Software Engineering Commons^™

Post-Quantum Cryptography Encryption Implementation For Messaging App, Callum S. Ward

Theses/Capstones/Creative Projects

This paper and complementary capstone project aim to explore the state of post-quantum cryptography today by defining the algorithms with which quantum computers can decipher modern asymmetric cryptographic algorithms in exponentially accelerated time, exploring national standards body NIST’s recommendations to circumvent these weaknesses with post-quantum solutions, and implementing recommended algorithms in my group’s project for the UNO Computer Science Capstone course, LockTalk. After having decided on ML-KEM for quantum-resistant asymmetric key transfer and AES-256 for symmetric message encryption and decryption, I was able to cryptographically encode messages to obscure their plaintext values from communication interceptions without any discernible increase in …

A Study Of Visualized Diagnostics In Early Stage Digital Twin Implementation Of An Industrial Control System, Michael R. Kinzel

All-Inclusive List of Electronic Theses and Dissertations

Industrial Control Systems (ICS) are used for process control in almost all industries. An ICS combines Operational Technologies (OT) with Information Technologies (IT) to allow human supervision of a process through surveillance of process variables and manipulation of controlling elements such as valves to maintain stable process conditions. ICSs have been in-service for several decades and may remain operational past their technological service life. Organizational personnel interact with the ICS through visual displays that both indicate the process variables and also the controlling elements. The Human Machine Interface (HMI) allows visibility of the process and the ability to manipulate controlling …

Know Thy Enemy: Building A Command-And-Control Solution For Adversarial Emulation, Caleb J. Chen

Senior Honors Theses

Command and Control (C2) is a critical part of any cyberattack. It serves many purposes, including Distributed Denial of Service (DDoS) attacks, data exfiltration, and malware deployment. Consequently, C2 frameworks play an important part in red team engagements and adversary emulation. However, many adversary emulation solutions focus on comprehensive testing through sequential technique execution instead of realistic chained and automated attacks. The proposed solution is Centurion, an open-source C2 framework that integrates MITRE's ATT&CK framework and several cybersecurity tools into modular playbooks for effective threat emulation. This paper provides background by defining key terms and concepts before delving into a …

Gencode: A Generic Data Augmentation Framework For Boosting Deep Learning-Based Code Understanding, Zeming Dong, Qiang Hu, Xiaofei Xie, Maxime Cordy, Mike Papadakis, Yves Le Traon, Jianjun Zhao

Research Collection School Of Computing and Information Systems

Pre-trained code models lead the era of code intelligence, with multiple models designed with impressive performance. However, one important problem, data augmentation for code data that automatically helps developers prepare training data lacks study in this field. In this paper, we introduce a generic data augmentation framework, GenCode, to enhance the training of code understanding models. Simply speaking, GenCode follows a generation-and-selection paradigm to prepare useful training code data. Specifically, it employs code augmentation techniques to generate new code candidates first and then identifies important ones as the training data by influence scores. To evaluate the effectiveness of GenCode, we …

Causality-Driven Test Case Minimisation For Cyber-Physical Systems, Michael Foster, Christopher M. Poskitt, Nicholas R. Latimer, Neil Walkinshaw, Richard Somers, Robert M. Hierons

Research Collection School Of Computing and Information Systems

Cyber-physical systems allow digital control systems to interact with the physical world using sensors and actuators. They are increasingly being used to automate critical infrastructure, where software faults can have dire consequences. Due to the complex nature and unpredictability of these systems, their resilience is often tested using a technique called fuzzing, which generates quasi-random sequences of sensor and actuator manipulations with the goal of forcing a system into unsafe states. However, there is currently no way of determining which manipulations of a test case cause a failure without systematically removing each one and re-running the test, which can be …

Func: Reducing The Impact Of Android Framework Evolution On Malware Detection, Hailong Yu, Tiantian Wang, Lwin Khin Shar, Hanmeng Li, David Lo

Research Collection School Of Computing and Information Systems

Android malware detection approaches commonly use APIs and permissions as features for classifying malware. However, since the release of the first Android operating system in 2008, the Android framework has undergone numerous version updates. The evolution of the Android framework over time has led to changes in APIs and permissions, including deprecations and replacements. These changes can result in inaccurate characterization of Android malware, thereby affecting performance of malware detectors. There is a lack of methods to mitigate the impact of Android framework evolution on malware detection. To fill this gap, we conduct a systematic study of the impact of …

Weavecc: Symbolically-Guided Joint Exploration Of Inputs And Schedules For Concurrency Bug Detection, William Philip Dinauer

Dartmouth College Master’s Theses

Concurrent programs introduce a class of bugs that depend jointly on both program inputs and thread schedules. Exposing these bugs requires simultaneously reasoning about which code paths are reachable and which thread interleavings are possible. At the same time, many existing tools handle the problem insufficiently. Race detectors observe only the interleavings that the OS happens to produce. Fuzzers explore inputs without controlling schedules. Tools that address both dimensions together exist, but are built on interpretation-based symbolic executors that incur considerable overhead.

We present WeaveCC, a practical concurrency testing tool for C/C++ programs that jointly explores inputs and thread schedules. …

The Quality Assurance Machine – A Software Quality Assurance Architecture For Ml-Enabled Systems, Shane E. Downing

All-Inclusive List of Electronic Theses and Dissertations

This dissertation evaluates whether a reusable assurance architecture, the Quality Assurance Machine (QAM), can provide effective product and process quality assurance for ML-enabled software platforms. The QAM is a system-level SQA architecture that turns plans and policies into versioned configurations, executes them in controlled environments, and produces preserved run evidence that supports traceability, auditability, and controlled change. The study follows Design Science Research and evaluates the instantiated artifact using eight assurance requirements (AR1–AR8) synthesized from standards-based guidance, including IEEE 730 and ISO/IEC/IEEE 15026. A four-year longitudinal evaluation combines two methods. First, operational evidence from routine regression and release-validation runs, defect …

Securing Cloud-Native Systems: From Vulnerability Analysis To External And Insider Threat Detection, Jiongchi Yu

Dissertations and Theses Collection (Open Access)

Cloud-native systems have become the backbone of modern software infrastructure. However, their dynamic resource orchestration and complex configurability introduce a large attack surface and intricate security challenges. Adversaries can externally exploit vulnerabilities in cloud components or perform insider movement within cloud environments to launch attacks. As these systems increasingly support critical services, security breaches can lead to severe operational and economic consequences.

Despite extensive efforts in vulnerability detection and attack monitoring, existing approaches struggle to remain effective in cloud-native environments characterized by rapid evolution and inherent heterogeneity. In particular, they exhibit three fundamental limitations: (1) Insufficient understanding of defect patterns …

Collaborative Practices And Tool Utilization In Software Development Projects: A Student Perspective, Yi Meng Lau, Muhammad Syahmi Bin Abbas, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Software development is a collaborative activity that depends on effective teamwork, shared understanding, and coordinated use of development practices and tools. While these aspects are well studied in professional environments, they are less frequently examined within software engineering education. This study investigates how students collaborate in group projects, focusing on collaborative practices, tool usage, and their perceptions of software quality. We conducted a quantitative post-project survey with 143 second-year undergraduate students enrolled in a software development course. The results show that students actively share information and often establish team norms to support coordination and collaboration. However, students face challenges in …

Selective Concolic Testing, Guofeng Zhang, Zhenbang Chen, Ziqi Shuai, Jun Sun, Weijiang Hong, Yufeng Zhang, Ji Wang, Yang Liu

Research Collection School Of Computing and Information Systems

The principled combination of symbolic execution and random testing lacks a formal foundation, especially in deciding which inputs to symbolize. We propose selective concolic testing, a cost-aware framework that formulates this choice as an optimized policy problem of a MDP (Markov Decision Process). We model program exploration over a finite control-flow graph, where MDP states represent covered statements, actions partition path constraints into symbolic and random fragments, rewards reflect coverage gain, and costs account for SMT solving effort and sampling inefficiency. Our framework yields the first formal characterization of selective symbolization as policy synthesis in a probabilistic system. We prove …

Software Integration In Personal Healthcare Devices And The Patient User Experience, Yassine Chahid, Patrick Slattery

Publications and Research

This study examines the current landscape and future direction of medical device hardware and software integration, focusing on how each contributes to patient care. It begins by analyzing hardware focused medical devices, such as implantable tools patients may rely on to assist with their condition, alongside diagnostic and monitoring equipment used to treat conditions in a variety of medical areas (e.g. cardiovascular conditions). It then evaluates how software is currently integrated through embedded systems, data processing, and user interfaces that support real time monitoring and clinical decision making, and how this impacts quality of care for the patient whilst minimizing …

Post-Vote Tampering In Nigerian Elections And The Role Of Blockchain-Enabled Electoral Systems, Ransome Chukwubuikem Enechukwu

Electronic Theses and Dissertations

Post-vote tampering during the collation and transmission of election results remains a persistent challenge in Nigerian elections, enabling manipulation of already-cast votes and weakening public trust in electoral outcomes. Existing technological interventions, including biometric voter accreditation and digital result transmission systems, improve voter authentication but do not adequately secure the post-vote result collation process. This thesis proposes a blockchain-enabled framework designed to protect the integrity of election results during the collation and transmission stages. Using a Design Science Research methodology, the study develops a permissioned blockchain framework based on Hyperledger Fabric that records polling-unit results as immutable ledger entries and …

Automated, Modular, Agentless Adversarial Emulation In Cloud Environments For Higher Education And Student Training, Doc Harley

Senior Honors Theses

Currently, the leading technologies in the market of adversarial emulation are MITRE Caldera, Atomic Red Team by IBM, and multiple proprietary products that come with support packages for different vendors like AttackIQ, Cymulate, SafeBreach, and many more. While it is clear that much work has been done in the broad category of adversarial emulation, when it comes to open source solutions, there are no agentless options with built in automation and modularity that have good support for cloud environments. Agentless adversarial emulation provides a unique advantage in that it can be both simpler and a better representation of the true …

Reminders App Execution, Alexander Gardner

Harrisburg University Other Works

This poster highlights the creation of an Android mobile application for reminders. This app is titled It's Time, Remind! Developed with the Flutter SDK and SQLite for the local database. Firebase Authentication was utilized for user account registration, login/ logout, and profile management. Users can additionally choose to use the app without an account. Users are able to view, create, and delete reminders and notes. Reminders also notify at specified times.

Spatial Computing With The Apple Vision Pro In Minimally Invasive Procedure Simulation: A Randomized Crossover Feasibility Study, Sydney Cooper, Aaron Kyle Jones, Rahul Anil Sheth, Koustav Pal, Bruno Odisio, Mark Blaylock, Shelita Kimble, Justin Bird, David Rice, Daniel Shoenthal, Emil Patel, Vipin Kamath, Sanjay Gupta, Jeffrey Siewerdsen, Joshua Kuban

Advances in Cancer Education and Quality Improvement

Purpose: This study aimed to evaluate the feasibility of wearing the Apple Vision Pro (AVP), a mixed-reality headset that integrates augmented and virtual reality, while performing minimally invasive procedures. While studies have demonstrated that spatial computing technology can improve surgical precision and reduce the risks of surgical complications, to our knowledge, no studies have specifically addressed the impact of the AVP on task performance during simulated image-guided procedures.

Materials and Methods: Thirteen diagnostic and interventional radiology residents performed image-guided central venous catheter placement, thoracentesis, and paracentesis on simulation models. Each participant completed a non-timed practice followed by the procedures once …

The Texture Of A Threat: Adversarial Training, Cnns, And Obfuscated Malware Detection, Kaelyn Haynie

Senior Honors Theses

Accurately detecting malicious programs is an expanding field of research for machine learning (ML), with a novel approach incorporating a bytecode-to-image pipeline that produces images representative of software. These images are provided to convolutional neural networks (CNNs) to be examined for malicious pattern indicators. However, CNNs struggle to generalize these patterns effectively while still being robust against adversarial data, an issue which this research addresses with adversarial training. In this paper, three unique CNN architectures (a DBFS-MC-inspired baseline, MIRACLE, and PSP-CNN) are trained for binary classification with 15,000 benign and malicious software samples encoded into images for Android, Windows, and …

A Backend Database Architecture For Persistent Epilepsy Classification Records, Attiksh A. Panda, Deep Desai, Artem Zabarov, Katrina D. Prantzalos, Satya S. Sahoo, Shuai Xu

Student Scholarship

Epilepsy affects over five million people globally each year, yet consistent clinical diagnosis remains a persistent challenge due to the lack of standardized classification workflows across medical institutions. The Four-Dimensional Epilepsy Classification (4D-EC) framework, developed by Lüders et al., provides a comprehensive structure for characterizing paroxysmal events across four dimensions: seizure semiology, epileptogenic zone, etiology, and comorbidities. Despite its clinical and educational value, no dedicated informatics platform existed to support its routine use until recently, limiting widespread adoption among clinicians and trainees. This project addresses that gap by implementing a full-stack web application that operationalizes the 4D-EC framework for clinical …

Umm (Ultimate Memory Manager): A Note–Taking App Built From Scratch, Caleb M. Early

ASPIRE 2026

For my honors project, I’m building UMM, an advanced note-taking application built entirely from scratch. I’m someone who takes many notes and primarily uses OneNote and Notion, but over time have found myself wanting something faster and more flexible than any note-taking application I could find. UMM is my attempt to create the note-taking app I wish I had, as well as learn how to create such a program.

Instead of relying on pre-made code, I built my own systems for how documents are structured, edited, saved, as well as how the cursor moves, text is formatted, and how selections …

Developing Machine Learning Algorithms For Highly Imbalanced Neonatal Disorder Data, Ali Nawaz

Thesis/ Dissertation Defenses

Neonatal disorders such as low birth weight, very low birth weight, extremely low birth weight, preterm birth, and very preterm birth increase the likelihood of high neonatal morbidity or mortality and call for early identification. However, the rarity of occurrence of these conditions in the clinical datasets has resulted in a severe class imbalance, raising questions about the application of binary classification models to them. Therefore, this thesis proposes a sequential methodological framework for neonatal disorder detection under different assumptions related to the availability of labels. Initially, binary classification experiments are conducted to analyze the behaviour of commonly used classification …