6262 CS Project Overview
This writeup contains an overview of how the project component of the class works, and it provides some ideas that can get you thinking about your project topic. You are required to work in a group totaling either two or three students. There are no free rides: everyone must substantially contribute to the project.
Timeline
16 Oct 14 Dec 14 Dec 5:00 p.m. 8:00 a.m. 8:0010:50 a.m. Proposals due Final project reports due Project poster session (Klaus atrium)
Proposal
Before starting the real work on your project, you must rst write a proposal detailing what you plan to complete during the eight weeks of project work. Your group should identify a project and work out some specic approach that you want to develop, implement, and test during the rest of the semester. You then explain your approach in a proposal document that shows that you have brainstormed, know what your project will try to show, and know how you will produce the desired results. When I read your proposal, I should understand what your goal is, what steps you are going to take, and how long you think it will take you to get there. The proposal should be roughly 1 page long. (If you need more detail: 10 point font on 12 point leading, 1 column, 0.91 margins.) It should include: A project title. The list of group members. A paragraph that explains your project, including a goal or hypothesis. What you plan to implement. The experiments you plan to run. A timeline to completion. When preparing the timeline, remember to allot time to write the nal paper and to prepare your poster. Quality writing counts. It is worth your eorts to spend time writing a good proposal: if you write the text well, you may be able to reuse some of the prose for your nal paper.
1
Final Report
After working on your projects for 8 weeks, we will hold a poster sesion to showcase the work. Each group should produce both a paper and a poster for the session. As we get closer to the end of the semester, we will discuss paper writing and poster preparation in greater detail. The paper is a conference-style document similar to what conferences call an extended abstract or short paper. It should introduce the problem addressed by your work, briey compare your work to related research, explain technically how you solved or tried to solve the problem, and present experiments and results testing your hypothesis or evaluating your implementation. I would expect a reasonable length estimate to be about 5 pages. The nal paper is due at the start of the poster session.
Poster Session
We will hold a poster session in the nal exam period of the course. Each group will present their project as a poster and will have someone manning the poster for the duration of the poster session to answer questions. If you have never prepared a presentation before, a reasonable starting point is Microsoft PowerPoint or Apple Keynote. Either produce a series of graphical slides that can be printed and mounted on posterboard, or produce a single large slide that can be tile-printed or poster-printed. Remember that posters should try to visually catch peoples attention, so include plenty of graphics. Spicing things up with color also looks nice if you have access to a color printer. The poster session will be held in the Klaus Atrium and is open to anyone in the community who feels like stopping by. We will provide an artists easel for each group. You are responsible for the actual poster, which should include some type of rm backing so that it stands upright on the easel. Wall mounting will not be available.
Project Suggestions
I have a brief list of possible project ideas, but I want to encourage you to consider thinking of your own topic. None of my ideas below are fully eshed out; my intent is to get you thinking about an idea that you can then develop into your 8 week project. When designing your topic, think about the test equipment that you will require and make sure that you will have access to that test equipment before committing to a project. Project: Your idea here. Please feel welcome to develop your own project idea. Perhaps you have already decided on a thesis topic and would like to work on something related to your thesis. Perhaps our readings so far have given you an idea. It can be fun to use a class project as an opportunity to attack an existing system in the literature, so that may be an approach to take when brainstorming.
2
If you do hit on a great idea, please talk with me about it as you are preparing your proposal and certainly before you submit your proposal. Project: Analysis of embedded software. As small devices such as cell phones become ubiquitous and Internet-connected, vulnerabilities in their software will have a signicant impact on society. Hardware devices often contain general purpose CPUs and execute software stored in ash memory. Just as software on our desktop computers contains exploitable errors, software embedded in small hardware devices can contain aws. Moreover, once errors are detected, patching the software is often cumbersome. (Do you know how to patch the software on your cell phone?) Hence, we would like to detect security vulnerabilities in embedded software as early as possible. Detecting vulnerabilities requires an understanding of the code executing on the device. In this project, you could use interactive binary analysis to study and nd aws in publicly-available device rmware. Some suitable hardware devices might include cell phones, IPTV set-top television boxes, and those broken conference-room display units in the Klaus hallways. Alternatively, if you have access to a device with previously identied aws, you could develop and demonstrate working exploits for those aws. To be most relevant to this course, these exploits should work across a network. Project: Evade a network intrusion detection system. Network intrusion detection systems (NIDS) monitor trac traversing an organizations network and try to identify trac known to be part of an attack. For example, the open-source Snort utility matches trac against a database of rules that charactize known attacks. The eectiveness of a network intrusion detection system relies upon the correctness and completeness of this database. If the database erroneously characterizes non-malicious trac, then the NIDS will generate false alarms; if the detector fails to include all patterns of malicious trac, then it will miss attacks. In this project, you could study the operation of NIDS such as Snort and develop techniques to reduce its eectiveness. You could show that an attacker can transmit benign trac that will cause the NIDS to generate a high rate of false alarms that will overwhelm a security administrator, or you could construct attack transformations that will alter an existing, detected attack into an equivalent but undetected attack. If you successfully reduce the NIDS eectiveness, you should consider how the NIDS could be changed to regain some usability. Project: Linux process tracing via the lesystem. A counterpart to network intrusion detection systems is a host-based intrusion detection system (HIDS). Like a virus scanner, a HIDS is installed locally on the machine that it protects. A common HIDS activity is to monitor the execution of processes by observing their system call behavior.
3
Many host-based intrusion detection systems use operating system supported process tracing mechanisms to follow the execution behavior of a vulnerable process. Linux provides tracing via the ptrace system call. Ptrace is cumbersome, inecient, and dicult to use when tracing multiple processes or forking processes. System V based UNIX systems provide a dierent interface to process tracing and control. One process traces another by reading and writing les in the /proc lesystem. Its part of the UNIX mantra: everything is a le, including other processes. For example, a process can stop the execution of another process by writing a command to the le /proc/PID/ctl, which is the process control le. (Note that this le does not exist on stock Linux systems). Process control via the /proc lesystem on UNIX is elegant, ecient, and scalable to large numbers of traced processes. You could develop similar process tracing and control for Linux. This is an implementation-based project: your goal would be to produce a Linux kernel module that will augment the existing [inadequate] Linux /proc lesystem with additional les oering UNIX-style tracing and control. Project: Masquerade detection. A malicious human user may masquerade as a dierent, legitimate user of an interactive computer system. Perhaps the attacker learned the victims password, or perhaps the victim stepped away from their computer for a meeting or a restroom break. The masquerader can then use the victims credentials to execute actions that cause harm to the victim or the greater computer system network. and Masquerade detectors attempt to identify these malicious impersonators based upon the way the human interacts with the computer. Just as a software reference monitor veries requests to an API, a masquerade detector veries requests to the human API (thats a keyboard and mouse, in less grandiose fashion). After building a prole for the normal user, the system can detect anomalies as potential masqueraders. Interesting problems in masquerade detection remain. What is the appropriate set of human actions to monitor? How do you characterize normal computer usage? A project may try to construct a masquerade detection system that addresses these questions. Project: Host-based egress monitoring. Botnets and self-propagating worms often produce high volumes of specially-constructed outgoing network trac. The presence of such trac may indicate the presence of malicious code on a system even if other software security tools have not detected any intrusion. Egress monitoring looks at outgoing network data, and host-based egress monitoring performs the data inspection at each host. A project could develop such a monitoring system for the purpose of identifying malicious code that uses the network. Project: Spyware detection. A dierent approach is to use some type of egress monitoring to detect leaks of private data. A project could develop a
4
system that monitors outgoing trac and searches for trac containing private information. Project: Database response monitoring. A similar approach may detect software exploits of vulnerabilities in database query construction. For instance, a SQL injection attack passes SQL commands through input, and those commands frequently cause leaks of private information in a backend database. A common version of this attack dumps all rows from a table. If we consider the rows that match a query as the return value of the query, a query that dumps all rows has a return value that looks suspiciously dierent from legitimate queries that return a single row. Although research eorts have produced anomaly detectors that check SQL queries, no eorts have tried to detect attacks by realizing that a querys return value is anomalous. A project could develop an anomaly detector inspecting returned results from SQL queries with the intent of detecting SQL injection attacks. Project: Multilevel secure lesystem. Government folks have wacky problems that are fun to think about. They have existing classication schemes that partition information into levels: unclassied, secret, top secret, codeword, and so on. We could envision partitioning information at the granularity of les. Each le in the le system carries a label indicating to which security level it belongs. We may even be able to implement such partitioning with strategic use of group identiers in a UNIX le system, for example. But the government folks smile politely and tell you they want something more. They want ne-grained partitioning that may even be character-bycharacter within a single le. A good example of this need is an email message. An email may contain some information at the unclassied level and other information at the classied level. A person with classied authorization sends the email to two recipients. The rst recipient is also authorized to see classied material and their operating system will present their email client with the full contents of the message. The second recipient smoked too much pot in college and cannot get a classied clearance. However, they still have sucient privilege to read the unclassied portions of the same email. Their operating system redacts the classied content and returns only the unclassied portion of the email to the second recipients mail reader. A project could develop a lesystem that supports ne-grained tagging of data within the les. Requests for data in a le would then be contingent upon the authorization of the user making the request. The operating system would return only data labeled with privilege at or below the users privilege level. There are clearly hard problems in this domain: le formats, writes that cross privilege boundaries, bootstrapping an initial tagging, and others. Ignore the hard problems for now, and just try to get the lesystem working for the simplest case of les of bytes. Email is the killer app. If you can provide the type of email client user experience I described above, then youll be added to the governments watch
5
list. The good watch list. Project: Comparative analysis of encryption standards or implementations. In class, we discussed a wide collection of encryption standards, algorithms, and implementation optimizations. How do these work in practice? You could study common encryption algorithms used in network communication and attempt to verify the common wisdom posited by the textbook about those algorithms. Project: Network connection visualization. Many users have no idea whats happening in their computers. This includes the complexities of many simultaneous network connections between strange programs executing locally and machines identied only by numeric IP addresses out in the Internet. In this project, you could develop a tool that tries to improve an average users ability to understand the network behavior of their computer. For example, your tool could have a way to visually represent remote hosts, local programs, and the connections between these. Project: Network attack visualization. Repeat everything from the previous point for administrators and networks. Network administrators may be operating network intrusion detection systems like Snort, but Snort generates alerts that may be cumbersome, dicult to understand, and at such a high rate that an administrator is unable to cope with the alerts. A network attack visualization tool can condense a stream of alerts from an intrusion detector into one or more visual representations of the currently-active alerts. For example, a visualization could show the IP ranges of the Internet that are appearing as sources of attacks against the administrators network. This could be a 3dimensional graph, where the X & Y axes characterize the IP address and the Z axis shows attack volume or attack severity from that address. The intention is to allow an administrator to rapidly assess the health of their network by quickly seeing whats being thrown against it from attackers. Project: Phishing detection in an email reader. Phishing messages are email messages from attackers that appear to be legitimiate messages from organizations with your privileged data. If users erroneously visit web sites linked from the email messages, they may willingly reveal privileged data to the attacker because they thought the site was legitimate. An email reader can try to protect its users by detecting these phishing messages. You could develop a plugin for an email reader that detects messages that are likely to be phishing attempts. This plugin will likely look at properties of email messages, such as sender addresses and the links contained within the message. Mozilla Thunderbird and Microsoft Outlook both oer the ability to add functionality as extensions and add-ins, respectively.
6
Project: Phishing detection in a web browser. A phishing email often send the user to a phishing web site. In addition to email-based phishing detection, you could attempt to identify phishing sites when the user browses to them in their web browser. One idea: the browser could contact Google whenever the user visits a machine with a domain name not seen before in their browsing history. If Google knows about the site and returns many search results, then it is probably a legitimate company. If Google has not indexed the site, then it is probably a phishing site that has only been around for a brief period. Project: Password protection in a web browser. Another defense against phishing attacks obscures the privilege information that a user may inadvertently reveal to a phishing web site. For instance, the browser could modify the password entered in a form by the user before sending it to the remote server. If the modication depends upon the name of the web site hosting the form, then the phishing site would see dierent information than the legitimate site. If the modication cannot be easily reversed, then the phishing site cannot recover the password actually typed by the user and hence cannot compute the data sent to the legitimate server. Although the user typed their password in a form sent to the phisher, the phisher ends up receiving useless information. You could implement a plugin for a web browser that provides such modication to user-entered data. You would need to show that the basic functionality of logging into a secure site still works for legitimate sites, and that the information that may be disclosed to a phishing site is insucient for the phisher to masquerade as the user.
7