Conference rankings are useful, but they become misleading when they are read as a single universal leaderboard. In systems and network security, the better question is usually this: which conference is the natural home for this specific kind of work?

I looked at ranking-oriented resources such as ConferenceRanks, CSRankings, CS Conferences, CORE/ICORE, and the CCF recommended conference lists as signals. They do not all use the same methodology, and they should not be treated as perfect ground truth. Still, they make one thing clear: systems security sits between three neighboring worlds.

The Short Version

For computer security and network security, the canonical top-tier targets are usually:

Area	Strongest general targets	When they fit best
Security	IEEE S&P, USENIX Security, CCS, NDSS	System security, network security, malware, privacy, isolation, applied security, usable security
Networking	SIGCOMM, NSDI, INFOCOM, CoNEXT	Protocols, network measurement, datacenter networking, routing, middleboxes, networked systems
Systems	SOSP, OSDI, ASPLOS, USENIX ATC, EuroSys	Operating systems, virtualization, storage, distributed systems, architecture, performance, systems security

If I had to make a practical mental model for my own field, I would use this:

1. Security contribution first: submit to IEEE S&P, USENIX Security, CCS, or NDSS.
2. Networking contribution first: submit to SIGCOMM, NSDI, INFOCOM, or CoNEXT.
3. Systems contribution first: submit to SOSP, OSDI, ASPLOS, ATC, or EuroSys.
4. Measurement-heavy security work: consider whether the strongest audience is security, networking, or Internet measurement.
5. Implementation-heavy security work: choose based on whether the paper’s core novelty is the threat model, the system design, or the performance story.

Security: The Top Four

For security researchers, the four names that appear most consistently as flagship venues are IEEE Symposium on Security and Privacy, USENIX Security Symposium, ACM CCS, and NDSS.

These are the natural targets when the main contribution is a security idea: a new attack, defense, measurement of abuse, vulnerability analysis, malware detection method, privacy mechanism, or system security design. In practice, each venue has its own taste.

Conference	How I read it
IEEE S&P	Very strong for rigorous security, privacy, cryptographic systems, formal or principled security analysis, and broad security impact.
USENIX Security	Excellent for practical security systems, attacks, defenses, measurement, applied work, and clear empirical evaluation.
CCS	Broad and highly competitive, spanning systems security, privacy, cryptography, web security, ML security, and applied security.
NDSS	Strong for network and distributed systems security, protocol security, web security, and deployable security mechanisms.

For network security, NDSS and USENIX Security often feel especially natural, but IEEE S&P and CCS are absolutely top-tier targets when the contribution is broad enough.

Networking: Where Networked Systems Live

Network security research often crosses into networking. If the main novelty is a network mechanism, measurement method, protocol behavior, or large-scale Internet observation, the networking venues may be the better audience.

Conference	How I read it
SIGCOMM	The flagship venue for computer networking. Best for major networking ideas with broad conceptual impact.
NSDI	A very strong home for networked systems, datacenter systems, distributed infrastructure, and practical systems with strong evaluation.
INFOCOM	Broad networking venue, often strong for algorithms, protocols, performance analysis, and network measurement.
CoNEXT	Strong for emerging networking ideas, measurement, protocols, and experimental networked systems.

For a security systems researcher, this matters because a paper about DDoS mitigation, routing abuse, censorship measurement, traffic analysis, or datacenter isolation might be read differently depending on whether the main contribution is a security claim or a networking claim.

Systems: The Infrastructure Side

Systems venues matter when the paper is not only about security but about building or modifying core infrastructure: operating systems, hypervisors, storage, distributed runtimes, cloud platforms, or hardware-software boundaries.

Conference	How I read it
SOSP	One of the highest-prestige systems venues, best for deep operating systems and distributed systems contributions.
OSDI	Similar prestige to SOSP, often strong for practical systems with substantial design and evaluation.
ASPLOS	Strong when the work connects architecture, programming languages, operating systems, and hardware-software co-design.
USENIX ATC	Excellent for practical systems work with clear implementation and evaluation.
EuroSys	Strong European systems venue, often a good fit for operating systems, distributed systems, and cloud infrastructure.

This is especially relevant for systems security. A paper about kernel isolation, hypervisor introspection, DPU-based monitoring, confidential computing, sandboxing, or cloud isolation may have two possible homes: a security venue if the security claim is central, or a systems venue if the systems mechanism and evaluation are the main story.

A Practical Ranking Map

Here is the way I would group the venues for a systems and network security research roadmap.

Tier	Security	Networking	Systems
Flagship	IEEE S&P, USENIX Security, CCS, NDSS	SIGCOMM, NSDI	SOSP, OSDI
Very strong	RAID, ACSAC, ESORICS, PETS	INFOCOM, CoNEXT, IMC	ASPLOS, USENIX ATC, EuroSys
Specialized	WiSec, DIMVA, AsiaCCS, FC	PAM, ANRW, HotNets	Middleware, FAST, HotOS, SoCC

This table is not meant to say that every paper in one row is better than every paper in another row. It is a map of audience, selectivity, and reputation. A great specialized paper in RAID, IMC, FAST, or WiSec can be much more relevant to your work than a loosely related paper from a flagship conference.

How I Would Choose a Target

When choosing a conference, I would ask five questions.

1. What is the core contribution? If the novelty is an attack or defense, start with security. If it is a protocol or network behavior, start with networking. If it is an infrastructure design, start with systems.
2. Who should review this paper? Security reviewers, networking reviewers, and systems reviewers reward different evidence.
3. What evaluation will be considered convincing? A security venue may want threat models, ablations, bypass analysis, and real-world impact. A systems venue may demand scalability, performance, and clean design tradeoffs.
4. What papers does this work cite? If most related work comes from one venue family, that is usually a strong signal.
5. Where will the right readers find it? The best venue is not just prestigious. It is where the paper will be read by the people who can build on it.

My Takeaway

For my own direction, systems and network security, the center of gravity is:

• USENIX Security / NDSS / IEEE S&P / CCS for security-first work.
• NSDI / SIGCOMM for networking and networked systems.
• OSDI / SOSP / ATC / EuroSys / ASPLOS for systems-first infrastructure.

The useful ranking is not a single number. It is a field-aware map. A good paper should be sent to the venue whose community will understand the problem, value the method, and care about the result.