Author Attribution of Binaries (available)

Attributing binaries, whether malicious or benign, is a difficult and time consuming task however, there is an increase demand for this either for attributing cyber attacks or preventing plagiarism. The goal of this project is to use machine learning to predict authorship of binaries. You will use a corpus of open source software either for … full description “Author Attribution of Binaries (available)”

Building a dataset of IoT device firmwares (available)

Performing security analysis of IoT devices is often expensive as it requires purchasing the IoT device, which is not practical at scale. To avoid this some researchers perform security analysis over the apps used by those IoT devices. Although this analysis can be useful it has some limitations as only one element of the ecosystem … full description “Building a dataset of IoT device firmwares (available)”

Control Flow Graph Reconstruction using Control-Flow Integrity (ongoing)

Control flow graphs (CFGs) show the set of possible flows a computer program can have at run-time, in particular, how a certain target can be reached inside (binary) code. CFG are incredibly useful in almost any program analysis technique. For example, when reverse engineering, the control flow graph is the main component to build on … full description “Control Flow Graph Reconstruction using Control-Flow Integrity (ongoing)”

Detecting broken security in hybrid Android apps (completed)

Many modern Android applications make use of a webview – a component providing easy access to the rendering engine and JavaScript interpreter of a full browser. The content shown by a webview can be loaded from a local resource or a remote server via HTTP and integrates seamlessly with the app. Webviews are popular with developers, … full description “Detecting broken security in hybrid Android apps (completed)”

Disassembling x86 binaries for static analysis and reverse engineering (completed)

The Jakstab static analyser for binaries automatically disassembles x86 binaries for Windows or Linux and reconstructs a control flow graph. It is particularly effective on targets that have been obfuscated with various tricks that throw off regular disassemblers such as IDA Pro. Jakstab disassembles one instruction at a time, translates it into an intermediate language, and then … full description “Disassembling x86 binaries for static analysis and reverse engineering (completed)”

Invisible Malware using Intel SGX Enclaves (available)

A fundamental security problem when hosting applications on cloud platforms is the increased risk of sensitive data loss (e.g. due to negligent or malicious employees of the cloud provider). An exciting approach to mitigating such attacks are new trusted execution environments (e.g. Intel SGX), recently available on commodity CPUs. Intel SGX allows users to create … full description “Invisible Malware using Intel SGX Enclaves (available)”

Machine Learning vs Machine Learning in Malware Evasion (available)

Machine learning is a popular approach to signature-less malware detection because it can generalize to new (unseen) malware families. Some recent works have proposed the use of AI/ML-powered malware to bypass machine learning anti-malware systems. The goal of the project is to model the system of malware vs anti-malware systems as two opponents using various … full description “Machine Learning vs Machine Learning in Malware Evasion (available)”

Mathematical Modelling of Cyber-Attackers vs Defenders using AI/ML (available)

Machine learning is a popular approach to signature-less malware detection because it can generalize to new (unseen) malware families. Some recent works have proposed the use of AI/ML-powered malware to bypass machine learning anti-malware systems (for instance, adversarial machine learning). The goal of the project is to model the system of malware vs anti-malware systems … full description “Mathematical Modelling of Cyber-Attackers vs Defenders using AI/ML (available)”

Predicting Debug Symbols for Closed Source Binaries (completed)

Reverse engineering binaries, whether malicious or benign, is made more difficult by the absence of debug information. Variables and functions have had their identifiers “stripped”, so reverse engineers have to manually name them during analysis based on human understanding of the code functionality. The goal of this project is to use machine learning to predict … full description “Predicting Debug Symbols for Closed Source Binaries (completed)”

Security Evaluation of Broadcasting Network – Protecting the Entertainment Media (available)

Project Description With an increase in the use of internet technologies in various fields, the traditional broadcasting industry also started to adopt systems, software and services based on internet technologies to provide their contents to viewers. Most of the connected media devices deployed still tend to have a low-security threshold inherited from the era of … full description “Security Evaluation of Broadcasting Network – Protecting the Entertainment Media (available)”

System Provenance Collection from a Client Workstation (completed)

A client workstation in an enterprise network is used by individual employees. They use this workstation to perform different activities, including accessing the data stored in the enterprise data repositories (i.e., Database). These activities, which relate to accessing the data and then using it on a workstation are the crucial missing element in data compliance … full description “System Provenance Collection from a Client Workstation (completed)”

System Provenance Collection from a Database Server (completed)

A database server is a collection of an Operating System (OS) at its core that hosts a database – accessible from various services and devices in an enterprise network. The activities observed on the database server are of immense importance to show compliance with data governance policies. A crucial element of such a compliance is … full description “System Provenance Collection from a Database Server (completed)”

Virtual Trusted Platform Module (vTPM) Migration in Cloud Environments (available)

TPM (Trusted Platform Module) is a computer chip (microcontroller) that can securely store artifacts used to authenticate a computer platform. For instance, a TPM can be used to store platform measurements that help ensure that the platform remains trustworthy. Authentication (ensuring that the platform can prove that it is what it claims to be) and … full description “Virtual Trusted Platform Module (vTPM) Migration in Cloud Environments (available)”