Cybersecurity Commons^™

Phishing Restraint: University Simulated Phishing Campaigns, Alexander M. Abou Khir

Cybersecurity Undergraduate Research Showcase

Universities face heightened vulnerability to phishing attacks due to their open information-sharing culture and diverse user populations. This study examines how phishing exploits human factors within campus environments and evaluates three major training strategies: embedded phishing, microlearning, and role-based instruction to understand their individual and combined effectiveness. I explored studies that implement these strategies in pairs and use the strategies alone, identified trends in susceptibility reduction, behavioral reinforcement, and contextual relevance. I suggest that, while each method independently improves user awareness, multiple approaches offer stronger, more adaptable protection by addressing both psychological triggers and role-specific risks. The paper contributes a …

Hijacking The Prompt: A Survey Of Prompt Injection Attacks, Detection, And Defense In Large Language Models, Edward J. Griggs

Cybersecurity Undergraduate Research Showcase

Prompt injection attacks, ranked the number-one vulnerability in AI systems by OWASP's 2025 Top 10 for Large Language Model Applications, remain largely unsolved, and this survey examines why. As large language models (LLMs) are deployed across enterprise workflows, agentic systems, and consumer tools, their fundamental inability to distinguish trusted instructions from untrusted user data has created a persistent and expanding attack surface. This paper presents a structured taxonomy of prompt injection attack vectors, including direct injection, indirect injection, multimodal attacks, tool and agent exploitation, hybrid chained techniques, and autonomous propagating threats. These vectors are mapped across five impact categories (data …

Limitations Of Signature-Based Network Intrusion Detection Under Modern Traffic Conditions, Henry Guidry

Cybersecurity Undergraduate Research Showcase

Network Intrusion Detection Systems are tools used to monitor network traffic and alert to suspicious or harmful activity before it can cause harm. Signature-based versions of these systems are a foundation for intrusion detection, operating by finding common patterns and forming malicious signatures. However, three developments in modern network environments have greatly impacted the significance of Network Intrusion Detection Systems. These three developments are the near-complete adoption of end-to-end encryption, the use of sophisticated packet fragmentation techniques, and the processing demands of high-throughput networks. Encryption makes deep packet inspection practically infeasible by transforming inspectable payloads into ciphertext, forcing NIDS to …

Artificial Intelligence Moderation In Online Gaming: A Cybersecurity Analysis Of Risks And Defenses, Labib Khan

Cybersecurity Undergraduate Research Showcase

This research paper will examine the role of artificial intelligence (AI) moderation systems in enhancing cybersecurity within online gaming environments. As multiplayer platforms increasingly rely on real-time text, voice communication, and user-generated content, developers have implemented AI-driven tools such as natural language processing (NLP), speech recognition, and behavioral analytics to detect harassment, toxic behavior, cheating coordination, and other malicious activity. These systems enable gaming companies to efficiently monitor large volumes of player interactions, improving response times and helping maintain safer and more controlled digital environments for users across global gaming communities of varying sizes and activity levels.

While these technologies …

Escaping Isolation: An Analysis Of Virtual Machine And Container Breakout Vulnerabilities, Felix Iov

Cybersecurity Undergraduate Research Showcase

Cloud computing providers rely on multi-tenant architectures to maximize resource efficiency. This infrastructure depends on virtualization, which provides isolation between clients. This comes primarily in the form of Virtual Machines (VMs) and Containers. However, “breakout attacks” or “escapes” are a critical threat where attackers bypass these isolation layers to gain unauthorized access to the host system and neighboring environments. This paper surveys virtualization escape threats and analyzes three case studies: a runc container escape (Leaky Vessels), a VMware ESXi VM escape (VSOCKPuppet), and an NVIDIA GPU container escape (NVIDIAScape). Each demonstrates different attack surfaces, including file descriptor misuse, kernel driver …

Bio-Cybersecurity: Securing The Healthcare Industry, Amanda D. Coleman

Cybersecurity Undergraduate Research Showcase

Bio-cybersecurity refers to the aspect of cybersecurity that applies to the biological sciences and the protection of digital biomedical information. Today’s healthcare industry has evolved with the enhancement of internet and biomedical technology. While hospitals and private medical providers remain compliant with the Health Information Portability and Accountability Act (HIPAA) through traditional means of securing documented patient information, the emergence of beneficial internet-based healthcare services like virtual appointments and digital patient records requires new policies and healthcare cybersecurity frameworks to protect sensitive information from unauthorized access. This paper examines the role of cybersecurity in healthcare, the vulnerabilities that exist and …

Ai's Double Edged Sword: Fighting Against Synthetic Csam, Shekhinah Adra Green

Cybersecurity Undergraduate Research Showcase

The rapid advancements in generative artificial intelligence has introduced new challenges in the production and distribution of synthetic child sexual abuse material (CSAM). AI has the capabilities of creating highly realistic imagery and videos, which  raises serious legal and ethical concerns, increasing the risk of harm, exploitation, and revictimization.

This paper discusses the legal improvements needed in order to lower the change of legal loopholes, how digital forensic analyst use advanced tools to identify and investigate synthetic material, and different methods to start the reduction of synthetic CSAM.

Supply Chain Attacks Through Open Source Software: A Comprehensive Analysis Of Npm, Pypi, And Docker Hub Vulnerabilities, Thomas Pham

Cybersecurity Undergraduate Research Showcase

Open-source software ecosystems have become critical infrastructure for modern software development, yet they remain vulnerable to sophisticated supply chain attacks. This paper presents a comprehensive empirical analysis of supply chain attacks targeting npm, PyPI, and Docker Hub, examining 23 documented campaigns affecting over 2.6 billion weekly downloads. Through systematic analysis of attack vectors including typosquatting, dependency confusion, and maintainer account compromise, we identify recurring patterns and structural vulnerabilities across package registries. Our analysis reveals that 86.1% of detected typosquatted packages contained malware, with cryptocurrency theft emerging as the predominant attack objective. We document the September 2025 npm compromise affecting 18 …

Viability Of Widely Used Encryption Schemes In Drone Transmission, Emanuel Yasir Nelson

Cybersecurity Undergraduate Research Showcase

This paper presents throughout research on the security issues related to drone transmission. These topics were addressed and explained, in particular the aspects relating to cybersecurity, for utmost clarity. These include threats and vulnerabilities, drone transmission the impact of encryption on latency, and the details of the encryption methods AES-128, AES-256, and ChaCha20 that were used in the experiment described in the paper. Each encryption method performance was measured and outputted by the Python code developed and used in the experiment. Afterwards, the performance of each method was analyzed in relation to their decryption time, encryption time, end to end …

Rogue Access Points And Their Impact On Networks, Sami Belmokhtar

Cybersecurity Undergraduate Research Showcase

This paper focuses on rogue access points (rogue APs) and how they can impact the security and stability of a network, and consequently, the safety and privacy of the users. Wireless access points (WAPs) are nodes that allow a user to connect to a local network. This includes devices such as the routers typically used in a home network. This paper examines how an unauthorized WAP may pose a threat to a network in both a public environment and an enterprise environment. Furthermore, it shows how a hacker can mimic a real wireless network and gain access to both user …

Insider Threat: A Case Study Of The Maroochy Water Services Attack, Samuel Rector

Cybersecurity Undergraduate Research Showcase

In 2000, a former employee at Hunter Watertech went rogue and caused a spill of 800,000 liters of sewage. He leveraged his insider knowledge and access to stolen equipment in order to seek retribution for the company that wronged him. After three months of torment police arrested him and an investigation and many studies were done on the incident. A consensus remains that much of this chaos was preventable with simple cybersecurity implementations.

Behavioral Detection Methods For Automated Mcp Server Vulnerability Assessment, Christian Coleman

Cybersecurity Undergraduate Research Showcase

The Model Context Protocol (MCP) has emerged as a critical standard for connecting AI agents to external data sources and tools. Still, its adoption has introduced significant security vulnerabilities across multiple attack surfaces. While recent research has catalogued extensive vulnerability taxonomies and attack implementations, automated detection methodologies remain limited. Current detection tools primarily employ static code analysis, which fails to identify behavioral vulnerabilities that only manifest during runtime server interactions. This study explores behavioral detection approaches for identifying MCP server vulnerabilities through systematic query-based testing, with particular emphasis on context manipulation techniques. Preliminary analysis of existing vulnerability research reveals 48 …

Game Hacking & Anti-Cheat Analysis, Quang Hoang

Cybersecurity Undergraduate Research Showcase

Reverse engineering and analyzing game hacking and anti-cheat mechanisms is a complex and evolving field. This research document explores the history of game hacking, various techniques used in game hacking, and the countermeasures implemented by anti-cheat systems. Through case studies, we illustrate the strategies involved in creating cheats. Specifically, we demonstrate how to hack the open-source game AssaultCube using memory editing and code injection techniques available in Cheat Engine in a step-by-step manner so that the reader can theoretically reproduce the results shown in this paper. We also dissect the game’s anti-cheat mechanisms, identifying their strengths and weaknesses. This document …

A Scalable Cybersecurity Model For Academic Makerspaces, William Faircloth

Cybersecurity Undergraduate Research Showcase

Academic makerspaces have become integral hubs of innovation on university campuses, providing students with access to industrial-grade operational technology (OT) such as 3D printers and CNC machines. However, the security posture for these spaces has overwhelmingly focused on physical safety, creating a significant cybersecurity gap. This oversight leaves networked OT vulnerable to cyberattacks, which threaten student intellectual property, expensive equipment, and the integrity of the broader institutional network. This research addresses this critical vulnerability by developing and implementing a secure and scalable cybersecurity model at the Old Dominion University Computer Science Makerspace, founded on two core principles: robust network segmentation …

Deconstructing Tycoon 2fa: A Static Analysis Approach To Threat Intelligence And Automated Defense, Daniel A. Austin Jr

Cybersecurity Undergraduate Research Showcase

It's gotten much easier to be a cybercriminal. We're seeing a boom in "Phishing-as-a-Service" (PaaS) platforms, which sell advanced phishing attacks as a ready-to-use product. This means almost anyone can now get the tools to launch sophisticated attacks, even if they don't have a lot of technical skill.

This research dives into one of the most prominent threats, the Tycoon 2FA phishing kit. This kit is dangerous because it's designed to bypass Multi-Factor Authentication (MFA) using what is known as an Adversary-in-the-Middle (AiTM) attack.

This paper covers how I built and tested a set of Python-based tools to perform "static …

A Systematic Review Of Poisoning Attacks Against Large Language Models (Llm), Patrick Mcguffin

Cybersecurity Undergraduate Research Showcase

This paper provides a comprehensive review of poisoning attacks against large language models (LLMs), drawing primarily from Fendley et al. (2025) and complementary studies from 2022–2025. It categorizes poisoning research into two key dimensions, Metrics and Specifications, to evaluate how attack success is measured and how attacks are implemented. This paper synthesizes quantitative results, experimental findings, and defense strategies across data, model, and multi-modal poisoning contexts. Finally, it highlights emerging challenges posed by self-adaptive and synthetic-data-driven LLMs, and proposes future research directions to strengthen model security and reliability.

Detecting Generative-Ai-Enabled Polymorphic Malware: A Semantic-Behavior Approach, Allyson M. Morris

Cybersecurity Undergraduate Research Showcase

AI drastically reduces the effort required to produce malware that mutates both its code and behavior, thereby creating polymorphic and nondeterministic variants in which traditional signatures and many heuristic defenses fail. In this paper, I survey recent developments in AI-assisted malware generation, explain why conventional defenses are insufficient, and propose a layered detection architecture emphasizing semantic behavior, streaming anomaly detection, and defensive generative augmentation. I also outline why this approach generalizes to previously unseen AI-mutated samples, provide an evaluation plan with meaningful metrics, and describe a feasible MVP roadmap for practical deployment. Recent disclosures and threat intelligence further highlight the …

A Comprehensive Evaluation Of Next-Generation Firewall Effectiveness Against Encrypted And Evasive Threats In Enterprise Networks, John Costanzo, Favour Anene

Cybersecurity Undergraduate Research Showcase

Encrypted traffic is becoming a pillar of security and privacy in enterprise networks. According to Google Transparency Report, over 95 percent of internet traffic is encrypted with the use of Hypertext Transfer Protocol secure (HTTPS), Transport Layer Security (TLS) 1.3 and Quick UDP Internet Connections (QUIC). Although encryption safeguards confidentiality and integrity, it has also introduced new blind spots to the conventional security solutions. Encrypted channels are used to hide command-and-control (C2) traffic, issue malware and extract sensitive data without their notice.

To make the issue even harder, the opponents have sophisticated avoidance methods including traffic fragmentation, tunneling, and polymorphic …

Investigating The Security Vulnerabilities Of Ip Cameras: Classifications And Trends From Public Cve Data, Sam Oliver

Cybersecurity Undergraduate Research Showcase

Internet of Things (IoT) devices are increasingly targeted by cyber attacks due to weak authentication, insecure communication protocols, outdated firmware, and many other vulnerabilities. Internet Protocol (IP) cameras, a subset of these IoT devices, are particularly vulnerable and often transmit sensitive information. This paper analyzes vulnerability data from the National Vulnerability Database (NVD) to classify security vulnerabilities affecting IP cameras. Using this dataset, the paper examines the types and frequencies of these vulnerabilities, including authentication bypass, web interface exploits, and default and weak credentials. We additionally examine trends over time and across categories. This research aims to identify the primary …

"Exploring The Training Data Landscape For Ai Based Threathunting For Protecting Intellectual Property", Manzi Siibo, Christopher Kreider

Cybersecurity Undergraduate Research Showcase

This study provides a comprehensive evaluation of the effectiveness that would result in the integration of AI into traditional threat hunting systems. To do so, 10-15 scholarly articles and data sets were evaluated to see the results of AI and machine learning threat hunting versus traditional systems. With so many proven benefits of this integration, this paper also explores how it impacts the protection of Intellectual property which is some of the most important forms of information that threat hunting systems aim to protect.

Fids: Accelerating Network Intrusion Detection Through Strategic Feature Selection, James Elmore

Cybersecurity Undergraduate Research Showcase

Network intrusion detection systems (IDS) typically analyze complete network flows to identify malicious traffic, requiring flows to conclude before classification. This approach creates detection delays for attacks like Slowloris that intentionally keep connections open for extended periods of time. This paper introduces a novel approach that classifies network traffic using only features available from the first few packets of a flow, enabling faster detection while maintaining high accuracy. We evaluate three random forest models on the CICIDS2017 dataset using expanding sets of features: the first-packet model trained on on features available from the first backward packet, the few-packet model which …

The Evolution Of Russian And Chinese Disinformation Tactics And The Threat They Pose To The U.S. Cybersecurity, Jehovani Sese

Cybersecurity Undergraduate Research Showcase

This paper aims to discuss how disinformation has become the most powerful tool used against the United State by foreign operatives. Of these foreign operatives, Russia and China have shown the ability to use advanced tactics to truly affect the United States security. Often these tools came in the form of state-sponsored media, influence campaigns and fake online identities. This literature review explores the evolution of Russian and Chinese disinformation tactics, examining how these approaches have changed over time and become more sophisticated. This paper will highlight major campaigns which use tools such as bot networks, and social media manipulation. …

Shaped Adversarial Patches And The Ability They Hold, Nathan Hallberg

Cybersecurity Undergraduate Research Showcase

In more recent years the development of computer vision has advanced to be more comprehensive than in the past, with newer applications ranging from autonomous vehicles to security systems. The main application I will be talking about throughout this paper is an object detection algorithm called YOLO (You only look once), this algorithm is particularly significant due to their real-time performance of being able to identify and localize objects within an image in quick timing. However, the strength of these computer vision models is increasingly challenged by adversarial attacks, which manipulate the computer's vision to block a certain part of …

Elder Fraud Metrics And Preventative Measures Of Chesapeake, Virginia, Joey J. Whitmore Jr.

Cybersecurity Undergraduate Research Showcase

Geriatric crime continues to escalate in the digital era, where older individuals are disproportionately being targeted because of their low digital literacy and high susceptibility to online frauds. In this paper, we examine the breadth of elder fraud in Chesapeake, Virginia using FBI Internet Crime Complaint Center (IC3) data and state-level cybersecurity initiatives and survey responses. Older adults aged 60 and up have reported losses of over $3.4 billion in 2023 alone, underscoring the importance of proactive measures. It assesses the public awareness from traditional and AI-based perspectives revealing significant gaps in digital safety literacy and fraud reporting mechanism among …

Leveraging Benford’S Law And Machine Learning For Financial Fraud Detection, Benjamin R. Fu

Cybersecurity Undergraduate Research Showcase

Financial fraud, particularly credit card fraud, continues to pose substantial challenges to financial institutions due to its increasing frequency and impact on consumer trust. While traditional rule-based methods have provided foundational defenses, their limitations in scalability and adaptability have accelerated the adoption of machine learning (ML) techniques. Concurrently, Benford’s Law—a statistical principle often used in forensic accounting—has demonstrated efficacy in detecting anomalies within naturally occurring numerical datasets. This study explores a hybrid fraud detection approach that integrates Benford’s Law with supervised machine learning algorithms, including Logistic Regression, Random Forest, and k-Nearest Neighbors. Using the publicly available European credit card fraud …

Phishing Attacks And Prevention, Ruth Johnson

Cybersecurity Undergraduate Research Showcase

Phishing attacks have been the number one leading cause of identity theft and financial theft since 1990. The internet is one of the leading places where individuals’ identity is stolen. Many businesses and government agencies have been at risk of cyber phishing attacks from foreign countries. Attacks on Several U.S. federal government agencies have been hit in a global cyberattack by Russian cybercriminals that exploit a vulnerability in widely used software, according to a top us cybersecurity agency (Lyngaas, Government hit cyber-attacks, 2023).

Phishing attacks are cybercrimes where one or many individuals steal sensitive information like passwords, credit card information, …

How Can We Improve Our Security Measures To Safeguard Against Cyber Threats?, Mattea Trotter-Hicks

Cybersecurity Undergraduate Research Showcase

Many people face the issue of having their information stolen without their knowledge of what is happening. I understand that some people don’t pay attention to everything when it comes to making sure their information is being secured properly. There must be set stages for those who don’t know technology as well and will need help with knowing what to do. There are many stories of people going through issues with getting hacked or scammed out of their money or important information. We are going to dive into finding ways to fix the outcome of others knowing what to do …

Securing Biometric Data, Alyssa F. Carroll

Cybersecurity Undergraduate Research Showcase

Biometric data has been widely adopted across various sectors, including digital identity, artificial intelligence (AI), border control, digital wallets, and national identification systems. While biometric identifiers—such as fingerprints, retina scans, and facial recognition—offer reliable and convenient authentication, they also raise significant concerns regarding privacy and security. This paper examines how biometric data is stored, the vulnerabilities it faces, and the most effective methods for safeguarding it. By highlighting the critical importance of biometric data protection, this study reviews current research on approaches, strategies, and policies that enhance security while preserving the functionality and efficiency of biometric systems.

Leveraging Artificial Intelligence To Strengthen Human Resilience Against Phishing Attacks, Muhammad Mavins

Cybersecurity Undergraduate Research Showcase

Phishing attacks are a major cybersecurity threat, tricking people with fake emails, scam websites, and social engineering tactics. As these attacks become more advanced, traditional security measures are no longer enough to stop them. This paper looks at how Artificial Intelligence (AI) can help detect and prevent phishing while also making people more aware of these threats. Using machine learning (ML), natural language processing (NLP), and behavioral analysis, AI can examine email content, sender behavior, and metadata to spot phishing attempts. AI-powered cybersecurity training can also teach people to recognize and respond to phishing by using personalized phishing tests and …

Digital Humanities: Using Computational Methods On Literature To Understand Human-Water Relations, Ariel Yang

Cybersecurity Undergraduate Research Showcase

By using computational techniques to analyze literature, deeper insights can be gained into human-water relationships across different historical and cultural contexts. Natural Language Processing (NLP) and other data science methods can explore applications of traditional ecological knowledge (TEK) and underlying emotions or beliefs in literature to help understand sustainability. Protecting this sensitive cultural data through ethical applications can further secure future implementations of policies, urban planning, and environmental relationships.