Future Attacks Research Articles

An investigation into microcycles of violence by the Taliban

This study investigated the notion of near-repeat victimisation in the context of the Taliban insurgency in Afghanistan. Applying methods originally developed for epidemiological research the current study found strong evidence that attacks by the Taliban insurgency occurred in microcycles of localised bursts of terrorist events. Nearly 40% of the 305 attacks analysed by the Taliban in 2016 took place within 5 miles and 2 weeks of each other. A binary logistic regression showed that, compared to other strategies, attacks were more likely to occur in microcycles when they were on national or provincial capitals, non-fatal and included bombings or armed assaults. These findings are in accordance with previous research conducted in other countries, suggesting that globally, terrorist organisations face similar strategic options and constraints. The results have implications for the understanding of terrorist campaigns at a more disaggregated level, for the prediction of future attacks and for counter-terrorism strategies.

Relational Characteristics of Maliciousness and Hacker in a Cyberattack

Cyber security threats are increasing day by day. However, this threat is sophisticated and intelligent. Therefore, artificial intelligence-based learning algorithms are emerging to effectively respond to cybersecurity threats. However, there has yet to be any interest or approach in studying the likelihood of an attack by efficiently analyzing the causes of the attack by individuals, religious groups, and hackers subordinate to state agencies. An idea in this study is to analyze hacker tendencies. And the link to how hacker tendencies affect attacks is being sought by the intelligence algorithm, which provides a sample of the predictive model as a preliminary study. Therefore, this study required a study on what an attacker's individual is influenced by, how a hacker subordinate to a religious group is affected by an attack from a religious group, and how a hacker subordinate to a national institution is affected by an attack from a state institution. In this study, however, we briefly focused on the factors that affect these attacks. In this study, we proposed an intelligent simplified model that predicts threats with the goal of producing results on whether or not an attack by combining the pattern of attack with inputs and weighing factors. Therefore, three groups of attackers were analyzed. From this, a simple intelligent algorithm model was presented The results of this study are expected to help derive the correlation between future hacker attack propensity analysis and intelligent algorithm. Future research will implement a threat analysis system that can more specifically derive attack propensity factors and apply them to intelligent algorithms (weights, f functions) to determine whether an attack is possible or not.

Optic neuritis: Differential diagnosis and management

Optic neuritis is one of the commonest conditions presenting acutely to both Ophthalmic and Neurological services worldwide. In the past 20 years understanding of the management of optic neuritis has departed from an emphasis on those cases associated with multiple sclerosis (emanating from Europe and North America) where there remains no treatment that influences the outcome. We now recognise four additional categories phenotypically and serologically: 1) A post-infectious monophasic disorder 2) An autoimmune, episodic relapsing condition associated with neuromyelitis optica (NMO) and the Aquaporin 4 antibody 3) An autoimmune episodic relapsing condition associated with the myelin oligodendrocyte (MOG) antibody which may show features of NMO and 4) A corticosteroid dependent condition requiring long term immune suppression known as chronic relapsing inflammatory optic neuropathy (CRION), some of which cases are found to have the MOG antibody. In this presentation I will discuss the approach from the point of view of a clinician faced with a patient presenting with his/her first ever episode of optic neuritis. How are the decisions to be made regarding diagnosis and treatment to prevent irreversible visual loss in this and any future attacks, where "time is vision"?

2201Coronary angioplasty patients' preferences for information about treatment risks: a survey study

Abstract Background Percutaneous Coronary Intervention (PCI) is the commonest invasive procedure in cardiology. Before treatment consent must be given. As part of this communication process patients receive information about the risks and benefits of PCI and alternative treatments. Published studies tell us that the amount and quality of the information received by patients undergoing PCI is variable; benefits are often overestimated, risks forgotten and alternative treatments not always considered. Very little is known about patients' preferences for PCI risk information. Aim: To describe patients' preferences for formation about PCI treatment risk as part of the informed consent process Methods: A cross-sectional survey was distributed to 350 participants treated with PCI across 10 PCI centres in England. Results Three hundred and twenty six participants completed the survey. Thirty percent of the sample reported needing help to understand written medical information. Fifty-one percent were treated with elective PCI, 75% were male, average age of 66.5 years. Recall and comprehension of PCI information given during the consent process was generally limited; 47% and 61% agreed that patients do not usually understand, or remember, the information given to them respectively. Eighty-eight percent of urgent PCI patients wanted to know about all possible risks compared to 90% of elective cases. Most participants (88% urgent and 94% elective) believed that PCI would reduce their risk of a future heart attack. Conclusion A significant proportion of PCI patients find it difficult to recall or understand information about treatment risks. It is recommended that patients are given health-related information designed to accommodate different health literacy levels in advance of their treatment. Acknowledgement/Funding National Institute for Health Research Research for Patient Benefit Programme Grant Reference Number PB-PG-0712-28089

P1744Patient prehospital delays in acute myocardial infarction. A nationwide patient survey. Heart attack-time is life campaign

Abstract Introduction A minimal delay from symptom onset to reperfusion therapy is essential in the management of acute myocardial infarction (AMI). The patient's response to initial symptoms (patient delay) substantially affects the delay. Nevertheless, predictors of patient-related delays are less clear. The aim of the study was to compare knowledge and awareness of heart attack symptoms and reactions to it in a general Polish population. Methods In this cross-sectional study, 1 376 persons aged 18 years or older enrolled in an Internet survey (computer assisted web interview, CAWI). Heart attack knowledge, self-efficacy for recognizing and responding to heart attack symptoms, and perceived risk for a future heart attack were measured. Primary exclusion criteria were: prior MI or family history of MI. The survey was carried out as a part of the nationwide “Heart attack – time is life” Campaign. Results Based on the Polish Registry on Acute Coronary Syndromes (PL-ACS) the median total ischemic time in Poland is 260 minutes, whereas the median patient delay is 142 minutes. The main factors associated with long time delays include interhospital transfers, symptoms presentation during the night, age >65 years, inhabitants of rural areas, diabetes mellitus, first-ever MI, female sex. The survey demonstrated that 73.8% of respondents recognize that chest pain may be associated with MI, but only 22.2% of them would call the emergency medical services. Age-, sex-, income-, and education-related responses are depicted in the Figure. Only 23% of these respondents would make the call immediately, whereas 31.7% would wait at least 3–4 hours (in some cases event until the next day). 66.4% of the surveyed population would ignore the chest pain main reason being “nothing serious” or “a result of extreme emotions”. Notwithstanding, the majority of the surveyed population is aware of the seriousness of the AMI-related complications (heart failure, disability, rehospitalizations, death). Conclusions These findings highlight the urgent need to develop effective, tailored campaigns to close the knowledge gap and, primarily, to educate the Polish society about the correct response to chest pain. Young age, higher education, and high income were not predictors of common sense and correct responses.

Geo-Spatial Crime Analysis Using Newsfeed Data in Indian Context

Social media is the platforms where users communicate, interact, share ideas, career interest, pictures, video, etc. Social media gives an opportunity to analyze the human behavior. Crime analysis using data from social media such as Newsfeeds, Facebook, Twitter, etc., is becoming one of the emerging areas of research for law enforcement organizations across the world. The intelligence gathered through data is used for identifying future attacks and plan for reinforcements. This article focuses on the implementation of textual data analytics by collecting the data from different newsfeeds and provides an optimized visualization. This article establishes a framework for better prediction of 16 types of crime in India and the Bangalore area by providing the coordinates of the crime area, along with the crime which might happen there.

Automated Dataset Generation System for Collaborative Research of Cyber Threat Analysis

The objectives of cyberattacks are becoming sophisticated, and attackers are concealing their identity by masquerading as other attackers. Cyber threat intelligence (CTI) is gaining attention as a way to collect meaningful knowledge to better understand the intention of an attacker and eventually predict future attacks. A systemic threat analysis based on data acquired from actual cyber incidents is a useful approach to generating intelligence for such an objective. Developing an analysis technique requires a high-volume and fine-quality data. However, researchers can become discouraged by inaccessibility to data because organizations rarely release their data to the research community. Owing to a data inaccessibility issue, academic research tends to be biased toward techniques that develop steps of the CTI process other than analysis and production. In this paper, we propose an automated dataset generation system called CTIMiner. The system collects threat data from publicly available security reports and malware repositories. The data are stored in a structured format. We released the source codes and dataset to the public, including approximately 640,000 records from 612 security reports published from January 2008 to June 2019. In addition, we present a statistical feature of the dataset and techniques that can be developed using it. Moreover, we demonstrate an application example of the dataset that analyzes the correlation and characteristics of an incident. We believe our dataset will promote collaborative research on threat analysis for the generation of CTI.

Altered Functional Connectivity within Default Mode Network in Patients with Transient Ischemic Attack: A Resting-State Functional Magnetic Resonance Imaging Study

Default mode network (DMN) is an important functional brain network that supports aspects of cognition. Stroke has been reported to be associated with functional connectivity (FC) impairments within DMN. However, whether FC within DMN changes in transient ischemic attack (TIA), an important risk factor for stroke, remains unclear. Forty-eight TIA patients and 41 age- and sex-matched healthy controls (HCs) were recruited in this study. Using resting-state functional magnetic resonance imaging seed-based FC methods, we examined FC alterations within DMN in TIA patients, tested its associations with clinical information, and further explored the ability of FC abnormalities to predict follow-up ischemic attacks. We found significantly decreased FC of left middle temporal gyrus/angular gyrus both with medial prefrontal cortex (mPFC) and posterior cingulate cortex/precuneus (PCC/Pcu) and significantly decreased FC among each pair of mPFC, left PCC, and right Pcu in patients with TIA as compared with HCs. Moreover, the connectivity between mPFC and left PCC could predict future ischemic attacks of the patients. Collectively, these findings may provide insights into further understanding of the underlying pathological mechanism in TIA, and aberrant FC between the hubs within DMN may provide a reference for the imaging diagnosis and early intervention of TIA.

Semi-supervised machine learning for primary user emulation attack detection and prevention through core-based analytics for cognitive radio networks

Cognitive radio networks are software controlled radios with the ability to allocate and reallocate spectrum depending upon the demand. Although they promise an extremely optimal use of the spectrum, they also bring in the challenges of misuse and attacks. Selfish attacks among other attacks are the most challenging, in which a secondary user or an unauthorized user with unlicensed spectrum pretends to be a primary user by altering the signal characteristics. Proposed methods leverage advancement to efficiently detect and prevent primary user emulation future attack in cognitive radio using machine language techniques. In this paper novel method is proposed to leverage unique methodology which can efficiently handle during various dynamic changes includes varying bandwidth, signature changes etc… performing learning and classification at edge nodes followed by core nodes using deep learning convolution network. The proposed method is compared with that of two other state-of-art machine learning-based attack detection protocols and has found to significantly reduce the false alarm to secondary network, at the same time improve the overall detection accuracy at the primary network.

Protection of office buildings and spaces: A balanced approach to perception of terrorism risk in the common workspace

The scholarly literature regarding soft target terrorism indicates a likely shift from acts of terror against hardened targets to attacks against easier, softer targets. Office buildings and spaces, by their often open and inviting nature and capacity to house large numbers of people, fit within the commonly accepted model of soft targets. They are also designated by the US Department of Homeland Security as components of critical infrastructure. The literature, however, identifies very little terrorist threat in the ordinary work environment. To better understand the history of and potential for future attacks in the office environment, this article examines frequency-based terrorist attack data from 1990 to 2017, from the Global Terrorism Database, along with contemporary attack trend data from government reports and relevant journal articles. The article also discusses how the reporting of such events impacts on the public. Finally, the article recommends an objective and comprehensive forward-looking approach to understand the level of risk, which embraces not only historical data but ongoing intelligence, assessment and analysis.

Data Acquisition From Mobile Phone using Mobiledit

Mobile forensic is a subsidiary of digital forensic that is flourishing constantly. As per current scenario, mobile phones not only mean traditional mobile phones that were developed and used in late 1990s but also include smart phones that offer an array of functionality. Mobile phones developed in 1990s also known as feature phones provided limited functionality such as calling and messaging as they were subjected to provide communication facility. But at present, mobile phones are used not only for communication but also for executing face to face interactions, shopping using various applications, trading and internet surfing, etc thus making mobile more feature-variant and making them smart. Since, mobile phone market is constantly rising because of increased and improved features; usage of mobile phones in criminal activities or illegal activities has also increased. The crime scene can be re-created by identifying the series of actions that has taken place when crime was committed by using compatible mobile forensic tools. Current attack could not be prevented, but the investigator can attain all crucial evidences present on the crime scene in order to reduce similar kind of attacks in future. The capturing and recording of crime scene, collecting and analyzing the evidence and finding the culprit and reason of committing crime is the art of mobile forensics. In this paper, we are going to discuss the implementation of proposed framework by using tool MOBILedit

Protecting elections from social media manipulation

Rigorous causal analysis could help harden democracy against future attacks

Disentangling herbivore impacts in primary succession by refocusing the plant stress and vigor hypotheses on phenology

AbstractThe plant stress and plant vigor hypotheses are widely used to explain the distribution and abundance of insect herbivores across their host plants. These hypotheses are the subject of contentious debate within the plant herbivore research community, with several studies finding simultaneous support for both hypotheses for the same plant–herbivore interaction. We address the question of how such support is possible using dynamic site‐occupancy models to quantify the attack dynamics of Cryptorhynchus lapathi (poplar‐willow weevil) on Salix sitchensis (Sitka willow), a dioecious shrub colonizing Mount St. Helens, Washington, USA after the 1980 eruption, in relation to host plant stress, vigor, and sex. We also introduce several scaling criteria as a rigorous test of the plant vigor hypothesis and demonstrate why modeling insect detection is important in plant–insect studies. Weevils responded positively to water stress associated with seasonal dry‐downs, and this response was phenologically compartmentalized by larval feeding mode. Weevils preferentially attacked large and/or flowering stems, imposing an ecological cost on willow reproduction via increased stem mortality and susceptibility to future attack. We propose that the dual response to host plant stress and vigor is due to the synchronization between young weevil larval feeding and willow nutrient pulses that are mediated by environmental stress. In turn, this process drives successional dynamics, causing the juvenilization of upland willow plants and possibly delaying establishment of a willow‐dominated upland sere. These results highlight the common, but often overlooked, phenological basis of the plant stress and plant vigor hypotheses, which both focus on how stress changes the quality of plant resources available to immature insects.

WhatsApp Encryption- A Research

In the recent years, battle between national security and a person’s privacy has become prime conflict. Governments and secret services are asking encrypted messaging services such as WhatsApp to allow them access to user’s data. After the March attack at Westminster(2017), UK home secretary, stated that accessibility of WhatsApp's data is mandatory to authorize the legitimate user since the government couldn’t smell the encrypted messages of suspected terrorists. But in turn such access to messages will allow authorities to thwart future terror attacks. In this paper, novel enhanced End to end encryption technique is proposed to identify the breaches and mitigate the terror attacks. Also different encryption techniques are compared with respect to their performance and the best encryption technique is revealed

Why do gun murders have a higher clearance rate than gunshot assaults?

Research SummaryThe prevailing view is that follow‐up investigations are of limited value as crimes are primarily cleared by patrol officers making on‐scene arrests and through the presence of eyewitnesses and forensic evidence at the initial crime scene. We use a quasi‐experimental design to compare investigative resources invested in clearing gun homicide cases relative to nonfatal gun assaults in Boston. We find the large gap in clearances (43% for gun murders vs. 19% for nonfatal gun assaults) is primarily a result of sustained investigative effort in homicide cases made after the first 2 days.Policy ImplicationsPolice departments should invest additional resources in the investigation of nonfatal gun assaults. When additional investigative effort is expended, law enforcement improves its success in gaining the cooperation of key witnesses and increases the amount of forensic evidence collected and analyzed. In turn, the capacity of the police to hold violent gun offenders accountable, deliver justice to victims, and prevent future gun attacks is enhanced.

Generic Attacks on Hash Combiners

Hash combiners are a practical way to make cryptographic hash functions more tolerant to future attacks and compatible with existing infrastructure. A combiner combines two or more hash functions in a way that is hopefully more secure than each of the underlying hash functions, or at least remains secure as long as one of them is secure. Two classical hash combiners are the exclusive-or (XOR) combiner \( \mathcal {H}_1(M) \oplus \mathcal {H}_2(M) \) and the concatenation combiner \( \mathcal {H}_1(M) \Vert \mathcal {H}_2(M) \). Both of them process the same message using the two underlying hash functions in parallel. Apart from parallel combiners, there are also cascade constructions sequentially calling the underlying hash functions to process the message repeatedly, such as Hash-Twice \(\mathcal {H}_2(\mathcal {H}_1(IV, M), M)\) and the Zipper hash \(\mathcal {H}_2(\mathcal {H}_1(IV, M), \overleftarrow{M})\), where \(\overleftarrow{M}\) is the reverse of the message M. In this work, we study the security of these hash combiners by devising the best-known generic attacks. The results show that the security of most of the combiners is not as high as commonly believed. We summarize our attacks and their computational complexities (ignoring the polynomial factors) as follows:1.Several generic preimage attacks on the XOR combiner:A first attack with a best-case complexity of \( 2^{5n/6} \) obtained for messages of length \( 2^{n/3} \). It relies on a novel technical tool named interchange structure. It is applicable for combiners whose underlying hash functions follow the Merkle–Damgård construction or the HAIFA framework.A second attack with a best-case complexity of \( 2^{2n/3} \) obtained for messages of length \( 2^{n/2} \). It exploits properties of functional graphs of random mappings. It achieves a significant improvement over the first attack but is only applicable when the underlying hash functions use the Merkle–Damgård construction.An improvement upon the second attack with a best-case complexity of \( 2^{5n/8} \) obtained for messages of length \( 2^{5n/8} \). It further exploits properties of functional graphs of random mappings and uses longer messages. These attacks show a rather surprising result: regarding preimage resistance, the sum of two n-bit narrow-pipe hash functions following the considered constructions can never provide n-bit security.2.A generic second-preimage attack on the concatenation combiner of two Merkle–Damgård hash functions. This attack finds second preimages faster than \( 2^n \) for challenges longer than \( 2^{2n/7} \) and has a best-case complexity of \( 2^{3n/4} \) obtained for challenges of length \( 2^{3n/4} \). It also exploits properties of functional graphs of random mappings.3.The first generic second-preimage attack on the Zipper hash with underlying hash functions following the Merkle–Damgård construction. The best-case complexity is \( 2^{3n/5} \), obtained for challenge messages of length \( 2^{2n/5} \).4.An improved generic second-preimage attack on Hash-Twice with underlying hash functions following the Merkle–Damgård construction. The best-case complexity is \( 2^{13n/22} \), obtained for challenge messages of length \( 2^{13n/22} \).The last three attacks show that regarding second-preimage resistance, the concatenation and cascade of two n-bit narrow-pipe Merkle–Damgård hash functions do not provide much more security than that can be provided by a single n-bit hash function. Our main technical contributions include the following:1.The interchange structure, which enables simultaneously controlling the behaviours of two hash computations sharing the same input.2.The simultaneous expandable message, which is a set of messages of length covering a whole appropriate range and being multi-collision for both of the underlying hash functions.3.New ways to exploit the properties of functional graphs of random mappings generated by fixing the message block input to the underlying compression functions.

The Interpretation of Biogeochemical Growths on Gold Coins from the SS Central America Shipwreck: Applications for Biogeochemistry and Geoarchaeology

Black crusts that formed on gold coins recovered from the 1857 shipwreck of the SS Central America played a key role in their preservation in a near original state. Within a few years of the sinking, the significant quantities of iron and steel on the shipwreck produced laminar geochemical precipitates of fine-grained iron minerals on the coins. This coating served to armor the coins from future chemical or biological attacks. Once coated, the coins were colonized by at least two distinct populations of gold-tolerant bacteria that precipitated abundant nanoparticulate gold in the black crust material and produced biomineralized bacteria in a web-like mat. Above this middle layer of black crust, the outer layer consisted of a geochemical reaction front of euhedral crystals of iron sulfate and iron oxy-hydroxide species, formed by the interaction of seawater with the chemical wastes of the bacterial mat. Understanding this process has application for assessing the diverse and extreme conditions under which nano-particulate gold may form through biological processes, as well as understanding the conditions that contribute to the preservation or degradation of marine archaeological materials.

The Kids Are Alt-Right: How Media and the Law Enable White Supremacist Groups to Recruit and Radicalize Emotionally Vulnerable Individuals

Right-wing extremist violence represents “the oldest and most persistent form of terrorism in the United States and surprisingly the deadliest form of extremism in the US since 9/11. In fact, since 9/11 right-wing extremists have killed more Americans on US soil than jihadi extremists by almost two-to-one.” A joint bulletin from the FBI and the Department of Homeland Security reported that the number of homicides committed by white supremacists from 2000 to 2016 was “more than any other domestic extremist movement.” The latest FBI report shows that, for the third year in a row, hate crimes are increasing, with a 17% increase from 2016-2017. Violence committed by white supremacists is also growing, making 2017 the fifth deadliest year for extremists violence since 1970. How is the growth within white supremacist groups able to occur when they are such a significant threat to our public’s safety? A few of the major causes are: the government’s refusal to label white supremacists as terrorists, the protection the courts have placed on first amendment rights at the cost of others safety, the spread of recruitment and visibility of these extremist groups on social media, and the lack of awareness of the public due to the inaccurate stereotyping and description of the threats and violence propagated by the media by labelling it as mental illness and not as terrorism. These factors insulate white supremacists from real consequences, stigmatizes minority groups, provides a false narrative to the public about the threat to their safety, allows white supremacists to recruit more individuals online with ease, protects their hate speech and propaganda, and stops government departments from utilizing resources that would prevent future attacks. The government and media must stop blaming acts of domestic terrorism by white supremacists as being committed due to mental illness, and instead call it domestic terrorism and place regulations on social media companies that are negligently allowing white supremacist groups to recruit online and incite violence. In the past months, we have seen The New York Times, The Washington Post, The Economist, and Time magazine run issues on the threat of white supremacy in the US and how the media and government have allowed this growth to occur. It is a recognized problem, however, there is little legal research that analyzes the real threats and consequences on the U.S. This paper addresses the issue as a whole. It analyzes the personality of those recruited by white supremacist groups, including the first psychological profile of the alt-right, the influence media has had on the growth and visibility of white supremacists, how the media and government blame the attacks on mental illness, how the courts and government protect white supremacists, the lack of an independent federal crime for domestic terrorism, and the necessary steps the government must take to raise awareness of this threat to the public by calling these attacks terrorism and the need to regulate social media platforms that allow these extremist groups to recruit, grow in visibility, and plan attacks on their platforms. This paper calls for accountability and presents evidence that refutes any dismissal of white supremacists not being a significant threat to the U.S.

Symptoms and Dietary Impact in Hypertriglyceridemia-Associated Pancreatitis: Development and Content Validity of Two New Measures.

BackgroundSevere hypertriglyceridemia (sHTG) is a rare condition, complicated by episodes of acute pancreatitis (AP), which can cause pain and/or life-threatening multi-organ dysfunction. Currently, there are no disease-specific patient-reported outcome (PRO) measures evaluating symptoms or dietary impact for this condition.ObjectiveThe objective of this study was to explore patient-reported symptoms and impacts of sHTG and AP and develop new measures to capture the symptoms and dietary impacts of this condition using patient language.MethodsIn-depth, semi-structured concept elicitation interviews were conducted with 12 US-based participants to explore their experience and identify key symptoms and impact on dietary behavior, both during and between episodes of AP. Participants had a range of AP severity with a previous triglyceride reading > 1000 mg/dL, and at least one attack of AP within the last 12 months. Transcripts were coded using thematic analysis.ResultsQualitative data analysis revealed the substantial burden of AP associated with sHTG. Participants reported experiencing symptoms, especially abdominal pain, both during and between attacks of AP, and discussed considerable diet changes to prevent or minimize future attacks. A conceptual model was refined, based on patient input, and reviewed by clinical experts to determine key concepts for inclusion within two PRO measures, one evaluating symptoms and another evaluating impact on dietary behavior. Items were drafted using patient-derived language. A 19-item symptoms measure [Hypertriglyceridemia and Acute Pancreatitis Symptom Scale (HAP-SS)] and a 6-item dietary impact measure (Hypertriglyceridemia and Acute Pancreatitis Dietary Behavior (HAP-DB) measure) were developed, both with a 24-h recall period.ConclusionsThe qualitative analysis confirmed the substantial burden of AP associated with sHTG. This research resulted in development of two disease-specific PRO measures for use during and between attacks of AP. These measures are being utilized in a clinical trial, which will confirm content, structure, and psychometric properties.Electronic supplementary materialThe online version of this article (10.1007/s41669-019-0155-y) contains supplementary material, which is available to authorized users.

Quantum Security Analysis of AES

In this paper we analyze for the first time the post-quantum security of AES. AES is the most popular and widely used block cipher, established as the encryption standard by the NIST in 2001. We consider the secret key setting and, in particular, AES-256, the recommended primitive and one of the few existing ones that aims at providing a post-quantum security of 128 bits. In order to determine the new security margin, i.e., the lowest number of non-attacked rounds in time less than 2128 encryptions, we first provide generalized and quantized versions of the best known cryptanalysis on reduced-round AES, as well as a discussion on attacks that don’t seem to benefit from a significant quantum speed-up. We propose a new framework for structured search that encompasses both the classical and quantum attacks we present, and allows to efficiently compute their complexity. We believe this framework will be useful for future analysis.Our best attack is a quantum Demirci-Selcuk meet-in-the-middle attack. Unexpectedly, using the ideas underlying its design principle also enables us to obtain new, counter-intuitive classical TMD trade-offs. In particular, we can reduce the memory in some attacks against AES-256 and AES-128.One of the building blocks of our attacks is solving efficiently the AES S-Box differential equation, with respect to the quantum cost of a reversible S-Box. We believe that this generic quantum tool will be useful for future quantum differential attacks. Judging by the results obtained so far, AES seems a resistant primitive in the post-quantum world as well as in the classical one, with a bigger security margin with respect to quantum generic attacks.