Sample Research Projects
The REU site at NCAT introduces six sample research projects. The REU projects are carefully selected from open problems and are derived directly from on-going research projects. Early in the program, each student will choose a focused project and will be matched with the faculty mentor associated with that project.
Computational Framework for Identity (Dr. Albert C. Esterline): Our framework takes situations as basic. Id-situations include identity-relevant actions. Identifying or characterizing an individual can involve various props, which relate to other situations. A structure consisting of an id-situation and supporting situations is an id-case. Our framework thus reveals structure, which is captured abstractly using category theory, and category theory provides a theoretical foundation for various operations on identities. The initial challenge is to develop software for an analyst to capture id-situations and the supporting situations that go into an id-case. We will use semantic-web, especially social-semantic-web, technology.
Extending the Use of WebIDs (Dr. Albert C. Esterline): The Web has a single global identification system—the URI. URIs on the Semantic Web should fulfill two requirements: a description of the identified resource should be retrievable with standard Web technologies ("de-referenceable" URIs), and a naming scheme should not confuse things and the documents representing them. We focus on what can be inferred from the profiles of a constellation of WebIDs, which may have wider implications. One challenge is to increase what can be inferred from the WebIDs. Another challenge is to develop guidelines for profiles of software agents and even computational resources in general. A further challenge is to consider the researchers referenced by WebID in an Research Objects (ROs) and, using their profiles, consider how they form a team relevant to the research.
User Active Authentication Using Touch Dynamics (Dr. Kaushik Roy): The traditional method for authenticating an individual requires that individuals use some knowledge or token to confirm their identity. A biometric-based authentication system can also be implemented. This system has an advantage over knowledge-based and token-based systems in that biometric modalities are difficult to replicate and are unique to individuals. However, once authentication has taken place, a session remains active and a device remains unlocked until an individual or the server closes the session. As long as sessions remain active, typical systems are at risk to being taken over by someone other than the individual if that individual leaves their station or device.
To counteract this, active authentication can be implemented to continuously monitor the identity of the individual using a device. Behavioral biometrics can be monitored unobtrusively in the background, without the need to explicitly query the user for input. There has been research done on behavioral biometrics for active authentication: Keystroke dynamics, mouse movement biometrics and touch biometrics. In this work, we will investigate the touch dynamics to actively authenticate on a case-by-case basis.
Mitigating Replay Attacks (Dr. Kaushik Roy): A biometric based replay attack occurs when a user’s biometric access information is captured by a hacker while it is being passed across a network connection. Once the information is obtained, the hacker simply passes the captured information across the network at a later time to gain unauthorized access. Replay attacks can occur on devices using password or token access, but passwords and tokens can also be easily replaced if access information is compromised. However, biometric information cannot be as easily replaced. This project will focus on mitigating replay attacks in Biometric based Access Control Systems (BACS).
Web Client Identification (Dr. Xiaohong Yuan): Web applications and web servers are widely used in various organizations, and they have been targets of numerous attacks. Though web application developers need to take measures to write secure applications to prevent known attacks, when such measures fail, it is important to detect such attacks and find the source of the attacks. The main challenge of this project has two aspects: (1) Identify features of client web activity for creating profiles of clients; (2) Classify the client web activity into one of several categories such as normal, DoS, SQL injection, or other abnormal.
Cyber Threat Identification (Dr. Xiaohong Yuan): Security and assurance of cyberspace is vital to nearly all aspects of our lives and our social, economic and political systems. Computer security researchers and practitioners have developed various network intrusion detection methods and tools to detect and prevent network intrusions. The REU students will conduct the following research activities: (1) From different data sources, extract features that can be used for characterizing user behaviors. The data sources include host-based IDS logs, network-based IDS logs, firewall logs, network traffic captured by tools such as tcpdump, results from vulnerability scanners, etc. (2) Select appropriate machine learning and data science techniques (such as clustering, Bayesian networks, neural networks, fuzzy logic, static models, etc.) to correlate data from different files and to learn (that is, to characterize) the user behaviors instantiated in the data.