INI Students Explore Topics Ranging from Cybersecurity Education to Network Traffic Management in Master’s Thesis Projects
By Evan Lybrand
Media Inquiries
INI Communications
At the Information Networking Institute (INI), students can choose to complete their program in three or four semesters. With the longer degree program, students are able to deepen their engagement by completing a master’s thesis, a development-based project or an area of concentration through coursework. Students interested in strengthening their research skills often select the master's thesis, which can result in publishable work and prepare them for further research activities.
This year, 12 graduating students successfully defended a master’s thesis, representing three degree programs: M.S. in Information Networking (MSIN), M.S. in Information Security (MSIS) and M.S. in Artificial Intelligence Engineering – Information Security (MSIAE-IS). Topics range from cloud-based malware protection to enhancing software and Machine Learning (ML) integration to improving network traffic management.
Explore the cutting-edge work being done by these INI students.
M.S. in Information Networking
Darshil Kaneria: VCCAnalyzer: Identifying Congestion Control Algorithms Used By OTT Platforms
Congestion control algorithms (CCAs) manage data flow in networks to optimize throughput and minimize delay. They are essential for network performance, particularly in applications such as video streaming. Identifying the CCA used by an Internet service provides useful insights into how the interactions between adaptive bitrate streaming algorithms (ABR) and congestion control impact video streaming quality. Prior work, such as CCAnalyzer, classifies a sender’s CCA by passively monitoring network traffic between a third-party service and a controlled receiver. However, video streaming applications pose additional challenges for these methodologies due to ABR, which introduces off-periods and irregular traffic patterns by limiting the amount of network activity when the video buffer at the client is sufficiently full. In this thesis, we present VCCAnalyzer, which addresses these challenges by carefully selecting appropriate link rates to minimize ABR interference and applying interpolation and smoothing techniques to eliminate drain events, creating clean traces. We explore two classification techniques: (1) Dynamic Time Warping (DTW) as a metric for a 1-nearest neighbor approach, achieving approximately 93% accuracy, and (2) a shapelet-based approach to identify distinctive sub-patterns within traces that serve as discriminative features for CCAs. To demonstrate the efficacy of VCCAnalyzer, we conduct a measurement study examining the CCA deployment across major streaming platforms, including Disney+, Hulu, Twitch, and other commonly visited websites. Our findings reveal some variations in congestion control strategies among these services. Our results demonstrate that VCCAnalyzer can effectively classify CCAs in video environments where traditional methods struggle.
Dongfang Ling: Leveraging Isomorphisms to Facilitate Zero-Shot KBQA Generalization
Knowledge Base Question Answering (KBQA) systems provide a unified and user-friendly approach for accessing knowledge bases. However, they often struggle with generalization beyond the training distribution, particularly evident in real-world scenarios where knowledge bases are vast and continuously evolving. Designing systems to perform question answering over KBQA on unseen schema items in a zero-shot setting remains a challenge. To address this, we leverage isomorphism (ISO) information as scaffolds of queries, enabling KBQA systems to generalize to unseen distributions without retraining. We explore the utility of ISO information across three predominant KBQA approaches: ranking-based, coarse-to-fine, and generation-based methods. Our experiments highlight significant performance improvements when gold ISO information is incorporated, especially in Exact Match (EM) and F1 scores, as demonstrated on the challenging GrailQA++ dataset. However, relying on gold ISO information during inference is impractical. To overcome this limitation, we propose and evaluate methods for automated ISO prediction, including (large) language models and graph neural networks, along with data augmentation techniques to address dataset imbalance. Our findings indicate that while integrating ISO information enhances inference quality, accurately predicting ISO categories remains challenging due to representation limitations. This work establishes a foundation for leveraging isomorphism-based strategies to facilitate zero-shot generalization in KBQA systems and identifies avenues for future exploration.
Bohan Liu: Enhancing Software and ML Collaboration: Integrating Large Language Models for Standardized Requirement Analysis
In modern tech companies, deploying machine learning (ML) models as part of real-world products is increasingly common. However, data scientists—who are typically responsible for developing these models—may not be familiar with specifying software requirements that reflect broader product-level considerations and involve diverse stakeholders. This project aims to support data scientists in formulating requirements that align with established engineering standards. First, we present a set of structured leading questions tailored to various quality attributes of ML systems, such as accuracy, robustness, and explainability. These questions guide users to consider concrete usage scenarios and stakeholder perspectives, helping them develop more thoughtful and context-aware requirements. Second, we integrate a large language model (LLM) to automatically critique user-provided requirements according to the quality characteristics defined in ISO/IEC/IEEE 29148:2018. The system evaluates both individual requirements and the overall requirement set, identifying issues such as ambiguity, unverifiability, or incompleteness, and offering suggestions for improvement. To enhance critique performance, we experiment with various prompt engineering techniques—including zero-shot, few-shot, prompt chaining, and multi-role prompting—to enhance the model’s ability to assess requirements effectively. Evaluation is conducted against human judgments to understand the accuracy and limitations of each method in the context of requirements engineering for ML-based systems.
Yuchen Liu: An Empirical Study of Adopting UDF Outlining in Modern Databases
User-Defined Functions (UDFs) play an integral role in enhancing database extensibility and supporting complex queries, yet their usage often imposes performance degradation due to interpretation and context-switching overheads. UDF outlining is the state-of-the-art UDF optimization technique that inherits UDF inlining’s ability to eliminate such overheads while avoiding its drawback of generating complex subqueries which leads to slow execution plans from the database optimizer. This thesis dives into the design details and tradeoffs of PRISM, the first UDF optimization module that implements UDF outlining. Through a combination of experimental benchmarking and performance profiling, this study evaluates the impact of adopting PRISM in four modern database systems. The results highlight the applicability of PRISM and the conditions under which PRISM yields substantial performance improvements. Insights gained from this analysis contribute to the broader discourse on enhancing the execution efficiency of UDFs through the introduction of dedicated PRISM-like UDF optimization modules to database systems.
Kshitij Rana: Building a High-Performance In-Kernel Traffic Shaper
Modern networked systems must balance two competing design goals: achieving high performance—characterized by optimal throughput and low latency—and maintaining flexibility in managing network traffic. The kernel network stack is known to introduce performance bottlenecks, leading to the adoption of kernel bypass networking as a popular high-performance solution. By interfacing directly with the NIC, kernel bypass minimizes the protocol stack overhead, data copying, and context switching typically involved when sending data through the kernel. However, bypassing the kernel sacrifices configurability, as it eliminates the central authority needed to allocate resources across competing data flows accessing the NIC. In traditional kernel architectures, traffic shapers play a critical role by enabling network operators to allocate resources among multiple applications, optimizing performance and prioritizing essential traffic. Unfortunately, implementing traffic shaping in kernel bypass frameworks reintroduces the same overheads as monolithic kernel architectures. This thesis presents and evaluates a high-performance in-kernel traffic shaper capable of delivering high throughput while effectively managing traffic across multiple applications, even in kernel bypass-like architectures. This solution is powered by Ensō, a novel NIC interface that allows the kernel to interpose on the data path, bridging the gap between performance and flexibility in networked systems.
M.S. in Information Security
Michalis Antoniades: Chronos: Efficient Time-Based Detection and Response for Safety-Critical Real-Time Embedded Systems
Safety-critical industries such as automotive and rail have long prioritized operational safety to prevent accidents and failures that could lead to catastrophic outcomes. However, as these systems increasingly incorporate complex digital components and connectivity features, their threat landscape has expanded to include cybersecurity risks. Embedded systems, which are fundamental to the operation of trains and vehicles, are particularly vulnerable due to their reliance on C; a language that is not inherently memory safe. Additionally, these systems typically lack memory isolation between the embedded OS kernel and application code, making it easier for an adversary exploiting vulnerabilities in application code to compromise the underlying system. Despite this growing threat, cybersecurity has not been prioritized to the same extent as safety assurance. This is largely due to the severe resource constraints of microcontrollers and the performance overhead introduced by security mechanisms. Many microcontrollers used in safety-critical environments such as those powering vehicle braking systems operate with only 32 kilobytes of memory and processor speeds as low as 80 MHz. These systems also have strict real-time constraints, requiring immediate responsiveness to prevent catastrophic failures.
To address these challenges, Chronos was developed as a lightweight kernel extension that brings endpoint detection and response (EDR) capabilities to real-time embedded systems. Chronos employs timing-based detection mechanisms to identify abnormal task behavior and enforces memory separation through the Memory Protection Unit (MPU) to isolate EDR and kernel code from untrusted application code. It dynamically adapts to system load, reducing the frequency of security checks during high utilization to maintain responsiveness, and increasing it during low utilization to enhance security coverage. To detect reconnaissance and tampering attempts, Chronos instruments OS kernel APIs, blocking unauthorized modifications to security-critical code and data structures. When a security event is detected, forensic data is transmitted to a remote server for real-time threat analysis. Chronos is implemented as an extension to FreeRTOS and evaluated on a system that simulates UAV operations. Performance was measured using the CoreMark benchmark. Under the most aggressive security policy configuration, Chronos incurred a runtime overhead of 0.86% and 45.1% increase in code size. These results demonstrate that Chronos is lightweight and suitable for resource-constrained real-time systems.
Rohil Chaudhry: Identification and Analysis of Emerging Propagation Techniques Utilized by Malware Targeting Cloud Environments
With the significant shift towards Cloud computing, critical workloads in Cloud environments have reached unprecedented levels. However, this transition has also drawn the attention of attackers, targeting these workloads, with Cloud attacks at an all-time high. Attackers exploit these workloads by finding low-hanging entry points and readily available exploits. These entry points include misconfigured Cloud services, exposed APIs, and weak authentication mechanisms, which are exploited to establish a foothold within the victim’s Cloud environment. Once inside, attackers utilize various techniques to maintain persistence. One of the most common methods involves leveraging persistent data storage within the victim's Cloud environment. By embedding malware into data repositories, containers, or virtual machines, attackers aim to propagate malicious artifacts throughout the Cloud environment. This raises the question: How are these attacks continuing to succeed? Especially when Cloud providers are consistently enhancing their Cloud-native security services. This study aims to address the aforementioned question by conducting experiments involving two of the most prevalent Cloud malware families, AndroxGh0st and Legion, and the Cloud services targeted by them. The primary objective is to identify and analyze the propagation techniques leveraged by prevalent Cloud malware while evaluating the effectiveness of existing safeguards against these threats. Furthermore, the study seeks to propose recommendations for enhancing the efficacy of Cloud-native services in mitigating the propagation of modern malware attacks within Cloud environments.
Ryder Daniel: Survey of EDR Evasion Techniques, Trends, and Taxonomy for Classifying Modern Attacks
Defending computers has been a cat and mouse game for the past half-century. Through many iterations, computer defenses have evolved from rudimentary searches for a single type of virus to deeply networked defenses protecting entire organizations with live feeds of information. The culmination of this evolution is the Endpoint threat Detection and Response (EDR), a centralized system with distributed agents on endpoint systems which monitor and transmit system information to a central point for mass data processing to mitigate threats. Naturally, EDRs are now the subject of attack in the cyclic story of attack and defense. This thesis explores the technologies and progression of EDR systems, trends of attacks, and aims to provide some insight into this cyclic battle and propose a means for defenders to systematically classify this growing class of attack. More specifically, this paper will discuss the early EDRs and security solutions, attacks on them, how EDRs have adapted, the modern state of EDR evasion and proposes a comprehensive taxonomy for classifying EDR evasion techniques in a manner that is more useful to defenders.
Jacob Kenny: Reimagining Triple-Entry Accounting: A Blockchain System for Confidential Transaction Verification
This thesis presents a blockchain-based accounting system that prioritizes transactional privacy, modular design, and automated verification. It does so without relying on cryptocurrencies or public transparency. Unlike most blockchain-based accounting platforms, which apply blockchain principles to accounting, this system inverts the model. The result is a centralized, permissioned network built on Hyperledger Fabric that uses Chaincode-as-a-Service, private data collections, and event-driven listener services. The system enables organizations to verify transactions on a per-transaction basis. At the same time, it maintains the confidentiality of their financial records. Chaincode functions emit events that trigger automated cross-organization workflows. These allow for confirmable but private triple-entry accounting with little user input. Unlike prior work in the field, this implementation is tailored for internal audits and small- to medium-sized enterprises. The system was tested in a local, multi-organization environment. It demonstrated correct behavior across a range of transaction workflows. The system resists misuse, supports dynamic on-boarding, and has the ability to scale. This work affirms that blockchain-based accounting can be both practical and private without deviating from established accounting practices.
Taylor McCampbell: Exploring Barriers to K-12 Cybersecurity Education
Cyber security is experiencing a workforce crisis. However, access to cyber security education for K-12 students remains scarily low. To better understand this phenomenon, we conducted a survey of teachers based in the United States registered to picoCTF: Carnegie Mellon's free cyber security education platform. We asked teachers questions intended to understand their background, school, and local community and the things that prevent them from offering, growing, or expanding cyber security education. To enrich the data set, we asked interested parties to be interviewed (n=14) so we could better understand their specific situation. We find several extrinsic barriers related to student attitude, funding, and administrative support. We also find second order barriers related to perceived student maturity, lack of confidence, and others. Our results have implications for the strategies curriculum designers, administrators, teachers, industry players, and government entities may wish to use to incentivize and grow K-12 cyber security education in the United States.
John Samuel: Code Modernization Techniques Using Clang-Tidy for C23 Checked Arithmetic
The first major integer safety issue occurred in 1975 with the DATE75 bug, where dates past January 4th 1975 could not be represented using a 12-bit integer. Almost 50 years later, integer safety bugs are still an issue programmers must consider when writing code. This is especially important for safety critical systems, which are often written in C. C as a programming language is also quite old and is known to be difficult to write secure code with. Recently, the C language standard recently introduced a set of checked arithmetic macros in an attempt to help programmers write more secure C. This thesis is an exploration into the feasibility of using compiler-assisted techniques to modernize safety critical systems so that they use checked arithmetic.
M.S. in Artificial Intelligence Engineering – Information Security
Jiajun Gu: Evaluating Selective Encryption Against Gradient Inversion Attacks
Gradient inversion attacks pose significant privacy threats to distributed training frameworks such as federated learning, enabling malicious parties to reconstruct sensitive local training data from gradient communications during the aggregation process. While traditional encryption-based defenses, such as homomorphic encryption, offer strong privacy guarantees without compromising model utility, they often incur prohibitive computational overheads. To mitigate this, selective encryption has emerged as a promising approach, encrypting only a subset of gradient data based on their significance under a certain metric. This paper systematically evaluates selective encryption methods with different significance metrics against state-of-the-art attacks. Our findings demonstrate the feasibility of selective encryption in reducing computational overhead while maintaining resilience against attacks. We propose a distance-based significance analysis framework that provides theoretical foundations for selecting critical gradient elements, and through extensive experiments on different model architectures (LeNet, CNN, BERT, GPT-2) and attack types, we identify gradient magnitude as a generally effective metric for protection against optimization-based gradient inversions. However, we also observe that no single selective encryption strategy is universally optimal across all attack scenarios and provide guidelines for choosing appropriate strategies for different model architectures and privacy requirements.