Security Conference Plotting
Overview
Create clear, defensible, publication-quality visuals for security research. Prefer deterministic, editable outputs for paper figures, and keep every visual tied to a research question, system claim, threat model, or evaluation result.
Core Workflow
- Identify the figure's job: answer an RQ, explain a mechanism, show an attack path, define a threat model, compare systems, or summarize evidence.
- Choose the artifact:
- Numerical results, axes, CDFs, bars, heatmaps, or distributions: read
references/data-visualization.md.
- Attack chains, system architectures, protocol flows, trust boundaries, or state machines: read
references/diagram-generation.md.
- Venue sizing, fonts, color, accessibility, and export requirements: read
references/style-guide.md.
- Extract the minimum factual content from the paper, report, table, log, CSV, or user description. Do not invent unsupported labels, metrics, datasets, or baselines.
- Generate a reproducible source artifact:
- For data plots, create
figures/gen_fig_<name>.py and export figures/fig_<name>.pdf plus figures/fig_<name>.png.
- For diagrams, prefer Mermaid, draw.io XML, TikZ, or another editable/vector format. Use raster image generation only for conceptual diagrams where editable primitives are not enough, then verify all labels.
- Check the figure at final paper size: text at least 7 pt, colorblind safe, readable in grayscale, no cramped legends, no misleading axis scaling, and no unsupported claims.
Decision Guide
Use data plots when the figure depends on measured values: precision/recall/F1, false positives, exploit success rate, alert volume, latency, throughput, time-to-detect, time-to-patch, coverage, code size, CVE counts, or ablation results.
Use diagrams when the figure explains structure or causality: attacker capabilities, trust boundaries, protocol steps, access-control states, stale-allow sequences, vulnerability lifecycle, analyzer pipeline, patch workflow, or deployment architecture.
Use a multi-panel figure when the paper needs one coherent story, such as "(a) threat model, (b) system workflow, (c) evaluation outcome". Keep panels visually consistent and caption them as one claim.
For vague requests such as "make an overview figure", infer a draft figure spec from the abstract, method, or evaluation section before rendering. State the inferred entities, relationships, and metrics briefly if user confirmation would materially change the figure.
Security Paper Conventions
- Show attacker, victim, defender, oracle, policy engine, analyzer, and external dependency roles explicitly when they matter.
- Draw trust boundaries, privilege transitions, data flows, and failure paths as first-class visual elements.
- Use restrained colors: one highlight for "ours" or the critical path, neutral grays for baselines, and red only for true failure/attack/error semantics.
- Label axes with units and denominators, for example "False positives per KLOC", "Detection time (s)", "Exploit success rate (%)", or "Patched CVEs".
- Avoid decorative "cyber" imagery, stock icons, locks everywhere, gradients, and scary aesthetics. Security conference figures should look sober, inspectable, and evidence-driven.
- Preserve raw data or cite the source table/log in the generation script so the figure can be audited later.
Output Checklist
figures/gen_fig_<name>.py exists for generated data plots.- Final vector output is PDF unless the figure is inherently raster.
- A 300 DPI PNG preview exists for review, slides, or markdown.
- All labels match the paper terminology exactly.
- The figure remains legible when placed at the intended venue width.
- Any chart highlights the paper's contribution without hiding negative or baseline results.
- Any diagram has correct directionality for attacks, authorizations, data flows, and mitigations.
References
references/style-guide.md: venue dimensions, typography, color, accessibility, and final QA.references/data-visualization.md: chart-selection rules and reusable matplotlib/seaborn patterns for security results.references/diagram-generation.md: diagram types, visual semantics, and prompt/spec patterns for security architectures and attack workflows.
1---2name: sec-conf-plot3description: Create publication-ready figures, charts, and diagrams for computer security conference papers and security research reports. Use when Codex needs to design or generate plots from security experiment results, vulnerability/attack workflows, system or threat-model diagrams, RQ result charts, evaluation figures, or LaTeX-ready visual assets for venues such as USENIX Security, IEEE S&P, ACM CCS, NDSS, RAID, ACSAC, or security workshops.4---56# Security Conference Plotting78## Overview910Create clear, defensible, publication-quality visuals for security research. Prefer deterministic, editable outputs for paper figures, and keep every visual tied to a research question, system claim, threat model, or evaluation result.1112## Core Workflow13141. Identify the figure's job: answer an RQ, explain a mechanism, show an attack path, define a threat model, compare systems, or summarize evidence.152. Choose the artifact:16 - Numerical results, axes, CDFs, bars, heatmaps, or distributions: read `references/data-visualization.md`.17 - Attack chains, system architectures, protocol flows, trust boundaries, or state machines: read `references/diagram-generation.md`.18 - Venue sizing, fonts, color, accessibility, and export requirements: read `references/style-guide.md`.193. Extract the minimum factual content from the paper, report, table, log, CSV, or user description. Do not invent unsupported labels, metrics, datasets, or baselines.204. Generate a reproducible source artifact:21 - For data plots, create `figures/gen_fig_<name>.py` and export `figures/fig_<name>.pdf` plus `figures/fig_<name>.png`.22 - For diagrams, prefer Mermaid, draw.io XML, TikZ, or another editable/vector format. Use raster image generation only for conceptual diagrams where editable primitives are not enough, then verify all labels.235. Check the figure at final paper size: text at least 7 pt, colorblind safe, readable in grayscale, no cramped legends, no misleading axis scaling, and no unsupported claims.2425## Decision Guide2627Use data plots when the figure depends on measured values: precision/recall/F1, false positives, exploit success rate, alert volume, latency, throughput, time-to-detect, time-to-patch, coverage, code size, CVE counts, or ablation results.2829Use diagrams when the figure explains structure or causality: attacker capabilities, trust boundaries, protocol steps, access-control states, stale-allow sequences, vulnerability lifecycle, analyzer pipeline, patch workflow, or deployment architecture.3031Use a multi-panel figure when the paper needs one coherent story, such as "(a) threat model, (b) system workflow, (c) evaluation outcome". Keep panels visually consistent and caption them as one claim.3233For vague requests such as "make an overview figure", infer a draft figure spec from the abstract, method, or evaluation section before rendering. State the inferred entities, relationships, and metrics briefly if user confirmation would materially change the figure.3435## Security Paper Conventions3637- Show attacker, victim, defender, oracle, policy engine, analyzer, and external dependency roles explicitly when they matter.38- Draw trust boundaries, privilege transitions, data flows, and failure paths as first-class visual elements.39- Use restrained colors: one highlight for "ours" or the critical path, neutral grays for baselines, and red only for true failure/attack/error semantics.40- Label axes with units and denominators, for example "False positives per KLOC", "Detection time (s)", "Exploit success rate (%)", or "Patched CVEs".41- Avoid decorative "cyber" imagery, stock icons, locks everywhere, gradients, and scary aesthetics. Security conference figures should look sober, inspectable, and evidence-driven.42- Preserve raw data or cite the source table/log in the generation script so the figure can be audited later.4344## Output Checklist4546- `figures/gen_fig_<name>.py` exists for generated data plots.47- Final vector output is PDF unless the figure is inherently raster.48- A 300 DPI PNG preview exists for review, slides, or markdown.49- All labels match the paper terminology exactly.50- The figure remains legible when placed at the intended venue width.51- Any chart highlights the paper's contribution without hiding negative or baseline results.52- Any diagram has correct directionality for attacks, authorizations, data flows, and mitigations.5354## References5556- `references/style-guide.md`: venue dimensions, typography, color, accessibility, and final QA.57- `references/data-visualization.md`: chart-selection rules and reusable matplotlib/seaborn patterns for security results.58- `references/diagram-generation.md`: diagram types, visual semantics, and prompt/spec patterns for security architectures and attack workflows.
aibot88