Cybersecurity Commons^™

Semantic Shields: Automating Critical Infrastructure Defense Via Nlp-Driven Ransomware Profiling, Henry Trowbridge, Ian Zalcberg, Ryan Schley, Carter Yagemann, Natasha Phan, Srikar Maduposu, Vimal Buck

Military Cyber Affairs

Ransomware poses a growing threat to critical infrastructure, where successful attacks can disrupt operational technology (OT) and industrial control systems (ICS) with significant public safety consequences. However, attributing ransomware incidents to specific threat actors remains challenging due to ransomware-as-a-service ecosystems, actor rebranding, and the obfuscation of traditional indicators of compromise. This paper presents Semantic Shields, an NLP-driven attribution framework that leverages BERT-generated semantic embeddings and DBSCAN clustering to profile ransomware actors through the linguistic characteristics of ransom notes. Using a dataset of 295 ransom notes from 189 distinct threat groups, the framework achieved an 87.2% true positive clustering rate and …

Using Siamese Neural Networks To Effectively Detect Trojans In Fpgas When Trojans Manipulate Encryption Operations At The Bitstream Level, Kylie Arnett

Graduate Theses and Dissertations (2019 - present)

This research investigates security vulnerabilities in Field-Programmable Gate Arrays (FPGAs) at the bitstream level, focusing on hardware trojans (HTs) that manipulate encryption operations. This study addresses two critical questions: (1) The feasibility of exploiting FPGA bitstreams to selectively bypass encryption operations when a predefined input pattern is observed (all ones), thereby exposing sensitive data, and (2) the efficacy of Siamese Neural Networks (SNNs) in detecting such trojans with high accuracy. FPGAs are vulnerable to malicious modifications during manufacturing or deployment, posing risks to data integrity and system functionality. In this work, a trojan is inserted into a Xilinx series-7 FPGA …

Weavecc: Symbolically-Guided Joint Exploration Of Inputs And Schedules For Concurrency Bug Detection, William Philip Dinauer

Dartmouth College Master’s Theses

Concurrent programs introduce a class of bugs that depend jointly on both program inputs and thread schedules. Exposing these bugs requires simultaneously reasoning about which code paths are reachable and which thread interleavings are possible. At the same time, many existing tools handle the problem insufficiently. Race detectors observe only the interleavings that the OS happens to produce. Fuzzers explore inputs without controlling schedules. Tools that address both dimensions together exist, but are built on interpretation-based symbolic executors that incur considerable overhead.

We present WeaveCC, a practical concurrency testing tool for C/C++ programs that jointly explores inputs and thread schedules. …

Automated, Modular, Agentless Adversarial Emulation In Cloud Environments For Higher Education And Student Training, Doc Harley

Senior Honors Theses

Currently, the leading technologies in the market of adversarial emulation are MITRE Caldera, Atomic Red Team by IBM, and multiple proprietary products that come with support packages for different vendors like AttackIQ, Cymulate, SafeBreach, and many more. While it is clear that much work has been done in the broad category of adversarial emulation, when it comes to open source solutions, there are no agentless options with built in automation and modularity that have good support for cloud environments. Agentless adversarial emulation provides a unique advantage in that it can be both simpler and a better representation of the true …

Large-Scale File Fragment Classification Via Multi-View Learning, Samuel Hildebrand

LSU Master's Theses

File reassembly is one of the most fundamental tasks in digital forensics, enabling recovery of data from potentially damaged storage media even when file system metadata is unavailable. This thesis reviews more than two decades of work in the realm of file carving, with a particular focus on fragmented file carving, which remains a focus of research, and file fragment classification, a principal component of fragmented file carving. This thesis serves a literature review of both file carving and fragmented file carving, surveys the massive amounts of data needed for the task of fragment classification and the datasets that serve …

From Network Packets To Physical Consequences: Network-Level Spoofing And Loss Of Visibility In Industrial Control Systems, Lillian B. Beck

LSU Master's Theses

Industrial Control Systems (ICS) are the foundation of critical infrastructure as they provide resources like clean water, electricity, and natural gas to support our everyday functions. Given their essential role in modern society, the failure or compromise of ICS systems can lead to significant negative consequences and public safety impacts. Understanding how these systems can be targeted and exploited by malicious actors is necessary to improve their security and resilience.

This research examines how an attacker could manipulate a real-world ICS network by targeting a fully functional Natural Gas (NG) Compressor Station Platform that emulates real operations. This research led …

Defending A Soho Network Against Mitm Attacks, Braeden J. Wise

Williams Honors College, Honors Research Projects

Cybersecurity is a vast domain that consists of many threats that target sensitive information found on wired and wireless networks. One of those threats is a man-in-the-middle (MITM) attack, which involves an attacker situating themselves between a sender and a receiver to intercept or redirect network traffic. These kinds of attacks can run rampant on a small office home office (SOHO) network due to the vulnerabilities and lack of enterprise level tools. The intent of this project is to perform and defend against MITM attacks for a SOHO network. In the context of the project, three MITM attacks will be …

Analyzing Network Traffic And Data Exfiltration Via Smb In Post-Vm Escape Scenarios, Noah M. Disanza

Williams Honors College, Honors Research Projects

Virtual machines (VMs) play a crucial role in modern IT infrastructure environments by providing isolation and enhanced security, among other things, for both personal and corporate systems. VMs are heavily rely upon to safely test malware, manage infrastructure, and reduce risk to host systems. This reliance is so substantial that the idea of reducing risk to the host system is believed to be erasing risk entirely. However, this mindset has shown to be challenged time and time again by the emergence of exploits known as virtual machine escapes. These exploits allow malicious actors to break out of the virtualized environment …

Secure The Database: A Red Team, Blue Team Analysis Of Sql Injection, Andrew N. Miller

Williams Honors College, Honors Research Projects

SQL injection (SQLi) attacks are a type of cyberattack that seeks to bypass website logins and gain entry to sensitive information. These pose a significant danger to organizations holding confidential user information. Personally Identifiable Information (PII) like physical addresses, emails, phone numbers, social security numbers are at risk of theft. Login credentials like usernames, passwords, and other sensitive information like financial details and social security numbers are also exposed through SQLi attacks. SQLi attacks harm the confidentiality, integrity, and availability of people’s identity. Additionally, data breaches that reach public battention harm the reputation and trust of organizations. SQLi attacks rank …

Gem-Can: A Real-World Dataset Of Can-Bus Attack Scenarios On An Autonomous Vehicle For Intrusion-Detection Research, Mahsa Tavasoli, Abdolhossein Sarrafzadeh, Ali Karimoddini, Tienake Phuapaiboon, Milad Khaleghi, Daniel Tobias

Electrical & Computer Engineering Faculty Publications

This paper presents GEM-CAN, a labelled Controller Area Network (CAN) dataset captured from an autonomous GEM e6 platform under both normal operation and controlled cyber-attack conditions.

The dataset contains ∼143 K frames comprising (i) ∼ nominal autonomous operation (∼100k messages), (ii) DoS floods using arbitration ID 0 × 00000000 (∼41 K messages), and (iii) data-tampering injections that reuse legitimate IDs for brake and steering-lock (∼1.3 K messages). Each record includes timestamp, arbitration ID (11/29-bit), DLC, eight payload bytes, and a Normal/Attack label. A companion metadata file enumerates attack windows, PCAN bus-load traces, bitrate, and test conditions. Data were collected with …

Ai-Driven Penetration Testing For Arm Systems: A Comprehensive Framework With Experimental Validation, Matthew Ragsdale

College of Graduate Studies: Theses & Dissertations

The convergence of artificial intelligence and cybersecurity presents new opportunities for automated penetration testing capable of discovering, prioritizing, and remediating vulnerabilities at machine speed. However, deployment on resource-constrained ARM platforms remains unexplored despite ARM’s dominance in mobile, IoT, and edge computing with over 280 billion chips deployed globally. This thesis presents systematic experimental evaluation of AI-driven penetration testing across four paradigms—traditional machine learning, deep learning, large language models, and reinforcement learning—on three ARM platform tiers: Raspberry Pi 5 (8GB, Cortex-A76), Radxa ROCK 5B Plus (16GB LPDDR5 with NPU), and NVIDIA Jetson Nano (4GB with Maxwell GPU). The experimental framework generates …

Toward Secure And Practical Machine Learning-Based Access Control: A Framework With Real-World Constraints And Adversarial Analysis, Olusesi Balogun, Mohammad Ghasemigol, Zhipeng Cai, Daniel Takabi

School of Cybersecurity Faculty Publications

Attribute-Based Access Control (ABAC) frameworks coordinate access requests based on subject, object, and environment attributes, as well as policy rules, and are widely used in corporate security systems. Recently, machine learning has been applied to ABAC to address policy-generation imbalances, misassigned privileges, and attribute leakages. However, existing MLBAC techniques do not consider the structural constraints and attribute interdependencies present in traditional ABAC systems. Moreover, these frameworks have not been extensively evaluated under black-box attack scenarios. To address these gaps, we propose extensions to MLBAC that integrate structural constraints, attribute dynamism, and attribute weighting into the MLBAC objective function. Additionally, we …

Confidential, Attestable, And Efficient Inter-Cvm Communication With Arm Cca, Sina Abdollahi, Amir Al Sadi, Marios Kogias, Hamed Haddadi, David Kotz

Other Faculty Materials

Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries such as the hypervisor. While they provide strong isolation guarantees, existing CVM architectures lack first-class mechanisms for inter-CVM data sharing due to their disjoint memory model, making inter-CVM data exchange a performance bottleneck in compartmentalized or collaborative multi-CVM systems. Under this model, a CVM's accessible memory is either shared with the hypervisor or protected from both the hypervisor and all other CVMs. This design simplifies reasoning about memory ownership; however, it fundamentally precludes plaintext data sharing between CVMs because all inter-CVM communication must pass through hypervisor-accessible …

Nonlinear Phase Space Analysis For Anomaly Detection In Ros 2 Communications: Detecting Man-In-The-Middle Attacks In Simulated Environments, William L. Locklier

Graduate Theses and Dissertations (2019 - present)

Robot Operating System 2 (ROS 2) marks a significant advancement over its predecessor through the transition from a centralized to a decentralized architecture, integrating the Data Distribution Service (DDS) to support real-time, scalable communications. Despite these improvements, inherent vulnerabilities in the ROS 2 communication stack continue to leave these systems exposed to sophisticated network-based attacks. This study leveraged nonlinear phase space analysis (NLPSA) as an intrusion detection system (IDS) to detect man-in-the-middle (MitM) attack anomalies in ROS 2 traffic. Grounded in Takens’ embedding theorem, NLPSA reconstructs the phase space of communication features and compares the resulting structure against a baseline …

Out-Of-Band Anomaly Detection For Real Time Operating Systems, Jeffrey K. Holifield

Graduate Theses and Dissertations (2019 - present)

Real Time Operating Systems (RTOS) are increasing present throughout the industrial, business, defense, and healthcare spaces. These lightweight and efficient operating systems are designed to run on embedded, resource constrained devices, often within cyber-physical systems (CPS). A defining characteristic ofRTOSs is that they are deterministic. Tasks are scheduled to run on fixed timelines within guaranteed execution windows. In Industry 4.0 applications for example, sensors must receive and process inputs within a fixed schedule to ensure products are properly manufactured. This requires guaranteed service at fixed time periods. To accomplish this, RTOSs must conform to worst case execution times (WCETs) as …

Leveraging P4 Programmable Switches For Resilient Operation And Design Of Phasor Measurement Unit Networks, Eva Casto

Electrical Engineering and Computer Science Undergraduate Honors Theses

The power grid utilizes a device called the phasor measurement unit (PMU), allowing power system administrators to remotely monitor and manage the state of the grid in Wide Area Monitoring Systems (WAMS). The advantages of PMUs – such as fine-grained, time-synchronized measurements and efficient, decentralized monitoring – are what make them key devices in the power grid. However, PMU technology also comes with new threats of the digital age, like malfunctions and cyberattacks, which can result in missing and faulty measurements that compromise power grid observability. P4 programmable networks can be used to detect faulty PMU data in a decentralized, …

Out-Of-Band Anomaly Detection For Real Time Operating Systems, Jeff K. Holifield

Shelby Hall Graduate Research Forum Posters

Real Time Operating Systems (RTOS) are increasing present throughout the industrial, business, defense, and healthcare spaces. These lightweight and efficient operating systems are designed to run on embedded, resource constrained devices, often within cyber-physical systems (CFS). A defining characteristic of RTOSs is that they are deterministic. Tasks are scheduled to run on fixed timelines within guaranteed execution windows. To accomplish tasks on time, real time software must conform to worst case execution times (WCETs) as design parameters. WCET is the maximum time a particular task can take to complete. Exceeding the WCET could cause system failure and lead to damage, …

Using Machine Learning Models To Improve The Cyber Physical Security Of Drones, Sean Lee, Aviv Segev

Shelby Hall Graduate Research Forum Posters

This research proposes a new manner of implementing machine learning models such that, when applied on a drone, it will be able to accurately identify and maintain the authenticity of the entity sending the control data to the drone. To begin with, the drone will, for a pre-determined amount of signals received per unit time, determine the average signal strength (RSSI) of them and use that average to determine the approximate distance between the drone and the source of those signals. This single data point will be fed into a custom implementation of the SCluStream algorithm (a real-time clustering machine …

Computing In The Commonwealth: Specialized Education In Computer Science And Information Technology For High School Students In Virginia – An Environmental Scan, Amy Corning, Jonathan D. Becker, Jon Graham, James Carrigan, Keisha Tennessee

ICRE Publications

Over the past two decades, Virginia has invested substantially in STEM education, in part through specialized programs focused on computer science and information technology (CS/IT). This study represents the first effort to identify Virginia’s specialized secondary CS/IT programs and examine them collectively. Findings from the statewide environmental scan indicate that the programs are delivered through a wide variety of institutional structures, including Governor’s STEM Academies, Governor’s Schools, specialty centers, and academies, but most often through Career and Technical Education (CTE) centers. Programs tend to be concentrated in metropolitan areas, and some rural divisions may not be served. The programs provide …

A Comprehensive Exploration Of 6g Wireless Communication Technologies, Md Nurul Absar Siddiky, Muhammad Enayetur Rahman, Md. Shahriar Uzzal, H. M. Dipu Kabir

Electrical & Computer Engineering Faculty Publications

As the telecommunications landscape braces for the post-5G era, this paper embarks on delineating the foundational pillars and pioneering visions that define the trajectory toward 6G wireless communication systems. Recognizing the insatiable demand for higher data rates, enhanced connectivity, and broader network coverage, we unravel the evolution from the existing 5G infrastructure to the nascent 6G framework, setting the stage for transformative advancements anticipated in the 2030s. Our discourse navigates through the intricate architecture of 6G, highlighting the paradigm shifts toward superconvergence, non-IP-based networking protocols, and information-centric networks, all underpinned by a robust 360-degree cybersecurity and privacy-by-engineering design. Delving into …

Dynamic Analysis Of Malware Detection Using Customized Payloads: Examining The Effectiveness Of Manual And Automated Approaches In Web Applications, Jiban Krisna Das

College of Graduate Studies: Theses & Dissertations

Web applications are becoming the prime targets for cyber-attacks, where SQL injection (SQLi) and Cross Site Scripting (XSS) are the most exploited vulnerabilities. The study explores a novel approach using customized payloads to examine the effectiveness of manual and automated techniques of malware detection. This dynamic approach can effectively generate attack payloads and identify the vulnerabilities in a website thereby strengthening website security measures. This research focuses on dynamic analysis in a controlled environment while testing and analyzing SQL and XSS payloads under varying security conditions. This quantitative analysis involves crafting targeted payloads to bypass Web Application Firewall (WAF) filters …

Qos-Aware Link Adaptation For Beyond 5g Networks: A Deep Reinforcement Learning Approach, Ali Parsa, Neda Moghim, Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

Modern wireless communication systems face increasingly complex challenges due to rapidly changing channel conditions and the growing diversity of application-specific Quality of Service (QoS) requirements. Traditional link adaptation mechanisms primarily aim to maximize throughput and often lack the flexibility to support emerging applications, such as Extended Reality (XR) and Virtual Reality (VR), which demand simultaneous guarantees for high data rates, ultra low latency, and high reliability. These stringent and multidimensional QoS needs call for more intelligent and adaptive solutions. In this paper, we propose QDRLLA (QoS-aware Deep Reinforcement Learning-based Link Adaptation), a novel framework that employs deep reinforcement learning to …

A Trust-By-Learning Framework For Secure 6g Wireless Networks Under Native Generative Ai Attacks, Md Shirajum Munir, Sravanthi Proddatoori, Manjushree Muralidhara, Trinidad Mario Dena, Walid Saad, Zhu Han, Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

Sixth-generation (6G) wireless networks will become vulnerable due to native generative AI (GenAI)-driven intelligent poisoning attacks in both the radio unit and the core network. In particular, network parameters and metrics in cross-layer design pose fundamentally uncertain conditions and can be compromised through the native GenAI mechanism, which leverages data augmentation and reconstruction capabilities. This work investigates the capabilities of native GenAI to create novel poisoning attacks in wireless networks, while investigating their impact through uncertainty-informed root analysis. Then, detected attacks are mitigated by developing a trustworthy service aggregation in the wireless network. First, a joint decision problem is formulated …

Sting: A Stealthy Backdoor Attack On Gnn-Based Malicious Domain Detection Via Dns Perturbations, Muhammad Anan, Mahmoud Nazzal, Abdallah Khreishah, Issa Khalil, Nhathai Phan, Ahmad Sawalmeh

Computer Science Faculty Publications

Detecting malicious Internet domains is essential for safeguarding against various online threats. The current approach to detecting malicious domains (MDD) employs a graph neural network (GNN) method, which uses DNS logs to construct heterogeneous graphs for determining the maliciousness of unknown domains. Despite its success, this method is vulnerable to data poisoning attacks where an adversary can manipulate specific graph nodes to implant a backdoor into the model during training. To showcase the vulnerability, we propose a stealthy trigger injection attack on node features and graph structure in MDD, dubbed (STING). The attacker carefully manipulates selected features and edges of …

Nexus: Network Exploration For Exploiting Unsafe Sequences In Multi-Turn Llm Jailbreaks, Javad Rafiei Asl, Sidhant Narula, Mohammad Ghasemigol, Eduardo Blanco, Daniel Takabi

Computer Science Faculty Publications

Large Language Models (LLMs) have revolutionized natural language processing, yet remain vulnerable to jailbreak attacks—particularly multi-turn jailbreaks that distribute malicious intent across benign exchanges, thereby bypassing alignment mechanisms. Existing approaches often suffer from limited exploration of the adversarial space, rely on hand-crafted heuristics, or lack systematic query refinement. We propose NEXUS (Network Exploration for eXploiting Unsafe Sequences), a modular framework for constructing, refining, and executing optimized multi-turn attacks. NEXUS comprises: (1) ThoughtNet, which hierarchically expands a harmful intent into a structured semantic network of topics, entities, and query chains; (2) a feedback-driven Simulator that iteratively refines and prunes these chains …

Microsegmented Cloud Network Architecture Using Open-Source Tools For A Zero Trust Foundation, Sunil Arora, John Hastings

Research & Publications

This paper presents a multi-cloud networking architecture built on zero trust principles and micro-segmentation to provide secure connectivity with authentication, authorization, and encryption in transit. The proposed design includes the multi-cloud network to support a wide range of applications and workload use cases, compute resources including containers, virtual machines, and cloud-native services, including IaaS (Infrastructure as a Service), PaaS (Platform as a service). Furthermore, open-source tools provide flexibility, agility, and independence from locking to one vendor technology. The paper provides a secure architecture with micro-segmentation and follows zero trust principles to solve multi-fold security and operational challenges.

Real-Time Network Simulations For Ml/Dl Ddos Detection Using Docker, Luis D. Garcia

Master's Theses

As the integration of artificial intelligence (AI) within cybersecurity continues to

grow, machine learning (ML) and deep learning (DL) models are increasingly used to

detect cyber attacks. However, these models are rarely evaluated in real-time attack

scenarios to see how subtle changes from the real networking environment can affect

their predictions. To address this issue, we propose a scalable, platform-independent

Docker testbed specifically designed for simulating real-time Distributed Denial of

Service (DDoS) attack scenarios that allows researchers to deploy and evaluate their

pre-trained, ML and DL detection models. Our framework is simple to configure

and can run across Intel and …

A Dynamical Systems Approach For Modeling Malware Propagating Through A Network And Potential Solutions Towards Mitigating Spread, James Johnson

Cybersecurity Undergraduate Research Showcase

Many people draw close parallels between malware propagating through a network and an epidemic spreading through a population. Epidemics are often modeled by a Susceptible-Infected-Recovered (SIR) model, in which a similar system of equations can model the spread of a virus through a computer network, and can be simplified when making assumptions about the network itself and its fixed number of nodes and edges. In this instance, malware propagating in a network also should reflect the network it is propagating through, in which the dynamical system will factor in the nodes of the network and their properties. The system itself …

Setc: A Vulnerability Telemetry Collection Framework, Ryan Holeman, John Hastings, Varghese Mathew Vaidyan

Research & Publications

As emerging software vulnerabilities continuously threaten enterprises and Internet services, there is a critical need for improved security research capabilities. This paper introduces the Security Exploit Telemetry Collection (SETC) framework - an automated framework to generate reproducible vulnerability exploit data at scale for robust defensive security research. SETC deploys configurable environments to execute and record rich telemetry of vulnerability exploits within isolated containers. Exploits, vulnerable services, monitoring tools, and logging pipelines are defined via modular JSON configurations and deployed on demand. Compared to current manual processes, SETC enables automated, customizable, and repeatable vulnerability testing to produce diverse security telemetry. This …

A Survey Of Unikernel Security: Insights And Trends From A Quantitative Analysis, Alex Wollman, John Hastings

Research & Publications

Unikernels, an evolution of LibOSs, are emerging as a virtualization technology to rival those currently used by cloud providers. Unikernels combine the user and kernel space into one ``uni''fied memory space and omit functionality that is not necessary for its application to run, thus drastically reducing the required resources. The removed functionality is significant however, and includes components that have become common security technologies such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Non-executable bits (NX bits). This raises questions about the security of unikernels. This research presents a quantitative methodology using TF-IDF to analyze the focus …