Information Security Commons^™

Hands-On Ransomware: An Experiential Wannacry Case Study For Undergraduate Cybersecurity Education, Eli Creek Richmond, Thomas R. Devine

Military Cyber Affairs

Ransomware represents one of the most disruptive threats in the cyber landscape, yet hands-on malware analysis remains rare in undergraduate cybersecurity curricula. This paper presents the design, implementation, and evaluation of an experiential learning module centered on the WannaCry ransomware case study, deployed in a senior-level course at West Virginia University. Students performed static and dynamic analysis using industry-standard tools. Pre- and post-module assessments demonstrated measurable gains in self-reported competency across seven technical dimensions. The module's competencies align directly with DoD Cyber Workforce Framework Work Role 212, Cyber Defense Forensics Analyst, supporting education-to-workforce pipeline development.

From Framework To Toolchain: Implementing Zero Trust Architecture In Cloud-Native Environments For Dow Compliance, Shelby C. Snyder

Military Cyber Affairs

Federal agencies face a fiscal year 2027 target for enterprise-wide Zero Trust deployment, but NIST SP 800-207A defines logical components without identifying the Kubernetes technologies that implement them. This paper proposes a three-tier mapping of the Policy Engine, Policy Administrator, and Policy Enforcement Point to service mesh, microsegmentation, and perimeter tooling, stating the criteria by which each component is classified. It then applies a defined rubric to six Zero Trust vendors across component alignment, Kubernetes capability, federal authorization posture, and evidence quality, finding that no single vendor covers all three tiers. The mapping is a testable architectural proposition; a Stage …

Semantic Shields: Automating Critical Infrastructure Defense Via Nlp-Driven Ransomware Profiling, Henry Trowbridge, Ian Zalcberg, Ryan Schley, Carter Yagemann, Natasha Phan, Srikar Maduposu, Vimal Buck

Military Cyber Affairs

Ransomware poses a growing threat to critical infrastructure, where successful attacks can disrupt operational technology (OT) and industrial control systems (ICS) with significant public safety consequences. However, attributing ransomware incidents to specific threat actors remains challenging due to ransomware-as-a-service ecosystems, actor rebranding, and the obfuscation of traditional indicators of compromise. This paper presents Semantic Shields, an NLP-driven attribution framework that leverages BERT-generated semantic embeddings and DBSCAN clustering to profile ransomware actors through the linguistic characteristics of ransom notes. Using a dataset of 295 ransom notes from 189 distinct threat groups, the framework achieved an 87.2% true positive clustering rate and …

Navigating Enhanced Exploration Assistance (Nexa), Azhari Abbas, Caleb Fakunle, Ryan Powell, Donovan Livingston

Discovery Day - Daytona Beach

NEXA is an artificial intelligence software platform developed to enhance residential security and property monitoring through seamless integration with autonomous drone systems. This research application of advanced AI in surveillance aims to create a standalone solution capable of real-time threat detection and intelligent alert management. By processing visual and sensory data, NEXA facilitates autonomous drone operation with minimal human intervention. Secure communication channels ensure that instant alerts are delivered to property owners and, potentially, law enforcement, improving response times in security incidents, search-and-rescue operations, and perimeter surveillance. Additionally, NEXA is capable of interfacing with commercially available drone platforms and presents …

Evaluating Machine Learning Models On Classification Of Novel Cyber Attacks In The Healthcare Domain, Promise Ehimen

Dissertations, Theses, and Projects

The increasing adoption of the Internet of Medical Things (IoMT) has improved healthcare delivery through connected medical devices while simultaneously expanding the cybersecurity risks facing healthcare organizations. Although machine learning based intrusion detection systems have demonstrated high detection accuracy, their ability to respond reliably to previously unseen cyberattacks remains uncertain. This study investigated how a Neural Network model and a Logistic Regression model classified novel cyberattacks within the IoMT environment. The Neural Network and Logistic Regression models were both trained and tested using a subset of the CICIoMT2024 benchmark dataset. The Neural Network achieved 99.82% test accuracy and a 0.94 …

Stop Blaming My Users: Illumination Of The Technocentric Mythos Bias, Ervin H. Frenzel, Richard Lightcap

Journal of Cybersecurity Education, Research and Practice

 Abstract -This conceptual essay addresses the need for systemic and systematic transdisciplinary analytical techniques within cybersecurity and technical security. This conceptual essay is contingent upon recognition that cybersecurity is not simply technical in nature, it does not need an adversary, and more importantly it is based upon systems engineering and systems thinking.  The essay contributes a socio-technical attribution chain and field-specific ontology/taxonomy which distinguish user-triggered events from root causes, latent conditions, technical debt, validation failures, governance failures, and attribution bias before assigning responsibility to end users. It systematically defines an ontology inclusive of developer technical debt, organizational debt arising from …

Cybersecurity Governance Of Industrial Iot In Sub-Saharan Africa: Policy Gaps, Threat Landscape, And Lessons From Comparative African Contexts, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid deployment of Industrial Internet of Things (IIoT) systems across Sub-Saharan Africa's extractive, energy, logistics, and agro-industrial sectors has introduced a cybersecurity challenge of growing urgency: industrial networks that were designed for operational efficiency are increasingly exposed to cyber threats for which neither the organizations nor the regulatory frameworks are adequately prepared. This article examines the cybersecurity governance of IIoT systems in a developing African economy, using Mozambique as a primary case study and drawing comparative lessons from South Africa, Rwanda, and Kenya. Through an integrative literature review and documentary analysis of national digital, cybersecurity, and industrial policies, the …

Contemporary Cybersecurity Challenges In Emerging Technologies: A Systematic Literature Analysis, Faztudo Languisse Prof

Journal of Cybersecurity Education, Research and Practice

The accelerating convergence of artificial intelligence (AI), the Internet of Things (IoT), cloud computing, blockchain, and quantum computing has fundamentally transformed the global threat landscape, introducing cybersecurity challenges of unprecedented complexity and scale. This systematic literature review synthesizes findings from peer-reviewed publications, institutional reports, and regulatory documents published primarily between 2020 and 2025 to provide an integrated analysis of contemporary cybersecurity challenges across five key emerging technology domains. The review identifies critical vulnerabilities inherent to each domain, documents the evolution of threat actors and attack methodologies — including AI-powered ransomware, adversarial machine learning, and harvest-now-decrypt-later quantum attacks — and evaluates …

Post-Vote Tampering In Nigerian Elections And The Role Of Blockchain-Enabled Electoral Systems, Ransome Chukwubuikem Enechukwu

Electronic Theses and Dissertations

Post-vote tampering during the collation and transmission of election results remains a persistent challenge in Nigerian elections, enabling manipulation of already-cast votes and weakening public trust in electoral outcomes. Existing technological interventions, including biometric voter accreditation and digital result transmission systems, improve voter authentication but do not adequately secure the post-vote result collation process. This thesis proposes a blockchain-enabled framework designed to protect the integrity of election results during the collation and transmission stages. Using a Design Science Research methodology, the study develops a permissioned blockchain framework based on Hyperledger Fabric that records polling-unit results as immutable ledger entries and …

Limitations Of Signature-Based Network Intrusion Detection Under Modern Traffic Conditions, Henry Guidry

Cybersecurity Undergraduate Research Showcase

Network Intrusion Detection Systems are tools used to monitor network traffic and alert to suspicious or harmful activity before it can cause harm. Signature-based versions of these systems are a foundation for intrusion detection, operating by finding common patterns and forming malicious signatures. However, three developments in modern network environments have greatly impacted the significance of Network Intrusion Detection Systems. These three developments are the near-complete adoption of end-to-end encryption, the use of sophisticated packet fragmentation techniques, and the processing demands of high-throughput networks. Encryption makes deep packet inspection practically infeasible by transforming inspectable payloads into ciphertext, forcing NIDS to …

The Psychology Behind Ai-Generated Phishing And Social Engineering Attacks, A’Shya Reynolds

School of Cybersecurity Master's Level Projects and Papers

Cybercrime has evolved significantly with the integration of artificial intelligence (AI), transforming traditional phishing and social engineering attacks into highly sophisticated and personalized threats. While early phishing attempts relied on generic messaging and low success rates, modern AI-driven attacks leverage advanced data analytics, natural language processing, and behavioral prediction to manipulate victims more effectively.

This research examines how cybercriminals utilize AI to enhance psychological manipulation techniques in phishing and social engineering attacks, increasing victim susceptibility. Drawing from interdisciplinary literature in cybersecurity and psychology, this study explores key psychological mechanisms, including cognitive biases, emotional triggers, and decision-making processes that influence victim …

Large-Scale File Fragment Classification Via Multi-View Learning, Samuel Hildebrand

LSU Master's Theses

File reassembly is one of the most fundamental tasks in digital forensics, enabling recovery of data from potentially damaged storage media even when file system metadata is unavailable. This thesis reviews more than two decades of work in the realm of file carving, with a particular focus on fragmented file carving, which remains a focus of research, and file fragment classification, a principal component of fragmented file carving. This thesis serves a literature review of both file carving and fragmented file carving, surveys the massive amounts of data needed for the task of fragment classification and the datasets that serve …

A Review Of Routing Attacks In Routing Protocol Over Low-Power And Lossy-Based Iot Networks, Lanka Chris Sejaphala Mr., Vusimuzi Malele Prof, Francis Lugayizi Prof.

Journal of Cybersecurity Education, Research and Practice

Low-power and Lossy IoT Networks (LLNs) comprise physical sensors, processing capability, power, and other technologies to exchange information between systems and devices over the internet. However, these networks are susceptible to routing attacks affecting resources, traffic flow, and topology formation. In the related work, it has been discovered that many previous studies do not consider algorithms and implementation approaches for routing attacks. This research study provides a comprehensive in-depth synthesis insight into the description, effects, and algorithms & implementation of four routing attacks in LLNs i.e., rank, sinkhole, DIS-flooding, and worst parent attacks. The findings of this research study highlight …

Ransomware As Organization: A Comparative Analysis Of Corporate And Criminal Structures In Conti, George Urling

Theses, Dissertations and Capstones

Cybercriminal groups continue to pose major threats to global cybersecurity. One of the most common types of cybercriminal groups are, “Ransomware-as-a-Service (RaaS)" groups, who create and sell ransomware. While research is conducted into the development of ransomware, there is limited reporting on the organizational structure and habits of RaaS groups. In 2022, prominent RaaS group Conti had their chat logs leaked, with the logs ranging from 2020 to 2022. This study seeks to provide a deeper understanding of RaaS group structures by utilizing the Conti leaked logs as a case study. The study, entitled “Ransomware as Organization: A Comparative Analysis …

Analyzing Network Traffic And Data Exfiltration Via Smb In Post-Vm Escape Scenarios, Noah M. Disanza

Williams Honors College, Honors Research Projects

Virtual machines (VMs) play a crucial role in modern IT infrastructure environments by providing isolation and enhanced security, among other things, for both personal and corporate systems. VMs are heavily rely upon to safely test malware, manage infrastructure, and reduce risk to host systems. This reliance is so substantial that the idea of reducing risk to the host system is believed to be erasing risk entirely. However, this mindset has shown to be challenged time and time again by the emergence of exploits known as virtual machine escapes. These exploits allow malicious actors to break out of the virtualized environment …

Gem-Can: A Real-World Dataset Of Can-Bus Attack Scenarios On An Autonomous Vehicle For Intrusion-Detection Research, Mahsa Tavasoli, Abdolhossein Sarrafzadeh, Ali Karimoddini, Tienake Phuapaiboon, Milad Khaleghi, Daniel Tobias

Electrical & Computer Engineering Faculty Publications

This paper presents GEM-CAN, a labelled Controller Area Network (CAN) dataset captured from an autonomous GEM e6 platform under both normal operation and controlled cyber-attack conditions.

The dataset contains ∼143 K frames comprising (i) ∼ nominal autonomous operation (∼100k messages), (ii) DoS floods using arbitration ID 0 × 00000000 (∼41 K messages), and (iii) data-tampering injections that reuse legitimate IDs for brake and steering-lock (∼1.3 K messages). Each record includes timestamp, arbitration ID (11/29-bit), DLC, eight payload bytes, and a Normal/Attack label. A companion metadata file enumerates attack windows, PCAN bus-load traces, bitrate, and test conditions. Data were collected with …

Privacy-Preserving Federated Learning With Optimized Ensemble Weighting And Knowledge Distillation For Covid-19 Detection From Non-Iid Medical Imaging Data, Richard Annan, Hong Qin, Robert Newman, Madhuri Siddula, Letu Qingge

Computer Science Faculty Publications

Medical imaging enables rapid and accurate diagnosis of COVID-19, with CT scans proving especially effective. However, data privacy concerns limit collaborative model development across hospitals. To address this issue, we introduce a novel federated learning framework. It is referred to as Independent Knowledge Distillation with post-Ensemble Federated Learning (IKDEFL). Differential Privacy (DP) is integrated into the framework to improve privacy guarantees. Three DP mechanisms are evaluated. These include Fixed Gaussian, Gaussian Adaptive, and Tree Adaptive. The evaluation has been conducted on heterogeneous and Non-Independent and Identically Distributed (Non-IID) datasets. These datasets reflect real-world hospital scenarios. Results show that IKDEFL significantly …

Viability Of Widely Used Encryption Schemes In Drone Transmission, Emanuel Yasir Nelson

Cybersecurity Undergraduate Research Showcase

This paper presents throughout research on the security issues related to drone transmission. These topics were addressed and explained, in particular the aspects relating to cybersecurity, for utmost clarity. These include threats and vulnerabilities, drone transmission the impact of encryption on latency, and the details of the encryption methods AES-128, AES-256, and ChaCha20 that were used in the experiment described in the paper. Each encryption method performance was measured and outputted by the Python code developed and used in the experiment. Afterwards, the performance of each method was analyzed in relation to their decryption time, encryption time, end to end …

Confidential, Attestable, And Efficient Inter-Cvm Communication With Arm Cca, Sina Abdollahi, Amir Al Sadi, Marios Kogias, Hamed Haddadi, David Kotz

Other Faculty Materials

Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries such as the hypervisor. While they provide strong isolation guarantees, existing CVM architectures lack first-class mechanisms for inter-CVM data sharing due to their disjoint memory model, making inter-CVM data exchange a performance bottleneck in compartmentalized or collaborative multi-CVM systems. Under this model, a CVM's accessible memory is either shared with the hypervisor or protected from both the hypervisor and all other CVMs. This design simplifies reasoning about memory ownership; however, it fundamentally precludes plaintext data sharing between CVMs because all inter-CVM communication must pass through hypervisor-accessible …

Enhancing Ad/Adrd Management Through Ihelpcare: A Compliant And Culturally Sensitive Ai-Driven Digital Healthcare Platform, Trisha Bhowmick

Master's Theses

The digital healthcare field is expanding fast, and now it requires platforms that use advanced technology and maintain robust data security and compliance practices. In the present paper, we present the main structure, key methods, and compliance strategies of the digital healthcare system iHelpCare, which, while fully meeting the HIPAA/GDPR requirements, provides health services more accessible, efficient, and inclusive. The proposed platform is powered by AI for personalized care solutions, with the main emphasis on preventive health management and providing tools for people with disabilities.

iHelpCare achieves real-time patient monitoring while securing medical data management and easy communication between patients, …

Making Deep Neural Networks Trustworthy: Intelligibility And Safety Through Symbolic Methods, Eleanor Catherine Quint

Dissertations and Doctoral Documents, University of Nebraska-Lincoln, 2023–

The rapid adoption of deep learning has come at the cost of properties long valued in artificial intelligence: intelligibility and safety. This dissertation develops methods that restore these properties by coupling neural networks with symbolic structure.

First, for supervised classification, I propose a differentiable decision tree integrated with a supervised variational autoencoder. The resulting model maintains competitive accuracy and generative performance while exposing clear macro-features in its latent space, improving interpretability.

Second, for reinforcement learning, I extend constrained Markov decision processes by specifying constraints in formal languages. This formal language constrained MDP enables the use of automata for state augmentation, …

Securing Connected And Autonomous Vehicles, Owana Marzia Moushi

Dissertations and Doctoral Documents, University of Nebraska-Lincoln, 2023–

A vehicular network is susceptible to various security flaws and attacks. Cryptographic techniques are used in vehicular networks but these alone cannot provide proper security to the network. Identifying various types of attacks is necessary to secure vehicular communication networks. In this dissertation, we focused on detecting various insider attacks in vehicular networks to enhance the security of the network.

Our first contribution in this dissertation is the detection of both binary and multi-class data replay and data replay Sybil attacks in vehicular networks. A publicly available dataset, VeReMi-Extension is used to detect these attacks. This dataset has been reformulated …

Exploring The Link Between Emotional States And Coding Task Quality: A Pilot Study, Aquib Reshad, Valentina Nino, Maria Valero, Adriane Randolph, Yang Shi

Faculty Articles

Emotions play a crucial role in shaping cognitive performance, yet their influence on programing remains understudied. This pilot study investigates the relationship between emotional states and coding task quality. Ten participants completed a programing task while their brain activity was recorded using electroencephalography (EEG), with frontal alpha asymmetry (FAI) applied as a neural marker of emotional valence. Emotional self-reports were collected using the Scale of Positive and Negative Experience (SPANE), and coding quality was evaluated through a structured rubric. Preliminary findings indicate a potential association between FAI and coding performance, whereas self-reported affect showed weaker or inconsistent patterns. Given the …

Investigating Resilience Of Cyberattack Detection Using Lyapunov-Based Economic Model Predictive Control To Data Poisoning, Helen Durand, Akkarakaran Francis Leonard

Chemical Engineering and Materials Science Faculty Research Publications

Cyberattacks may be performed on process control systems due to their integration of networking and computing with physical systems. Prior work in our group has developed detection strategies for nonlinear systems under sensor, actuator, and combined sensor and actuator attacks which can ensure, under characterizable conditions, that attacks can be detected before they cause safety issues. However, this work did not take into account the potential that an attacker could attempt to provide data to a process that causes an attack to remain undetected but that also is consistent with different process dynamics than those which the process has. This …

Response Of Dynamic Processes With Control Implemented On A Noisy Quantum Computer, Shilpa Narashimhan, Dominic Messina, Henrique Oyama, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

A major challenge to determining the applicability (and potential outperformance over classical computers) of a quantum computer (QC) within chemical manufacturing processes is quantum noise. Computations by a QC are error-prone due to the influence of quantum noise inherent to the hardware. Errors in control inputs may destabilize a chemical process and lead to unsafe conditions for manufacturing personnel and the environment. The response of a process with control implemented on a QC to errors due to noise must be investigated thoroughly. In this work, the impacts of control input errors due to quantum noise on a process are modeled …

Heuristic Strategies For Process Stabilization Using Proportional Control Implemented By A Noisy Quantum Simulator, Keshav Kasturi Rangan, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

Processing and storage demands of industrial processes are causing fields such as optimization, scheduling, and control to assess the effectiveness of quantum devices in their applications. A key objective of control systems is to ensure process safety. This paper focuses on the potential of quantum devices to compute control inputs that maintain system safety despite sources of nondeterminism inherent to currently available quantum devices (quantum noise). In our previous work, we employed a quantum simulator to assess whether a quantum implementation of a proportional (P) control law could stabilize a single-input/single-output system under quantum noise approximated from a real quantum …

Tools To Design Algorithms For Implementing Control Over Quantum Computers, Shilpa Narashimhan, Jihan Abou Halloun, Kip Nieman, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

Quantum computers (QCs) may find future applications within control systems that operate manufacturing processes. For application within control engineering, quantum algorithm development must be led by control engineers. However, control engineers may face challenges in designing quantum algorithms for control engineering problems. In this work, we provide several path-finding studies that leverage engineering tools such as optimization, encryption, and computational "short-cuts" toward making algorithm design for QC easier for control engineers.

In The Shadow Of Prompts: Adversarial Attacks And Model Cloning In Large Language Models, Kanchon Gharami

Doctoral Dissertations and Master's Theses

Large-language models (LLMs) already power mission critical tasks such as command-and-control chat, satellite ground-station automation, military analytics, and cyber-defense. Since most of these services are offered through application programming interfaces (APIs) that still expose full or top-k logits and lack mature safeguards, they present a serious, often overlooked attack surface. Earlier work has shown how to rebuild the output projection layer or distill surface behavior, but no attack has produced a deployable clone within a tight query budget. In this thesis, we address this problem by presenting a practical pipeline for cloning LLMs under constrained settings. The approach first estimates …

Syntax-Enhanced Boundary-Aware Named Entity Recognition Model, Chuanming Yu, Bin Deng, Zhengang Zhang

Journal of Scientific Information Research

[Purpose/significance] This study addresses the issue of inadequate perception of entity boundaries in traditional character-level modeling-based named entity recognition models by integrating syntax information containing entity boundary features into the task using a multi-head graph attention network with dense connections. This integration enhances the effectiveness of named entity recognition.

[Method/process] This study proposes a Syntax-enhanced Boundary-aware Named Entity Recognition Model (SynBNER), which utilizes BERT for text semantic representation and integrates syntax information using a dense-connected graph attention network. This integration incorporates implicit entity boundary information from syntax information into word representations, thereby enhancing the model's entity boundary perception capability.

[Result/conclusion] …

Selected Artificial Intelligence Provisions In U.S. Fiscal Year 2025 National Defense Authorization Act, Bert Chapman

Libraries Faculty and Staff Presentations

The 2025 Fiscal Year National Defense Authorization Act contains multiple provisions relating to artificial intelligence (AI). These congressionally mandated provisions direct various sections of the Department of Defense (DOD) and individual U.S. armed service branches to execute congressional intent for AI policymaking. Examples of such intent include identifying and planning DOD's AI workforce, demonstrating AI biotechnology applications for national security, improving the human usability of AI systems, and establishing an AI security center. This presentation will note that reports on these initiatives must be prepared for relevant congressional oversight committees, and, in many cases, are in many cases, publicly released …