Is advanced mathematics relevant to security beyond cryptography?

Question

Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, I mean to be at the edge of the science one must have advanced mathematical training.

If so, what branch of security and what branch of mathematics--and why?

Please note that I am not looking down on any branch of security, at all, just curious what other branches of security advanced mathematics is essential for.

---

Edit: In lieu of some comments in the answers: I consider the "classic" college calculus sequence to be something like: calculus 1, calculus 2, multi-variable calculus, and differential equations. Of course, one can branch off into other mathematical fields before reaching differential equations.

Answer 1

Yes, math is a tool and it can be useful in the realm of computer security. A fair amount of math is required to obtain a degree in Computer Science, and hackers prey on software developed by computer scientists.

Algebra can be used to fool GPS, and detect doctored photographs.

Computer Science theory is a branch of math and has applications to security.

There are also Algorithmic Complexity Attacks which is an attack pattern rooted in algorithmic analysis.

Answer 2

I honestly can't think of any.

• Crypto is the obvious maths domain.
• Routing protocols and certain security tools use a little maths but that is focused on performance.
• Forensic analysis can make use of mathematical tools but again, you don't need the maths expertise to use them.
• Wireless analysis makes use of Fourier transforms to extract data from the noise floor but this is not a security focus.

Answer 3

Yes. Hardware design (especially secure one) requires Physics, which in turn uses advanced mathematics a lot, especially partial differential equations (or are these taught in college?) - and group theory also won't hurt.

Some important fields are classical electromagnetism (i.e. whether your smartcard can't actually be read out by exploiting hardware design flaws; and security also includes that your computer shouldn't cause your cell phone to explode...) or quantum physics (it's not just good for quantum cryptography or quantum computers, but also e.g. scanning electron microscopy and the ultimate limits of Moore's law)

Answer 4

I guess it depends on what you mean by "classic college level calculus sequence".

I've certainly taxed my abilities in statistical analysis (my first degree was in Cell Biology / Biophysics - even though this was some time ago it did include rather a lot of statistics) looking at threat analysis / modelling. Also in the area of forensic analysis - using Bayesian classification, neural networks and genetic algorithms.

Answer 5

Advanced math is useful in a wide variety of computer science and inormation technology fields. Security relevance comes up often also, e.g. with:

• Statistics: critical for intrusion detection and forensic analysis of the enormous ("big data") log files you run into, and e.g. for defending against election attacks via risk-limiting audits.
• Category theory: applied to type theory and robust programming (free of side-effects), e.g. in Haskell, for monads, etc.
• Formal verification techniques, automated proofs of correctness.

I'd say that if more people knew more math, the list would be much longer and we'd be safer - math is useful!

Answer 6

Do you have to know maths? A little depending on what you want to do. To use tools and to implement algorithms you probably need little math. However to understand in a very detailed manner how particular things work within the security field, some maths and even physics are needed.

For instance reverse engineering computer chips requires you to understand physics and maybe even a little chemistry for the acid you use to melt the chip. Understanding statistical algorithms used in data analysis, which we can find in the fields of forensics, spam detection or evasion(baysian poisoning), fraud detection, IPS anomalie detection,... requires a decent grasp of mathematics.

In the end Computer Science is a field that evolved from mathematics, depending on what you want to do it's not really required to know advanced mathematics in the same way you do not need to know in great detail how a combustion engine works to drive a car. But it does help :)

Answer 7

The term "advanced mathematics" is very broad. If we talk about abstract algebra then yes, it is used in crypto, but still no practical use other than crypto in the field of information security. Although there is a lot of research going on in the field of mapping information security incidents to mathematics models, to make pattern recognition and decision making processing much easier and economical. But the research is not specific to any branch of advanced mathematics. You may narrow down your statement by choosing a specific branch of advanced mathematics.

Answer 8

To add to others' answers with my personal experience-

If you count 'Applications of Game theory to security' as a field of 'Computer security', then advanced mathematics has a good deal of role to play.

You may want to have a look at Network Security: A Decision and Game-Theoretic Approach, By Tansu Alpcan and Tamer Başar. A Game theoretic approach to network security does deal with math!

There are also many interesting publications by this research group at the University of Southern California, where they have employed their game theoretic approaches for Security at Los Angeles airport, Security of U.S. Ports from terrorists, etc. All these security algorithms have strong mathematical roots.

In case someone is wondering how is Game theory "advanced mathematics", have a look at Algorithmic Game Theory

Answer 9

I have a BS degree in Actuarial Science, however my current profession is as a network security architect. Although I have not seen must literature or discussion on the topic I believe there is an important place for actuarial mathematics in the area of network security. I myself define actuarial science simply as 'the valuation of risk' as such it becomes very relevant in the corporate environment. No one wants to spend a million dollars on avoiding a risk that's maximum possible cost if incurred is only $500,000. Of course that is a simplification of the problem however hopefully you see where I'm coming from. The biggest barrier I have noticed so far to this approach to security design and prioritization is the lack of the development and testing of the relevant statistical distributions that would be required. This then brings in another valuable use of advanced mathematical methods.