| 2009 | It's No Secret. Measuring the Security and Reliability of Authentication via "Secret" Questions. | Stuart E. Schechter, A. J. Bernheim Brush, Serge Egelman |
| 2009 | CLAMP: Practical Prevention of Large-Scale Data Leaks. | Bryan Parno, Jonathan M. McCune, Dan Wendlandt, David G. Andersen, Adrian Perrig |
| 2009 | De-anonymizing Social Networks. | Arvind Narayanan, Vitaly Shmatikov |
| 2009 | Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers. | Mike Ter Louw, V. N. Venkatakrishnan |
| 2009 | An Epistemic Approach to Coercion-Resistance for Electronic Voting Protocols. | Ralf Ksters, Tomasz Truderung |
| 2009 | Noninterference for a Practical DIFC-Based Operating System. | Maxwell N. Krohn, Eran Tromer |
| 2009 | The Mastermind Attack on Genomic Data. | Michael T. Goodrich |
| 2009 | Wirelessly Pickpocketing a Mifare Classic Card. | Flavio D. Garcia, Peter van Rossum, Roel Verdult, Ronny Wichers Schreur |
| 2009 | A Logic of Secure Systems and its Application to Trusted Computing. | Anupam Datta, Jason Franklin, Deepak Garg, Dilsun Kirli Kaynar |
| 2009 | Sphinx: A Compact and Provably Secure Mix Format. | George Danezis, Ian Goldberg |
| 2009 | Practical Mitigations for Timing-Based Side-Channel Attacks on Modern x86 Processors. | Bart Coppens, Ingrid Verbauwhede, Koen De Bosschere, Bjorn De Sutter |
| 2009 | Prospex: Protocol Specification Extraction. | Paolo Milani Comparetti, Gilbert Wondracek, Christopher Krgel, Engin Kirda |
| 2009 | Fingerprinting Blank Paper Using Commodity Scanners. | William Clarkson, Tim Weyrich, Adam Finkelstein, Nadia Heninger, J. Alex Halderman, Edward W. Felten |
| 2009 | Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments. | Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang |
| 2009 | Exploiting Unix File-System Races via Algorithmic Complexity Attacks. | Xiang Cai, Yuwei Gui, Rob Johnson |
| 2009 | Quantifying Information Leaks in Outbound Web Traffic. | Kevin Borders, Atul Prakash |
| 2009 | Formally Certifying the Security of Digital Signature Schemes. | Santiago Zanella-Bguelin, Gilles Barthe, Benjamin Grgoire, Federico Olmedo |
| 2009 | Secure Content Sniffing for Web Browsers, or How to Stop Papers from Reviewing Themselves. | Adam Barth, Juan Caballero, Dawn Song |
| 2009 | Automatic Discovery and Quantification of Information Leaks. | Michael Backes, Boris Kpf, Andrey Rybalchenko |
| 2009 | Tempest in a Teapot: Compromising Reflections Revisited. | Michael Backes, Tongbo Chen, Markus Drmuth, Hendrik P. A. Lensch, Martin Welk |
| 2009 | Plaintext Recovery Attacks against SSH. | Martin R. Albrecht, Kenneth G. Paterson, Gaven J. Watson |
| 2008 | SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks. | Haifeng Yu, Phillip B. Gibbons, Michael Kaminsky, Feng Xiao |
| 2008 | Spot Me if You Can: Uncovering Spoken Phrases in Encrypted VoIP Conversations. | Charles V. Wright, Lucas Ballard, Scott E. Coull, Fabian Monrose, Gerald M. Masson |
| 2008 | Efficient and Robust TCP Stream Normalization. | Mythili Vutukuru, Hari Balakrishnan, Vern Paxson |
| 2008 | Anonymous Networking with Minimum Latency in Multihop Networks. | Parvathinathan Venkitasubramaniam, Lang Tong |