| 2025 | CRITIS | A Comparison of Security ICS Communication Protocols. | Daniel Clark, Tom Chothia |
| 2023 | AsiaCCS | Symbolic modelling of remote attestation protocols for device and app integrity on Android. | Abdulla Aldoseri, Tom Chothia, Jos Moreira, David F. Oswald |
| 2022 | CCS | The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning. | Chris McMahon Stone, Sam L. Thomas, Mathy Vanhoef, James Henderson, Nicolas Bailluet, Tom Chothia |
| 2022 | SP | Practical EMV Relay Protection. | Andreea-Ina Radu, Tom Chothia, Christopher J. P. Newton, Ioana Boureanu, Liqun Chen |
| 2020 | CCS | Security Analysis and Implementation of Relay-Resistant Contactless Payments. | Ioana Boureanu, Tom Chothia, Alexandre Debant, Stphanie Delaune |
| 2020 | CCS | Catch Me If You Can: An In-Depth Study of CVE Discovery Time and Inconsistencies for Managing Risks in Critical Infrastructures. | Richard James Thomas, Joseph Gardiner, Tom Chothia, Emmanouil Samanis, Joshua Perrett, Awais Rashid |
| 2020 | ESORICS | Learning from Vulnerabilities - Categorising, Understanding and Detecting Weaknesses in Industrial Control Systems. | Richard James Thomas, Tom Chothia |
| 2019 | EuroSys | Time Protection: The Missing OS Abstraction. | Qian Ge, Yuval Yarom, Tom Chothia, Gernot Heiser |
| 2019 | FC | Short Paper: Making Contactless EMV Robust Against Rogue Readers Colluding with Relay Attackers. | Tom Chothia, Ioana Boureanu, Liqun Chen |
| 2018 | CARDIS | Breaking All the Things - A Systematic Survey of Firmware Extraction Techniques for IoT Devices. | Sebastian Vasile, David F. Oswald, Tom Chothia |
| 2018 | ESORICS | Extending Automated Protocol State Learning for the 802.11 4-Way Handshake. | Chris McMahon Stone, Tom Chothia, Joeri de Ruiter |
| 2017 | ACSAC | Spinner: Semi-Automatic Detection of Pinning without Hostname Verification. | Chris McMahon Stone, Tom Chothia, Flavio D. Garcia |
| 2017 | ACSAC | TRAKS: A Universal Key Management Scheme for ERTMS. | Richard James Thomas, Mihai Ordean, Tom Chothia, Joeri de Ruiter |
| 2017 | CCS | An Attack Against Message Authentication in the ERTMS Train to Trackside Communication Protocols. | Tom Chothia, Mihai Ordean, Joeri de Ruiter, Richard James Thomas |
| 2017 | DIMVA | HumIDIFy: A Tool for Hidden Functionality Detection in Firmware. | Sam L. Thomas, Flavio D. Garcia, Tom Chothia |
| 2017 | ESORICS | Stringer: Measuring the Importance of Static Data Comparisons to Detect Backdoors and Undocumented Functionality. | Sam L. Thomas, Tom Chothia, Flavio D. Garcia |
| 2017 | FC | Why Banker Bob (Still) Can't Get TLS Right: A Security Analysis of TLS in Leading UK Banking Apps. | Tom Chothia, Flavio D. Garcia, Chris Heppel, Chris McMahon Stone |
| 2017 | ICISSP | Towards an Understanding of the Misclassification Rates of Machine Learning-based Malware Detection Systems. | Nada Alruhaily, Behzad Bordbar, Tom Chothia |
| 2017 | ICISSP | A Better Understanding of Machine Learning Malware Misclassifcation. | Nada Alruhaily, Tom Chothia, Behzad Bordbar |
| 2017 | ICSOC | A Market-Based Approach for Detecting Malware in the Cloud via Introspection. | Nada Alruhaily, Carlos Joseph Mera-Gmez, Tom Chothia, Rami Bahsoon |
| 2016 | ACSAC | On the (in)security of the latest generation implantable cardiac defibrillators and how to secure them. | Eduard Marin, Dave Singele, Flavio D. Garcia, Tom Chothia, Rik Willems, Bart Preneel |
| 2016 | BigData | Asset-centric Security-Aware Service Selection. | Giannis Tziakouris, Marios Zinonos, Tom Chothia, Rami Bahsoon |
| 2015 | FC | Relay Cost Bounding for Contactless EMV Payments. | Tom Chothia, Flavio D. Garcia, Joeri de Ruiter, Jordi van den Breekel, Matthew Thompson |
| 2015 | TrustCom | Analysis of Mobility Algorithms for Forensic Virtual Machine Based Malware Detection. | Nada Alruhaily, Behzad Bordbar, Tom Chothia |
| 2014 | ESORICS | LeakWatch: Estimating Information Leakage from Java Programs. | Tom Chothia, Yusuke Kawamoto, Chris Novakovic |
| 2014 | ESORICS | Automatically Calculating Quantitative Integrity Measures for Imperative Programs. | Tom Chothia, Chris Novakovic, Rajiv Ranjan Singh |
| 2013 | CAV | A Tool for Estimating Information Leakage. | Tom Chothia, Yusuke Kawamoto, Chris Novakovic |
| 2012 | SecureComm | The Unbearable Lightness of Monitoring: Direct Monitoring in BitTorrent. | Tom Chothia, Marco Cova, Chris Novakovic, Camilo Gonzlez Toro |
| 2010 | FC | A Traceability Attack against e-Passports. | Tom Chothia, Vitaliy Smirnov |
| 2010 | TACAS | Statistical Measurement of Information Leakage. | Konstantinos Chatzikokolakis, Tom Chothia, Apratim Guha |
| 2009 | Coordination | From Coordination to Stochastic Models of QoS. | Farhad Arbab, Tom Chothia, Rob van der Mei, Sun Meng, Young-Joo Moon, Chrtien Verhoef |
| 2008 | RTSS | Schedulability and Compatibility of Real Time Asynchronous Objects. | Mohammad Mahdi Jaghoori, Delphine Longuet, Frank S. de Boer, Tom Chothia |
| 2007 | Coordination | Component Connectors with QoS Guarantees. | Farhad Arbab, Tom Chothia, Sun Meng, Young-Joo Moon |
| 2007 | SecureComm | Securing pseudo identities in an anonymous peer-to-peer file-sharing network. | Tom Chothia |
| 2006 | FORTE | Analysing the MUTE Anonymous File-Sharing System Using the Pi-Calculus. | Tom Chothia |
| 2005 | EUC | A Survey of Anonymous Peer-to-Peer File-Sharing. | Tom Chothia, Konstantinos Chatzikokolakis |