Software Engineering Commons^™

The Security Of Llm-Generated Code, Christopher Brian Gonzalez Ayala

Student Theses

The rapid adoption of Large Language Models (LLMs) in software development has transformed coding practices by enabling automated code generation, completion, and optimization. Despite these advantages, concerns persist regarding the security and reliability of LLM-generated code. This study presents a comprehensive evaluation of both the functional correctness and security of code produced by three prominent LLMs as of early 2026. A total of 4,800 code snippets were generated using 100 security-focused programming prompts derived from the OWASP Top 10:2025, translated across eight natural languages and two phrasing styles (literal and natural developer-oriented prompts). To assess performance, a multi-stage experimental framework …

The Texture Of A Threat: Adversarial Training, Cnns, And Obfuscated Malware Detection, Kaelyn Haynie

Senior Honors Theses

Accurately detecting malicious programs is an expanding field of research for machine learning (ML), with a novel approach incorporating a bytecode-to-image pipeline that produces images representative of software. These images are provided to convolutional neural networks (CNNs) to be examined for malicious pattern indicators. However, CNNs struggle to generalize these patterns effectively while still being robust against adversarial data, an issue which this research addresses with adversarial training. In this paper, three unique CNN architectures (a DBFS-MC-inspired baseline, MIRACLE, and PSP-CNN) are trained for binary classification with 15,000 benign and malicious software samples encoded into images for Android, Windows, and …

A.I.R.E., Laurene Robinson

Presentations - 2026

•Cybersecurity analysts rely on reverse engineering to understand suspicious software. •Ghidra can surface decompiled code, but it does not fully explain function purpose, behavioral meaning, or analyst priority. •When symbols are stripped and context is weak, analysts must still reconstruct intent manually from low-level output. •That process is Time-consuming , complex and , operationally costly

A.I.R.E. - Ai-Assisted Reverse Engineering, Laurene Robinson

Posters - 2026

Reverse engineering plays a vital role in cybersecurity by helping analysts examine unknown binaries, investigate malware, identify vulnerabilities, and better protect sensitive systems. However, once a program is compiled and stripped, the meaningful names that describe its behavior are lost, leaving behind generic function labels like FUN_00401a30. Analysts must then manually interpret decompiled code, trace call chains, and infer program behavior function by function, which is slow and mentally demanding on large binaries. To address this challenge, this project introduces A.I.R.E., a local Ghidra extension that extracts contextual evidence from stripped functions and uses a locally hosted language model to …

Agentguard: An Active Threat Discovery System For Package Confusion Using Multi-Agent Collaboration, Wei Ma, Yu Li, Zhi Chen, Ye Liu, Lingxiao Jiang, Qiang Hu, Junyi Tao

Research Collection School Of Computing and Information Systems

The proliferation of open-source software (OSS) has made software supply chains prime targets for attacks like Package Confusion, where adversaries publish malicious packages with names deceptively similar to legitimate ones. Existing detection methods often rely on simple lexical similarity or passive analysis of known package pairs, struggle with high false positive rates (FPR), fail to proactively identify emerging threats, and are vulnerable to adversarial evasion. To overcome these limitations, we introduce AgentGuard, a novel framework for proactive, single-input package confusion detection. AgentGuard employs a multi-agent architecture that autonomously discovers potential confusion targets using fine-tuned word embedding model to hybird semantic …

Effects Of Code Scaffolding In Increasing Student Confidence In Programming Cryptography, John Denny

LSU Master's Theses

Cryptography is essential for secure communications, and new threats require more students willing to program and interact with cryptographic systems. Previous research is focused on tools for teaching these systems at a high level, teaching through attacks against these systems, and proper use of these systems in software development. In this paper, we seek to design a workshop to use scaffolded Python code to teach how these cryp- tographic systems are designed. We explore the use of code scaffolding for students to program an example implementation of the McEliece crypto- graphic system to build confidence in working with these systems. …

Signal-Based Error Handling: Case Study Using The Bathymetric Attributed Grid Library, Anthony R. Papetti

Honors Theses and Capstones

No abstract provided.

Exploration Of The Gap Between The Secure Web Application Development Competencies Needed By Industry And Those Competencies Provided By Graduates Of U.S. Undergraduate Software Engineering Programs, Gary Allen Harris

Theses and Dissertations

Literature demonstrates that threats and attacks on computer systems and networks have been around since the beginning of computing, and the number, severity, sophistication, and costs of attacks and data breaches are continuing to grow. Several studies suggest that one of the most common causes of data breaches is insecure web applications that contain vulnerable application code. These studies suggest that poor secure web application development practices are a prime cause of the susceptible web applications. Additionally, studies suggest that higher education is not meeting industry’s secure software/web application development needs. Employers have reported that they are not getting the …

Effect Of Virtual Reality Technology On Computer Science/Engineering Based Laboratories Education – A Case Study, Saeed Salem Al Shebli

Theses

The rapid growth in mobile applications raises critical concerns about the security of apps and users' privacy, especially in permission control. Mobile apps access sensitive information of users, and the current cybersecurity landscape faces a huge challenge in ensuring the least required permissions are granted. This research focuses on designing an advanced permission recommendation system that couples the strengths of Natural Language Processing (NLP) and Machine Learning (ML) in solving most of the existing gaps in permission management, thus guiding which permissions are mostly needed by Android applications.

The research thus follows a multi-classification approach, integrating state-of-the-art ML techniques with …

Editorial Preview, Su-Cheng Haw

Journal of Informatics and Web Engineering

Effective from Volume 3, JIWE has transitioned to a triannual publication release effort. Specifically, releases occur each February, June, and October. This particular October 2024 release contains 12 papers within the regular section that covers a broad range of application concerning Machine Learning (ML), Artificial Intelligence (AI), Data Mining (DM), Software Engineering, Recommender Systems, Cybersecurity, Healthcare, and other key areas in web engineering. Additionally, this edition presents a captivating collection of 7 papers curated by our Thematic Editor, Dr. Ji-Jian Chin, under the theme "Pervasive Computing." In his editorial, Dr. Ji-Jian Chin highlights cutting-edge research on the integration of computing …

Editorial: Artificial Intelligence And Cybersecurity In Pervasive Computing, Ji-Jian Chin

Journal of Informatics and Web Engineering

Pervasive computing, or ubiquitous computing, is rapidly increasing in capacity and capabilities. With the Internet of Things (IoT) becoming an integral part of daily life and the growing availability of edge computing resources, automation guided by data is advancing applications in healthcare, manufacturing, automotive, and other areas. It's natural that pervasive computing will intersect with artificial intelligence (AI) and cybersecurity. AI can improve detection, prediction, and anticipative responses to human needs, while cybersecurity addresses topics like misuse prevention, ethics, policies, and governance. This issue features seven articles on these intersections, including four AI articles exploring natural language processing and computer …

Cyber-Securing Medical Devices Using Machine Learning: A Case Study Of Pacemaker, Suliat Toyosi Jimoh, Shaymaa S Al-Juboori

Journal of Informatics and Web Engineering

This study aims to enhance the cybersecurity framework of pacemaker devices by identifying vulnerabilities and recommending effective strategies. The objectives are to pinpoint cybersecurity weaknesses, utilize machine learning to predict security breaches, and propose countermeasures based on analytical trends. The literature review highlights the transformation of pacemaker technology from basic, fixed-rate devices to sophisticated systems with wireless capabilities, which, while improving patient care, also introduce significant cybersecurity risks. These risks include unauthorized entry, data breaches, and life-threatening device malfunctions. The methodology in this study utilizes a quantitative research approach using the WUSTL-EHMS-2020 dataset, which includes network traffic features, patients' biometric …

Transforming Information Systems Management: A Reference Model For Digital Engineering Integration, John Bonar, John Hastings

Research & Publications

Digital engineering practices offer significant yet underutilized potential for improving information assurance and system lifecycle management. This paper examines how capabilities like model-based engineering, digital threads, and integrated product lifecycles can address gaps in prevailing frameworks. A reference model demonstrates applying digital engineering techniques to a reference information system, exhibiting enhanced traceability, risk visibility, accuracy, and integration. The model links strategic needs to requirements and architecture while reusing authoritative elements across views. Analysis of the model shows digital engineering closes gaps in compliance, monitoring, change management, and risk assessment. Findings indicate purposeful digital engineering adoption could transform cybersecurity, operations, service …

Generative Machine Learning For Cyber Security, James Halvorsen, Dr. Assefaw Gebremedhin

Military Cyber Affairs

Automated approaches to cyber security based on machine learning will be necessary to combat the next generation of cyber-attacks. Current machine learning tools, however, are difficult to develop and deploy due to issues such as data availability and high false positive rates. Generative models can help solve data-related issues by creating high quality synthetic data for training and testing. Furthermore, some generative architectures are multipurpose, and when used for tasks such as intrusion detection, can outperform existing classifier models. This paper demonstrates how the future of cyber security stands to benefit from continued research on generative models.

An Empirical Study Of Pre-Trained Model Reuse In The Hugging Face Deep Learning Model Registry, Wenxin Jiang, Nicholas Synovic, Matt Hyatt, Taylor R. Schorlemmer, Rohan Sethi, Yung-Hsiang Lu, George K. Thiruvathukal, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Deep Neural Networks (DNNs) are being adopted as components in software systems. Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the-art architectures grow more complex. Following the path of traditional software engineering, machine learning engineers have begun to reuse large-scale pre-trained models (PTMs) and fine-tune these models for downstream tasks. Prior works have studied reuse practices for traditional software packages to guide software engineers towards better package maintenance and dependency management. We lack a similar foundation of knowledge to guide behaviors in pre-trained model ecosystems.

In this work, we present the first empirical investigation of PTM reuse. …

The Future Between Quantum Computing And Cybersecurity, Daniel Dorazio

Williams Honors College, Honors Research Projects

Quantum computing, a novel branch of technology based on quantum theory, processes information in ways beyond the capabilities of classical computers. Traditional computers use binary digits [bits], but quantum computers use quantum binary digits [qubits] that can exist in multiple states simultaneously. Since developing the first two-qubit quantum computer in 1998, the quantum computing field has experienced rapid growth.

Cryptographic algorithms such as RSA and ECC, essential for internet security, rely on the difficulty of complex math problems that classical computers can’t solve. However, the advancement of quantum technology threatens these encryption systems. Algorithms, such as Shor’s, leverage the power …

Supporting The Discovery, Reuse, And Validation Of Cybersecurity Requirements At The Early Stages Of The Software Development Lifecycle, Jessica Antonia Steinmann

Doctoral Dissertations and Master's Theses

The focus of this research is to develop an approach that enhances the elicitation and specification of reusable cybersecurity requirements. Cybersecurity has become a global concern as cyber-attacks are projected to cost damages totaling more than $10.5 trillion dollars by 2025. Cybersecurity requirements are more challenging to elicit than other requirements because they are nonfunctional requirements that requires cybersecurity expertise and knowledge of the proposed system. The goal of this research is to generate cybersecurity requirements based on knowledge acquired from requirements elicitation and analysis activities, to provide cybersecurity specifications without requiring the specialized knowledge of a cybersecurity expert, and …

Canary: An Automated Approach To Security Scanning And Remediation, David Wiles

Masters Theses & Specialist Projects

Modern software has a smaller attack surface today than in the past. Memory-safe languages, container runtimes, virtual machines, and a mature web stack all contribute to the relative safety of the web and software in general compared to years ago. Despite this, we still see high-profile bugs, hacks, and outages which affect major companies and widely-used technologies. The extensive work that has gone into hardening virtualization, containerization, and commonly used applications such as Nginx still depends on the end-user to configure correctly to prevent a compromised machine.

In this paper, I introduce a tool, which I call Canary, which can …

Design And Development Of Techniques To Ensure Integrity In Fog Computing Based Databases, Abdulwahab Fahad S. Alazeb

Graduate Theses and Dissertations

The advancement of information technology in coming years will bring significant changes to the way sensitive data is processed. But the volume of generated data is rapidly growing worldwide. Technologies such as cloud computing, fog computing, and the Internet of things (IoT) will offer business service providers and consumers opportunities to obtain effective and efficient services as well as enhance their experiences and services; increased availability and higher-quality services via real-time data processing augment the potential for technology to add value to everyday experiences. This improves human life quality and easiness. As promising as these technological innovations, they are prone …

Countering Cybersecurity Vulnerabilities In The Power System, Fengli Zhang

Graduate Theses and Dissertations

Security vulnerabilities in software pose an important threat to power grid security, which can be exploited by attackers if not properly addressed. Every month, many vulnerabilities are discovered and all the vulnerabilities must be remediated in a timely manner to reduce the chance of being exploited by attackers. In current practice, security operators have to manually analyze each vulnerability present in their assets and determine the remediation actions in a short time period, which involves a tremendous amount of human resources for electric utilities. To solve this problem, we propose a machine learning-based automation framework to automate vulnerability analysis and …

Ransomware Behavioural Analysis On Windows Platforms, Nikolai Hampton, Zubair A. Baig, Sherali Zeadally

Research outputs 2014 to 2021

Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behaviour. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls

Homesafe: A Mobile Application Utilizing Encryption And Access Control, Kenneth Trumpoldt

Senior Honors Projects, 2010-2019

Our society is becoming more virtual and mobile everyday. The purpose of this application is to transform a physical card system into a virtual card system that meets the demands of a technologically-oriented society. Parents will be able to create their own child identification cards more quickly and cost efficiently. Cards can be easily edited instead of having to order an updated replacement. Immediate and frequent alteration of cards allows for information to be more accurate. Cards can be shared globally and instantly via the Internet or shared connections such as Bluetooth. The fast access to and virtual duplication of …

Framing The Question, "Who Governs The Internet?", Robert J. Domanski

Publications and Research

There remains a widespread perception among both the public and elements of academia that the Internet is “ungovernable”. However, this idea, as well as the notion that the Internet has become some type of cyber-libertarian utopia, is wholly inaccurate. Governments may certainly encounter tremendous difficulty in attempting to regulate the Internet, but numerous types of authority have nevertheless become pervasive. So who, then, governs the Internet? This book will contend that the Internet is, in fact, being governed, that it is being governed by specific and identifiable networks of policy actors, and that an argument can be made as to …