Cybersecurity Commons^™

Evaluating Machine Learning Models On Classification Of Novel Cyber Attacks In The Healthcare Domain, Promise Ehimen

Dissertations, Theses, and Projects

The increasing adoption of the Internet of Medical Things (IoMT) has improved healthcare delivery through connected medical devices while simultaneously expanding the cybersecurity risks facing healthcare organizations. Although machine learning based intrusion detection systems have demonstrated high detection accuracy, their ability to respond reliably to previously unseen cyberattacks remains uncertain. This study investigated how a Neural Network model and a Logistic Regression model classified novel cyberattacks within the IoMT environment. The Neural Network and Logistic Regression models were both trained and tested using a subset of the CICIoMT2024 benchmark dataset. The Neural Network achieved 99.82% test accuracy and a 0.94 …

Escaping The Cyberstorm: A Gamified Social Engineering Training Program, Noah Mcclanahan, Fadi Abu-Amara, Ali Khattab, Travis Jett, Andre Jackson

Journal of Cybersecurity Education, Research and Practice

In this research work, we explored the effectiveness of gamification in improving cybersecurity awareness and training users on targeted social engineering attacks. Traditional cybersecurity training focuses on lectures and videos. These training methods may not actively engage employees, which reduces their knowledge retention and ability to recognize social engineering attacks. This lack of involvement is a concern, as social engineering continues to be one of the most prevalent attack methods faced by end-users. A gamified training program, Escaping the Cyberstorm, was developed using the Godot game engine to address key challenges in spreading cybersecurity awareness. The game includes real-life …

Security Limitations Of The Can Bus And Detection Through Power Fingerprinting, Ken Broden

Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal

This paper examines the vulnerabilities of the Controller Area Network (CAN), the standard communication protocol used in most modern vehicles. It explains why CAN is widely adopted and outlines key security weaknesses in its design. The paper then reviews recent research efforts to detect and mitigate these vulnerabilities, with particular focus on an approach to origin authentication that relies on the unique power consumption patterns of each individual electronic control unit on a CAN bus.

2026 Cyber-Resilient Health Care Workshop Report, Malcolm Schongalla, Sergey Bratus

Computer Science Technical Reports

The ISTS and the Dartmouth College Cybersecurity Cluster hosted the successful, inaugural Cyber-Resilient Health Care (CRHC) Workshop, March 5th & 6th, 2026. The event theme was "Innovation and Implementation," in response to the need to shift from reactive to proactive resiliency measures in the healthcare sector. Approximately 30 experts in clinical health care, cybersecurity, medical technology, policy, and innovation met to discuss solution-focused innovations addressing hard, cyber-related problems in health care. The agenda featured keynotes, an expert panel, innovation pitches, small group discussions, and a tabletop infrastructure disaster exercise. Participants gained insights into the obstacles and solutions involved in supporting …

The Security Of Llm-Generated Code, Christopher Brian Gonzalez Ayala

Student Theses

The rapid adoption of Large Language Models (LLMs) in software development has transformed coding practices by enabling automated code generation, completion, and optimization. Despite these advantages, concerns persist regarding the security and reliability of LLM-generated code. This study presents a comprehensive evaluation of both the functional correctness and security of code produced by three prominent LLMs as of early 2026. A total of 4,800 code snippets were generated using 100 security-focused programming prompts derived from the OWASP Top 10:2025, translated across eight natural languages and two phrasing styles (literal and natural developer-oriented prompts). To assess performance, a multi-stage experimental framework …

Security Assessment Of A Machine Learning Approach To Generate And Validate Digital Signatures, Juan Ortiz Couder

Doctoral Dissertations and Master's Theses

Cybersecurity has become a global concern as cyber-attacks have become more common, and the cost of the damage caused by them continues to increase. There are several approaches to improve the cyber security of systems such as Digital Signatures, hashing, watermarking, and encryption among others. Digital Signatures are a cryptographic technique used to verify the authenticity and integrity of digital messages or documents. Digital Signatures use a combination of hashing and public-private key encryption to verify the authenticity and integrity of videos, just as they are used for documents and messages. As a result of using a combination of other …

The Texture Of A Threat: Adversarial Training, Cnns, And Obfuscated Malware Detection, Kaelyn Haynie

Senior Honors Theses

Accurately detecting malicious programs is an expanding field of research for machine learning (ML), with a novel approach incorporating a bytecode-to-image pipeline that produces images representative of software. These images are provided to convolutional neural networks (CNNs) to be examined for malicious pattern indicators. However, CNNs struggle to generalize these patterns effectively while still being robust against adversarial data, an issue which this research addresses with adversarial training. In this paper, three unique CNN architectures (a DBFS-MC-inspired baseline, MIRACLE, and PSP-CNN) are trained for binary classification with 15,000 benign and malicious software samples encoded into images for Android, Windows, and …

A.I.R.E., Laurene Robinson

Presentations - 2026

•Cybersecurity analysts rely on reverse engineering to understand suspicious software. •Ghidra can surface decompiled code, but it does not fully explain function purpose, behavioral meaning, or analyst priority. •When symbols are stripped and context is weak, analysts must still reconstruct intent manually from low-level output. •That process is Time-consuming , complex and , operationally costly

A.I.R.E. - Ai-Assisted Reverse Engineering, Laurene Robinson

Posters - 2026

Reverse engineering plays a vital role in cybersecurity by helping analysts examine unknown binaries, investigate malware, identify vulnerabilities, and better protect sensitive systems. However, once a program is compiled and stripped, the meaningful names that describe its behavior are lost, leaving behind generic function labels like FUN_00401a30. Analysts must then manually interpret decompiled code, trace call chains, and infer program behavior function by function, which is slow and mentally demanding on large binaries. To address this challenge, this project introduces A.I.R.E., a local Ghidra extension that extracts contextual evidence from stripped functions and uses a locally hosted language model to …

Foxbuddy, Luis Eduardo Garza Jr.

Posters - 2026

Emergency preparedness remains a significant challenge for individuals due to disorganized resource management and lack of accessible guidance. Additionally, cybersecurity risks during emergencies are often overlooked, leaving individuals vulnerable to digital threats such as phishing, scams, and data exposure. FoxBuddy provides a centralized, user-friendly platform that enhances both physical preparedness and cybersecurity awareness.

Cybersecurity Center For Offshore Wind Energy (Final Project Round), Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

This project establishes a Cybersecurity Center for Offshore Wind Energy with the objective of designing and operating a cyber-physical testbed for wind energy farms (WEFs) that enables comprehensive cybersecurity research. The testbed incorporates a Supervisory Control and Data Acquisition (SCADA) system connected to turbine models via industrial-grade programmable logic controllers (PLCs) and remote terminal units (RTUs). It supports side-channel data acquisition, implementation and analysis of various cyberattack scenarios, and development of attack detection, mitigation, and best-practice guidance tailored to wind energy systems. During the project, the team expanded the number and fidelity of mathematical turbine models (MTMs), integrated these models …

Look-Ahead Cyber-Threat Forecasting For Connected And Automated Transport: A Spatio-Temporal Graph Learning Approach, Md Al Amin, Mohammad Shafat Ahsan, Jannatul Maua, Arifa Akter Eva, M.F. Mridha, Md. Jakir Hossen

Student Publications [Scholarly]

Modern intelligent transportation systems (ITS) increasingly rely on connected electronic control units (ECUs), exposing in-vehicle networks to cyber-attacks such as message injection on the Controller Area Network (CAN) bus. While prior work has focused on post-factum detection, this paper addresses the underexplored task of forecasting cyber-attacks before they occur. We propose a spatio-temporal graph neural network (STGNN) architecture that models CAN traffic as a dynamic graph sequence, where nodes represent active CAN IDs and edges capture statistical co-activation patterns. Each graph snapshot encodes temporal features such as inter-arrival statistics and entropy, and is processed using graph attention layers followed by …

Enlem: Ensemble Learning-Based Model To Detect Phishing Websites, Most Nilufa Yeasmin, Md Abu Rumman Refat, Bikash Chandra Singh, Zulfikar Alom, Zeyar Aung, Mohammad Azim

School of Cybersecurity Faculty Publications

Phishing involves manipulating individuals into revealing private data, e.g., user IDs, bank details, and passwords. The observed surge in fraud is related to increased deception, impersonation, and advanced online attacks. Thus, effective phishing detection methods are required to mitigate escalating global phishing threats. Existing methods (e.g., heuristics-based, signature-based, and visual similarity-based methods) attempt to detect phishing sites, and machine learning (ML) and deep learning (DL) methods are effective in the cybersecurity context in terms of learning from data, offering insights, and forecasting. However, independent ML algorithms are limited when handling complex data, and DL techniques surpass traditional ML methods in …

Biosecure-Llm Framework: Protecting Llms From Cyberbiosecurity Threats And The Case For Independent Ai Safety Governance, Xavier-Lewis Palmer, Lucas Potter, Srdjan Lesaja, Sotirios Karathanasis, Mohammad Ghasemigol

Computer Science Faculty Publications

Large Language Models (LLMs) are becoming critical infrastructure in scientific, healthcare, and governmental contexts. As frontier AI laboratories increasingly partner with government agencies, a fundamental question arises: Who should control the safety and policy-enforcement layers that constrain model behavior? Current safety mechanisms (LLM guardrails) are typically designed for generic "harmlessness" and operate by detecting semantic patterns and refusing requests. However, they are inadequate governance instruments because they cannot implement auditable, domain-specific controls tied to external regulatory policy objects (e.g., control lists or rules governing personally identifying information). Even a perfectly aligned model is not able to express institution-specific policy without …

Gem-Can: A Real-World Dataset Of Can-Bus Attack Scenarios On An Autonomous Vehicle For Intrusion-Detection Research, Mahsa Tavasoli, Abdolhossein Sarrafzadeh, Ali Karimoddini, Tienake Phuapaiboon, Milad Khaleghi, Daniel Tobias

Electrical & Computer Engineering Faculty Publications

This paper presents GEM-CAN, a labelled Controller Area Network (CAN) dataset captured from an autonomous GEM e6 platform under both normal operation and controlled cyber-attack conditions.

The dataset contains ∼143 K frames comprising (i) ∼ nominal autonomous operation (∼100k messages), (ii) DoS floods using arbitration ID 0 × 00000000 (∼41 K messages), and (iii) data-tampering injections that reuse legitimate IDs for brake and steering-lock (∼1.3 K messages). Each record includes timestamp, arbitration ID (11/29-bit), DLC, eight payload bytes, and a Normal/Attack label. A companion metadata file enumerates attack windows, PCAN bus-load traces, bitrate, and test conditions. Data were collected with …

Analyzing Network Traffic And Data Exfiltration Via Smb In Post-Vm Escape Scenarios, Noah M. Disanza

Williams Honors College, Honors Research Projects

Virtual machines (VMs) play a crucial role in modern IT infrastructure environments by providing isolation and enhanced security, among other things, for both personal and corporate systems. VMs are heavily rely upon to safely test malware, manage infrastructure, and reduce risk to host systems. This reliance is so substantial that the idea of reducing risk to the host system is believed to be erasing risk entirely. However, this mindset has shown to be challenged time and time again by the emergence of exploits known as virtual machine escapes. These exploits allow malicious actors to break out of the virtualized environment …

Secure The Database: A Red Team, Blue Team Analysis Of Sql Injection, Andrew N. Miller

Williams Honors College, Honors Research Projects

SQL injection (SQLi) attacks are a type of cyberattack that seeks to bypass website logins and gain entry to sensitive information. These pose a significant danger to organizations holding confidential user information. Personally Identifiable Information (PII) like physical addresses, emails, phone numbers, social security numbers are at risk of theft. Login credentials like usernames, passwords, and other sensitive information like financial details and social security numbers are also exposed through SQLi attacks. SQLi attacks harm the confidentiality, integrity, and availability of people’s identity. Additionally, data breaches that reach public battention harm the reputation and trust of organizations. SQLi attacks rank …

When Helpfulness Becomes Harmful: Jailbreaking Llms For Malicious Code Generation, Noelle Capodieci

Electronic Theses & Dissertations (2024 - present)

Generative AI (GenAI) and Large Language Models (LLMs) have made large strides in coding task capabilities, with many software developers integrating agentic engineering into their workflow. While GenAI has largely benefited professional software engineers who can automate their work, it has also created room for those with little coding expertise to also create fully fledged programs and applications. It is commonly noted that GenAI is trained with two major goals in mind: to be as helpful as possible, and be as harmless as possible. There exist moments where helpfulness may be prioritized over harmlessness when these goals conflict. LLMs may …

Cybercamp: An Experience Report On The Transformations Of An Intensive Cybersecurity Summer Camp For High School Students, Jose R. Ortiz Ubarri, Kariluz Dávila Diaz Ph.D., Rafael A. Arce Nazario

Journal of Cybersecurity Education, Research and Practice

The Cybercamp is a Cybersecurity summer camp for high school students that has been held for the last nine years at a Hispanic Serving Institution. Since its inception in 2016 the Cybercamp has undergone several transformations in response to budget reductions and the COVID pandemic, to finally become its current version: a rich, hands-on learning experience that we believe is easily replicable even in resource-challenged environments.

In this paper, we document the transformations of the Cybercamp and discuss the developed curriculum and materials in hopes that others will reuse, adapt, and improve upon them. In the Cybercamp, we apply active …

Bridging The Gap Between Network Science And Network Systems To Identify And Mitigate Cyber Risk: Identify And Mitigate Backdoor Attacks On Graph Neural Networks And On Complex Systems, Sabah Ettahri

Electrical & Computer Engineering Projects for D. Eng. Degree

This doctoral project aims to bridge the gap between graph theory and network science to identify and mitigate cyber risk, represented as a CY-Triangular Network that connects different networks. The CY-Triangular Framework is a cybersecurity system that integrates graph theory and network science through an interoperable learning approach. The objective of this project is to bridge the gap between two domains: network science and network systems. Accordingly, it examines one representative network from each field, focuses on a complex system network, and explores Graph Neural Networks (GNNs). The connection between these domains lies in graph theory. This research demonstrates that …

Effects Of Code Scaffolding In Increasing Student Confidence In Programming Cryptography, John Denny

LSU Master's Theses

Cryptography is essential for secure communications, and new threats require more students willing to program and interact with cryptographic systems. Previous research is focused on tools for teaching these systems at a high level, teaching through attacks against these systems, and proper use of these systems in software development. In this paper, we seek to design a workshop to use scaffolded Python code to teach how these cryp- tographic systems are designed. We explore the use of code scaffolding for students to program an example implementation of the McEliece crypto- graphic system to build confidence in working with these systems. …

Optimizing Cybersecurity Through Ai Predictive Analytics And Human Expertise, Cathy Mae C. Dutong

Journal of the Symposium of University Research and Creative Expression

Project Mentor(s): Hideki Takei, DBA

As cybersecurity threats evolve in complexity and scale, the reliance on artificial intelligence (AI) has become increasingly prevalent across both public and private sectors. This study examines the dual role of AI-driven predictive analytics in strengthening organizational cybersecurity, while addressing the ongoing need for human oversight. Through a mixed-method approach, combining survey data from cybersecurity professionals with an extensive literature review, this research analyzes AI's capacity to detect emerging threats, the systemic challenges associated with AI integration, and the indispensable role of human expertise in interpreting AI outputs. Findings indicate that while AI enhances proactive …

Cybersecurity: Digital Stewardship In A Violent World, Rocky K. C. Chang

University Faculty Publications and Creative Works

This paper defines cybersecurity based on the principle of biblical stewardship. The focus of this principle is God, not the technologies, who is the creator and owner of cyberspace and everything in it. Humankind is called by God to steward them by protecting the digital property of our neighbors in cyberspace from malicious attacks. In the context of cybersecurity, a neighbor can be any individual cyber user, practitioner, educator, organization, tech company, or even hacker. However, as argued from the perspectives of human sin and human finitude, the defending stewards can never win over evil in this spiritual battle. Instead, …

Exploitation For All: The Factors That Enable Pig Butchering Schemes To Weaponize Cybersecurity's Weakest Link, Melaney Freeman

Boise State Graduate Student Projects

This paper discusses pig butchering schemes and how they leverage human weaknesses through advanced social engineering and manipulation techniques that are enabled through the use of human trafficking, forced labor, and government corruption in Southeast Asia. Details regarding scammer exploitation and the formation of a victim-offender identity is presented, followed by the explanation of factors that allow organized crime groups to exist. Essential tactics used by scammers are examined to understand how they weaponize people's vulnerabilities for the duration of the scam to build a relationship with the victim and earn their trust in order to financially exhaust them through …

Broadband Resilience By Zero Trust Community Network Policy Design, Lee W. Mcknight, Danielle Smith

The Lender Center for Social Justice

This paper proposes a Zero Trust framework for broadband policy design to enhance community network resilience. It provides a governance and policy perspective for ensuring secure, equitable broadband access.

Digital Forensics And Ai: Artifact Analysis And Using Ai In The Forensics Domain, Clinton Joel Walker

LSU Doctoral Dissertations

Digital Forensics (DF) is a field of forensic science focusing on the acquisition, authentication, and analysis of digital evidence while maintaining integrity of that data. DF analysts use forensic tools to parse large volumes of data for investigations and depend on them for identification of pertinent digital evidence in vast amounts of data. Keeping up with innovations and ever-expanding data volumes is a constant challenge for these investigators. The prevalence of Artificial Intelligence (AI) in everyday computing is rapidly expanding, with the use of Machine Learning (ML) and Large Language Models (LLM)s becoming increasingly commonplace. Innovations in technology bring new …

Exploring The Translation Lookaside Buffer (Tlb) For Low-Level Task Differentiation And Classification, Cristian Agredo, Daniel F. Koranek, Christine M. Schubert, Jose A. Gutierrez Del Arroyo, Tor J. Langehaug, Scott R. Graham

Faculty Publications

The primary focus of modern Central Processing Unit (CPU) technologies is performance improvement, with security often considered a secondary concern. As a result, vulnerabilities within the system are overlooked. While significant research, both offensive and defensive, has been conducted on CPU caches, relatively little attention has been given to the Translation Lookaside Buffer (TLB) due to its perceived lack of data granularity. Prior studies have typically combined multiple Hardware Performance Counters (HPCs) or relied on timing analysis to extract meaningful insights. In contrast, this study introduces a novel methodology that leverages only TLB related HPCs for multi-task classification, without incorporating …

Securing Distributed Energy Resources: A Secure Gateway For Modbus To Solid Communication Using A Raspberry Pi, Donna R. Thakadipuram

Electrical Engineering and Computer Science Undergraduate Honors Theses

As distributed energy resources (DERs) such as solar panels, wind turbines, and battery storage systems become more common, securing their communications has become increasingly important. Many of these systems still rely on legacy communication protocols such as Modbus, which were not designed with cybersecurity in mind. This project addresses this challenge by developing a secure communication gateway that allows Modbus RTU devices to interface with decentralized Solid pods, which are personal data storage units that give users control over their information. This system is built on a Raspberry Pi 4, and it translates telemetry data from Modbus into a Solid-compatible …

Deepfakes On Trial: Developing A High-Accuracy, Court-Admissible Ai Pipeline For Deepfake Detection In Corporate Fraud Litigation, Aiden J. Green

Honors College Theses

As deepfake technology advances, cybercriminals are increasingly using AI-generated videos and audios to impersonate executives and carry out sophisticated CEO fraud schemes. These synthetic forgeries target human trust and corporate communication systems, creating an urgent need for forensic tools capable of authenticating digital evidence with legal accuracy. This thesis presents a forensic-grade AI deepfake detection pipeline designed for this purpose, emphasizing courtroom admissibility, reproducibility, and evidentiary integrity. Built entirely with free, opensource tools, the framework combines metadata analysis, AI-powered spectrogram analysis, neural artifact detection, and facial manipulation recognition into a transparent workflow that accurately identifies synthetic media. It was trained …

Does The Transit Industry Understand The Risks Of Cybersecurity And Are The Risks Being Appropriately Prioritized?, Scott F. Belcher, Terri Belcher, James Grimes, Lusa Holmstrom, Andy Souders

Mineta Transportation Institute

The intent of this study is to assess the readiness, resourcing, and capabilities of public transit agencies to detect, identify, be protected from, respond to, and recover from cybersecurity vulnerabilities and threats. This study is an update of the 2020 Mineta Transportation Institute (MTI) study, “Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness.” In the previous study, the authors found that the transit industry was ill-prepared for cybersecurity attacks. Unfortunately, after four years and the development of new, and often free, resources, the situation has not markedly improved. In fact, this …