDL: 20.500.12708/152982
- Aumayr, L., Moreno-Sanchez, P., Kate, A., Maffei, M. (2021, February 24). Blitz: Secure Multi-Hop Payments Without Two-Phase Commits [Presentation]. Decrypto Seminar, Unknown. Invited.HDL: 20.500.12708/152985
- Somé, D. F., Squarcina, M., Calzavara, S., Maffei, M. (2020). The Remote on the Local: Exacerbating Web Attacks Via Service Workers Caches in Progressive Web Applications. EuroS&P 2020 SecWeb Workshop, Genova, Italy.HDL: 20.500.12708/87080
- Egger, C., Moreno-Sanchez, P., Maffei, M. (2019). Atomic Multi-Channel Updates with Constant Collateral in Bitcoin-Compatible Payment-Channel Networks [Conference Presentation]. Scaling Bitcoin 2019, Tel Aviv, Israel.HDL: 20.500.12708/58034
Recent Theses
- Lecker, M. (2026). Virtualization-based code obfuscation via android runtime permutation [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.130267 / Download: PDF
- Schärmer, A. S. (2026). LLM-based IDS alert interpretation for cyber incident analysis and triage [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.131750 / Download: PDF
- Tagliaro, C. (2026). “Things” Fall Apart : Adventures in Securing a World of Connected Chaos [Dissertation, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.100308 / Download: PDF
- Pillwax, W. (2026). Improving onion routing in Tor [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.129611 / Download: PDF
- Kitzler, S. (2026). Computational Methods for Analyzing Decentralized Finance Ecosystems [Dissertation, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.139200 / Download: PDF
- Ploner, A. (2026). The silent bridge : how web-to-app mechanisms enable user tracking [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.139283 / Download: PDF
- Moser, L. (2026). User behavior simulation with large language models for security evaluation [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.132647 / Download: PDF
- Gewald, P. J. (2026). Android OAT library detection : detecting third party libraries leveraging of ahead time format in android applications [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.128602 / Download: PDF
- Wagner, P. (2026). Mining and verification of mobile app store privacy labels : a comparative study of Huawei AppGallery and google play store [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.136544 / Download: PDF
- Bondarenko, V. (2026). The Gap Game Model within a Composable Game-Theoretic Framework [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.142401 / Download: PDF
- Kopec, J. A. (2026). Transformer-based Mobile Malware Detection under Concept Drift [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2026.129943 / Download: PDF
- Danis, A. (2025). Exploiting smart TVs using the HbbTV protocol [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.126342 / Download: PDF
- Probst, B. (2025). Enhancing Linux privilege escalation attack capabilities of local LLM agents [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.130441 / Download: PDF
- Apel, D. F. P. (2025). Devising a privacy-preserving multi-token payment system as an optimistic L2 rollup [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.127764 / Download: PDF
- Keusch, A. (2025). Binary matching of android and iOS apps [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.128603 / Download: PDF
- Komsic, M. (2025). Investigating data privacy and network communication in IoT devices and their Apps across android and iOS [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.124857 / Download: PDF
- Glinzner, M. (2025). Video games as an attack vector [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.122068 / Download: PDF
- Saha, A. (2025). Advanced persistent threats: Attribution, profiling, and tracking [Dissertation, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.100309 / Download: PDF
- Reinsperger, M. (2025). Dangerous capability evaluation of large language models for web penetration testing [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.130442 / Download: PDF
- Crvic, O. (2025). Privacy matters : a comparative analysis of privacy labels in two android app stores [Diploma Thesis, Technische Universität Wien]. reposiTUm.DOI: 10.34726/hss.2025.124105 / Download: PDF
We shape the future.
Cybersecurity is evolving as fast as the systems it protects. We develop security-by-design for AI, connected systems, cloud and critical infrastructure — combining cryptography, formal methods, program analysis, and human-centered privacy. At the same time, we address regulation, transparency, usability, and societal trust to ensure that secure technologies can be adopted in practice. Our vision: a digital society that is secure, resilient, and trustworthy by design.
Want more? We have more. Head over to our Newsroom!