Information Security Commons^™

Advancing Cybersecurity Practice: Explainable Machine Learning For Network Intrusion Detection, Adam Grabowski, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

This research investigates explainable artificial intelligence (XAI) integration within machine learning (ML)-based intrusion detection systems (IDS), focusing on distinguishing malicious from benign network activities. We employed Random Forest and XGBoost models evaluated on widely recognized datasets, including NSL-KDD and UNSW-NB15, using both binary and multi-class classification tasks. The objective was to enhance cybersecurity operations through improved model transparency and interpretability. By integrating SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations), the study offers comprehensive global and local insights into model decision-making processes. Results demonstrate SHAP's effectiveness in providing a broad, dataset-wide understanding of feature interactions and importance, while …

Cybercamp: An Experience Report On The Transformations Of An Intensive Cybersecurity Summer Camp For High School Students, Jose R. Ortiz Ubarri, Kariluz Dávila Diaz Ph.D., Rafael A. Arce Nazario

Journal of Cybersecurity Education, Research and Practice

The Cybercamp is a Cybersecurity summer camp for high school students that has been held for the last nine years at a Hispanic Serving Institution. Since its inception in 2016 the Cybercamp has undergone several transformations in response to budget reductions and the COVID pandemic, to finally become its current version: a rich, hands-on learning experience that we believe is easily replicable even in resource-challenged environments.

In this paper, we document the transformations of the Cybercamp and discuss the developed curriculum and materials in hopes that others will reuse, adapt, and improve upon them. In the Cybercamp, we apply active …

Viability Of Widely Used Encryption Schemes In Drone Transmission, Emanuel Yasir Nelson

Cybersecurity Undergraduate Research Showcase

This paper presents throughout research on the security issues related to drone transmission. These topics were addressed and explained, in particular the aspects relating to cybersecurity, for utmost clarity. These include threats and vulnerabilities, drone transmission the impact of encryption on latency, and the details of the encryption methods AES-128, AES-256, and ChaCha20 that were used in the experiment described in the paper. Each encryption method performance was measured and outputted by the Python code developed and used in the experiment. Afterwards, the performance of each method was analyzed in relation to their decryption time, encryption time, end to end …

Confidential, Attestable, And Efficient Inter-Cvm Communication With Arm Cca, Sina Abdollahi, Amir Al Sadi, Marios Kogias, Hamed Haddadi, David Kotz

Other Faculty Materials

Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries such as the hypervisor. While they provide strong isolation guarantees, existing CVM architectures lack first-class mechanisms for inter-CVM data sharing due to their disjoint memory model, making inter-CVM data exchange a performance bottleneck in compartmentalized or collaborative multi-CVM systems. Under this model, a CVM's accessible memory is either shared with the hypervisor or protected from both the hypervisor and all other CVMs. This design simplifies reasoning about memory ownership; however, it fundamentally precludes plaintext data sharing between CVMs because all inter-CVM communication must pass through hypervisor-accessible …

Zero Day Malware Detection With Alpha: Fast Dbi With Transformer Models For Real World Application, Matthew Gaber, Mohiuddin Ahmed, Helge Janicke

Research outputs 2022 to 2026

The effectiveness of an AI model in accurately classifying novel malware hinges on the quality of the features it is trained on, which in turn depends on the effectiveness of the analysis tool used. Peekaboo, a Dynamic Binary Instrumentation (DBI) tool, defeats malware evasion techniques to capture authentic behavior at the Assembly (ASM) instruction level. This behavior exhibits patterns consistent with Zipf's law, a distribution commonly seen in natural languages, making Transformer models particularly effective for binary classification tasks. We introduce Alpha, a framework for zero-day malware detection that leverages Transformer models, Support Vector Machines (SVMs) and ASM language features. …

Defeating Evasive Malware With Peekaboo: Extracting Authentic Malware Behavior With Dynamic Binary Instrumentation, Matthew Gaber, Mohiuddin Ahmed, Helge Janicke

Research outputs 2022 to 2026

The accuracy of Artificial Intelligence (AI) in malware detection is dependent on the features it is trained with, where the quality and authenticity of these features is dependent on the dataset and the analysis tool. Evasive malware, that alters its behavior in analysis environments, is challenging to extract authentic features from where widely used static and dynamic analysis tools have several limitations. However, Dynamic Binary Instrumentation (DBI) allows deep and precise control of the malware sample, thereby facilitating the extraction of authentic behavior from evasive malware. Considering the limitations of malware analysis for use with AI, this research had two …

Proverag: Provenance-Driven Vulnerability Analysis With Automated Retrieval-Augmented Llms, Reza Fayyazi, Stella Hoyos Trueba, Michael Zuzak, Jay Yang

Institute for Informatics and Applied Technology Scholarship

In cybersecurity, security analysts constantly face the challenge of mitigating newly discovered vulnerabilities in real-time, with over 300,000 vulnerabilities identified since 1999. The sheer volume of known vulnerabilities complicates the detection of patterns for unknown threats. While LLMs can assist, they often hallucinate and lack alignment with recent threats. Over 40,000 vulnerabilities have been identified in 2024 alone, which are introduced after most popular LLMs’ (e.g., GPT-5) training data cutoff. This raises a major challenge of leveraging LLMs in cybersecurity, where accuracy and up-to-date information are paramount. Therefore, we aim to improve the adaptation of LLMs in vulnerability analysis by …

A Study Of Configuration Management Database (Cmdb) Adoption In It Service Management (Itsm) Implementations Within Nj Community Colleges, Fredrick Dande

All-Inclusive List of Electronic Theses and Dissertations

This study examines the adoption of Configuration Management Databases (CMDBs) in IT Service Management (ITSM) implementations within New Jersey (NJ) community colleges. Despite the well-documented benefits of CMDBs—such as faster issue resolution, improved compliance, and greater visibility across IT infrastructures—implementation success rates remain low. As technology continues to enhance production capabilities and expand access to information, the need for centralized configuration visibility has become critical. A CMDB provides a single system of record for IT assets and services, helping organizations manage outages, assess changes, maintain compliance, and improve asset tracking. This research used an online survey to collect data from …

Enhancing Ad/Adrd Management Through Ihelpcare: A Compliant And Culturally Sensitive Ai-Driven Digital Healthcare Platform, Trisha Bhowmick

Master's Theses

The digital healthcare field is expanding fast, and now it requires platforms that use advanced technology and maintain robust data security and compliance practices. In the present paper, we present the main structure, key methods, and compliance strategies of the digital healthcare system iHelpCare, which, while fully meeting the HIPAA/GDPR requirements, provides health services more accessible, efficient, and inclusive. The proposed platform is powered by AI for personalized care solutions, with the main emphasis on preventive health management and providing tools for people with disabilities.

iHelpCare achieves real-time patient monitoring while securing medical data management and easy communication between patients, …

Making Deep Neural Networks Trustworthy: Intelligibility And Safety Through Symbolic Methods, Eleanor Catherine Quint

Dissertations and Doctoral Documents, University of Nebraska-Lincoln, 2023–

The rapid adoption of deep learning has come at the cost of properties long valued in artificial intelligence: intelligibility and safety. This dissertation develops methods that restore these properties by coupling neural networks with symbolic structure.

First, for supervised classification, I propose a differentiable decision tree integrated with a supervised variational autoencoder. The resulting model maintains competitive accuracy and generative performance while exposing clear macro-features in its latent space, improving interpretability.

Second, for reinforcement learning, I extend constrained Markov decision processes by specifying constraints in formal languages. This formal language constrained MDP enables the use of automata for state augmentation, …

Cnn Based Deep Learning Modeling With Explainability Analysis For Detecting Fraudulent Blockchain Transactions, Mohammad Hasan, Mohammad Shahriar Rahman, Mohammad Jabed Morshed Chowdhury, Iqbal H. Sarker

Research outputs 2022 to 2026

In the era of growing cryptocurrency adoption, Blockchain has emerged as a leading player in the digital payment landscape. However, this widespread popularity also brings forth various security challenges, including the need to safeguard against fraudulent activities. One of the paramount challenges in this regard is the detection of fraudulent transactions within the realm of Bitcoin data. This task significantly influences the trust and security of digital payments. Yet, it's a formidable challenge given the relatively low occurrence of fraudulent Bitcoin transactions. While deep learning techniques have demonstrated their prowess in fraud detection, there remains a scarcity of studies exploring …

Securing Connected And Autonomous Vehicles, Owana Marzia Moushi

Dissertations and Doctoral Documents, University of Nebraska-Lincoln, 2023–

A vehicular network is susceptible to various security flaws and attacks. Cryptographic techniques are used in vehicular networks but these alone cannot provide proper security to the network. Identifying various types of attacks is necessary to secure vehicular communication networks. In this dissertation, we focused on detecting various insider attacks in vehicular networks to enhance the security of the network.

Our first contribution in this dissertation is the detection of both binary and multi-class data replay and data replay Sybil attacks in vehicular networks. A publicly available dataset, VeReMi-Extension is used to detect these attacks. This dataset has been reformulated …

General Test-Time Backdoor Detection In Split Neural Network-Based Vertical Federated Learning, Shunjie Yuan, Xinghua Li, Xuelin Cao, Haiyan Zhang, Robert H. Deng

Research Collection School Of Computing and Information Systems

As a new distributed machine learning framework, vertical federated learning (VFL) has been widely applied in the industry. However, recent studies have demonstrated that VFL faces serious challenges from backdoor attacks, which significantly hinder its further development. Although a few studies have focused on defending against VFL backdoor attacks, these defenses either do not consider the latest attack methods or show limited effectiveness. Moreover, most existing backdoor defense efforts primarily focus on backdoor attacks in horizontal federated learning (HFL) and centralized learning. Due to the unique architecture of VFL models, these methods cannot be directly applied to backdoor defense in …

Fl-Cdf: Collaborative Defense Framework For Backdoor Mitigation In Federated Learning, Haiyan Zhang, Xinghua Li, Yinbin Miao, Shunjie Yuan, Mengyao Zhu, Ximeng Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Federated learning (FL) is vulnerable to backdoor attacks due to its distributed nature. Existing unilateral defense mechanisms often fail against persistent attack strategies, primarily due to their limited perspectives. To address the challenge of model misclassification on the server side caused by overlooked model similarity drift, and gradient misjudgment on the client side caused by semantic learning imbalances across classes, this paper proposes a collaborative defense framework for federated learning, termed FL-CDF. FL-CDF establishes an end-to-end defense through a bidirectional client-server collaboration mechanism. Specifically: (1) On the client side, an adversarial perturbation-based malicious neuron detection module is introduced. This module …

Accuracy-Enabling Differential Privacy-Preserving Truth Discovery, Man Zhang, Xinghua Li, Yinbin Miao, Bin Luo, Siqi Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

Perturbation-based privacy-preserving truth discovery requires the Service Provider (SP) to calculate the truthful aggregation result from perturbed data of the Data Sources (DSs), which inevitably damages the aggregation accuracy due to perturbation noise added in the data. Thus, the existing works attempt to relieve the perturbation errors by reducing noise amounts or adjusting aggregation weights of DSs. However, the former sacrifices DSs’ privacy preservation and the latter has the limited accuracy recovery performance. Aiming at it, we propose an accuracy-enabling differential privacy-preserving truth discovery consisting of an independence-guaranteed data perturbation module and a progressive-private noise elimination module. Specifically, in the …

Exploring The Link Between Emotional States And Coding Task Quality: A Pilot Study, Aquib Reshad, Valentina Nino, Maria Valero, Adriane Randolph, Yang Shi

Faculty Articles

Emotions play a crucial role in shaping cognitive performance, yet their influence on programing remains understudied. This pilot study investigates the relationship between emotional states and coding task quality. Ten participants completed a programing task while their brain activity was recorded using electroencephalography (EEG), with frontal alpha asymmetry (FAI) applied as a neural marker of emotional valence. Emotional self-reports were collected using the Scale of Positive and Negative Experience (SPANE), and coding quality was evaluated through a structured rubric. Preliminary findings indicate a potential association between FAI and coding performance, whereas self-reported affect showed weaker or inconsistent patterns. Given the …

Behavioral Detection Methods For Automated Mcp Server Vulnerability Assessment, Christian Coleman

Cybersecurity Undergraduate Research Showcase

The Model Context Protocol (MCP) has emerged as a critical standard for connecting AI agents to external data sources and tools. Still, its adoption has introduced significant security vulnerabilities across multiple attack surfaces. While recent research has catalogued extensive vulnerability taxonomies and attack implementations, automated detection methodologies remain limited. Current detection tools primarily employ static code analysis, which fails to identify behavioral vulnerabilities that only manifest during runtime server interactions. This study explores behavioral detection approaches for identifying MCP server vulnerabilities through systematic query-based testing, with particular emphasis on context manipulation techniques. Preliminary analysis of existing vulnerability research reveals 48 …

Creating An Iot User Centric Security And Privacy Label, Luke Joseph Gleba

Theses and Dissertations

Concerns for cybersecurity awareness and training in the public have been rising at astronomical rates over the past few years. People globally have entered a critical intersection with computers. Computers are being used in everyday life, and users do not have an easy way to understand their own cyber risk. Consumers deserve to know how secure their new Internet of Things (IoT) system is in a quick, efficient way before they purchase the device and while they own it. The following research looks to improve on ideas for the criteria and the development of a security label. Few prototypes currently …

Software-Defined Networking Powered By Ai-Driven Anomaly Detection, Dina Moloja, Vusumuzi Malele Prof

Journal of Cybersecurity Education, Research and Practice

Software Defined Networking (SDN) revolutionizes network control by separating the control plane from the data plane. Although the latter improves SDN agility and scalability, it creates a security hole, particularly in a central control plane, leading to SDN environments becoming high-profile targets for advanced cybersecurity threats. Due to static and signature-based point-in-time behavior, traditional security methods are unable to keep up with modern attacks that are an anomaly to SDNs. Artificial Intelligence (AI) with its different applications and techniques, has the capability of detecting SDN cyber threats’ anomalies. This paper presents the results of a literature scoping exercise that used …

Enhancing It Security Management With An Advanced Intrusion Detection System Based On Machine Learning And Explainable Ai, Hanan Alzubaidi

Thesis/ Dissertation Defenses

The fast-changing landscape of cyber threats continues to challenge the development of strong and reliable security frameworks for IT management systems. Traditional defense tools, such as Intrusion Detection Systems (IDS), often struggle to keep up with today’s advanced and constantly evolving attack methods. This thesis explores these ongoing challenges and looks into how machine learning (ML) and explainable artificial intelligence (XAI) can be used to boost IDS performance.

The research outlines a smart, adaptive system that combines supervised learning for real-time threat detection, unsupervised models for anomaly analysis, and proactive defense strategies. The goal is to improve detection accuracy, cut …

Experts’ Validation Of The Fundamental Cybersecurity Competency Index (Fcci) Using A Commercial Cyber Range Through Human-Generative Artificial Intelligence (Genai) Teaming, Dariusz Witko, Yair Levy, Catherine Neubauer, Greg Simco, Laurie P. Dringus, Melissa Carlton

Journal of Cybersecurity Education, Research and Practice

The increasing volume of cyber threats, combined with a critical shortage of skilled professionals and rising burnout among practitioners, highlights the urgent need for innovative solutions in cybersecurity operations. Generative Artificial Intelligence (GenAI) offers promising potential to augment human analysts in cybersecurity, but its integration requires rigorous validation of the fundamental competencies that enable effective collaboration of human-GenAI teams. This research study employed a mixed-methods research project designed to evaluate human-GenAI teams, emphasizing the role of expert consensus in shaping the experimental assessment of the Fundamental Cybersecurity Competency Index (FCCI) in a commercial cyber range. We engaged 20 Subject Matter …

Security And Privacy Of Wearable And Implantable Medical Devices: A Course-Based Approach To Medical Device Cybersecurity Education, Michelle M. Ramim

Journal of Cybersecurity Education, Research and Practice

As wearable and implantable medical devices become integral to remote patient monitoring and precision medicine, the associated cybersecurity and privacy risks demand urgent attention. These devices are increasingly targeted by cyberattacks, potentially endangering patient safety and data integrity. To address this, we developed an experiential learning course titled Security and Privacy of Wearable and Implantable Medical Devices, designed for advanced undergraduate and graduate students in health and medical fields. The course immerses students in real-world challenges through lectures, labs, and project-based learning, leveraging wearable devices such as FitBit^TM to analyze and interpret real-time personal health data. The curriculum …

Enhancing Cloud-Based Threat Detection Through Explainable Ai: A Comparative Study Of Machine Learning And Xai-Integrated Models, Amna Al Ghaithi

Thesis/ Dissertation Defenses

The rapid adoption of cloud computing brought about serious security concerns, as cloud infrastructures are constantly exposed to cybersecurity threats such as malware and Distributed Denial of Service attacks. Also, on the other hand, current security methodologies have limitations in identifying new threats accurately. Apart from the fact that ML models are highly efficient in detecting attacks, as ‘black boxes,’ they lack interpretability, impacting trust and adoption within vital cloud environments. This research aims to solve this issue by integrating Explainable Artificial Intelligence practices to help enhance both the accuracy and interpretability of AI systems intended to detect threats in …

Enhanced Privacy Preserving Healthcare Data Management With Federated Learning Using Homomorphic Encryption, Omar Abdulla Ali

Thesis/ Dissertation Defenses

Federated Learning (FL) is a decentralized approach of machine learning on multiple clients jointly training models without sharing their raw data, which drastically improves privacy and enhance protection against security breach. However, there is still a risk of privacy breach when clients send their model updates to the central server, because if a model update is intercepted or analyzed by a malicious entity, it could be used to recover sensitive data using inference attack. To address this issue, Homomorphic Encryption (HE) can be applied to protect against the interception, since the model updates remain encrypted during transmission as well as …

Enhanced Privacy Preserving Healthcare Data Management With Federated Learning Using Homomorphic Encryption, Omar Abdulla Ali

Theses

Federated Learning (FL) is a decentralized approach of machine learning on multiple clients jointly training models without sharing their raw data, which drastically improves privacy and enhance protection against security breach. This is particularly critical in the healthcare sector, where hospitals and medical institutions are often unable to exchange patient records due to strict privacy regulations and data-management policies. However, there is still a risk of privacy breach when clients send their model updates to the central server, because if a model update is intercepted or analyzed by a malicious entity, it could be used to recover sensitive data using …

Detecting Data Poisoning Attacks In Medical Imaging: A Study On Chest X-Ray Classification Tasks, Akhila Abdulla Asgar

Theses

This thesis examines the vulnerability of AI medical imaging models to adversarial threats, with a specific focus on data poisoning attacks in chest X-ray classification. The study begins with a Systematic Literature Review (SLR) to assess the existing adversarial attacks and defenses in medical imaging, revealing a significant research gap in studies exploring data poisoning attacks in the medical domain. Based on our literature search, an efficient and lightweight defense, namely friendly noise defense, against data poisoning has not been investigated in medical imaging classification tasks. Hence, in this work, we investigated its effectiveness on the chest X-ray dataset, and …

Startup Success Forecasting Through Machine Learning: A Comprehensive Analysis Of It Startups, Khaled Abdulla Alhassani

Theses

Lately, startups attracted significant attention from investors throughout the previous years. This raised several questions concerning startups and what they possibly define as them. It could refer to collective individuals who focus on innovative ideas with a reproducible and scalable business model; others refer to it as a newly established business. Nevertheless, all these definitions lead to a predictive question. Will these startups face success?

This study explores startup success prediction methods, focusing on forecasting information technology startup (SIT) insights using Machine Learning (ML) models such as Random Forest (RF), Decision Tree (DT), Support Vector Machine (SVM), K-Nearest Neighbor (k-NN), …

Advancing Security Safeguards In Large Language Models Through Multi-Agent Systems, Mohammed Rashed Alnuaimi

Theses

This thesis focused on enhancing the safe use of Large Language Model (LLM) through the innovative use of a Multi-Agent System (MAS). As LLMs like ChatGPT became essential to our everyday interactions, the need to maintain the safe use of these systems increased. This research thoroughly assessed the current security measures in place for LLM, pointed out their limitations and developed new and more effective security strategies. The core of the proposed solution was a MAS designed to ensure that all data processed by LLM met guidelines including Privacy, Confidentiality, and Ethical standards before reaching the user. The system involved …

Evaluating Large Language Models For Automated Cv Ranking: A Hybrid Embedding Approach For Enhanced Recruitment, Sarah Mohamed Alhindaassi

Theses

Increasing numbers of applications have revealed limitations in legacy keyword-filtering-based Applicant Tracking Systems (ATS), which commonly overlook candidate potential and ignore contextual or transferable skills. Advances in Natural Language Processing (NLP) and Large Language Models (LLMs) offer an exhilarating alternative, supporting context-sensitive and human-crafted reasoning in candidate evaluation. This thesis systematically evaluates four classes of approaches, lexical models, embedding-based methods, Large Language Models (LLMs), and hybrid ensembles, for automation of Curriculum Vitae (CV) to Job Description (JD) matching without exploiting prior annotations or annotations at match time. Using a combination of publicly available datasets and real-world sample data covering three …

Security Modelling For Cyber-Physical Systems: A Systematic Literature Review, Shao Fei Huang, Christopher M. Poskitt, Lwin Khin Shar

Research Collection School Of Computing and Information Systems

Cyber-physical systems are at the intersection of digital technology and engineering domains, rendering them high-value targets of sophisticated and well-funded cybersecurity threat actors. Prominent cybersecurity attacks on CPS have brought attention to the vulnerability of these systems and the inherent weaknesses of critical infrastructure reliant on them. Security modelling for CPS is an important mechanism to systematically identify and assess vulnerabilities, threats, and risks throughout system life cycles, and to ultimately ensure system resilience, safety, and reliability. This survey delves into state-of-the-art research on CPS security modelling, encompassing both threat and attack modelling. While these terms are sometimes used interchangeably, …