Automated vulnerability analysis utilises machine learning models or agents to find issues, bugs, and exploits in code and protocols. Prior works/approaches primarily use large language models (LLMs) or graph neural networks (GNNs), with the former being more common due to prior, unfair, comparisons in the favour of LLMs. However, the theory suggests that GNNs should be better in optimal situations but less flexible. Moreover, GNNs and LLMs more have further advantages other than accuracy. For example, current LLM-based approaches have been shown to be significantly impacted by memorisation, which perhaps GNN or another alternative approach can resolve.

System prompts are an input text provided to Large Language Model (LLM) that takes precedence over most other subsequent inputs, it acts as one of main aspects of aligning an LLM towards a target tasks. Prominent prompt engineering tutorials state that providing an LLM with a 'role' to play through the system prompt is one of the most effective types of system prompt, however, the theory suggests that a simpler system prompt strategy with greater similarity to relevant training data for the current task would be most effective. Prior empirical analysis in the topic has been separately demonstrated that effective prompt optimisation, and usage of multi-roleplaying prompts can improve performance, but they are not directly compared. So the goal of this thesis is to perform a direct analysis between role-based and optimised prompts on LLMs applied in the cybersecurity domain, and potentially design and implement a prompt optimisation strategy for teams of LLM agents.

Jailbreaking and privacy attacks are performed by providing specific inputs to a language model that leads to it providing outputs that are either unsafe/unintended or leak private information of the user of the model's training data. With the advancement of Large Language Models (LLMs), they have also improved substantially in code completion and generation capabilities, and have become very prominent within the software development workflow, usually in the form of autocompletion/suggestion or vibe coding. However, code projects provide a greater number of exploitable vectors to perform jailbreaking and privacy attacks, e.g. variable names, file names, functions, comments, enabling evasion of current filtration methods used by LLMs to prevent them. The goal of this thesis is to develop a mitigation strategy to help prevent jailbreaking and privacy attacks within the code project setting.

DNS tunneling is a technique by which a covert communication can be realized bypassing firewalls or other network packet filters. This is achieved by encoding the information in DNS queries and responses, the permeability of which through network filters is essential for the internet functionality. The goal of this thesis is to develop and implement a novel DNS tunnel that incompasses new encoding strategies to potentially achieve higher traffic volume and lower detectablilty compared to existing implementations. It should be explored, which DNS protocol features are viable for use and evaluated, how they comparatively perform compared to existing solutions.

Students interested in this topic are ideally expected to be knowledgable about networks and internet protocols, have prior experience in programming with Python and are proficient in working with Linux to the extend of setting up containerized applications, network configurations, and firewalls.

The Internet is a massive, complex system held together by a protocol from the 1990s called BGP (Border Gateway Protocol). The problem? BGP was built on trust, and that trust is now a critical vulnerability. Every day, BGP hijacks and route leaks redirect massive amounts of traffic, causing major outages, enabling cryptocurrency theft, and facilitating state-level espionage. We are looking for motivated students to join our cutting-edge research on routing security and RPKI. We have a variety of topics that range from the hunting down new vulnerabilities and attack vectors, to large-scale internet security evaluations, and secure protocol design.

Fuzzing is a technology for automizing the analysis of implementation against errors, bugs, and vulnerabilities. Modern fuzzing techniques have greatly accellerated the hardening of parsers and protocol implementations in particular. In our research group, we develop, utilize and innovate on fuzzing frameworks for Internet cryptographic protocols.

We are looking for motivated students to research, develop and integrate components that form part of our fuzzing frameworks. Topics may range from in-depth mutation strategies, integration of oracle techniques to solving complexity and scaling. Our main development languages are Rust and Python, so students are expected to have familiarity with or invovled interest in learning these languages. Moreover, students should be comfortable with working in Linux, navigating build and virtualization processes, and thoroughly documentating their work. Please get in touch for more details.

Denial-of-service (DoS) attacks aim to disable Internet infrastructure in a variety of ways. Distributed servers that independently or recursively request resources from the Internet are particularly vulnerable to abuse in distributed DoS (DDoS) attacks. The amplification factor of such systems is crucial: Can an attacker sending few messages trigger a large amount of traffic being sent to the victim? The goal of this thesis is to research, analyze, and evaluate mechanisms and attack vectors in Internet infrastructure that can be exploited for (D)DoS attacks.

Students interested in this topic should have background knowledge of distributed systems, Internet protocols, network components, and basic concepts of cybersecurity (or be willing to acquire this knowledge before starting the work). In addition, knowledge of C (possibly Python, Rust) and experience with Linux are required.

The internet is comprised of over a million networks, all of whom are owned by different entities and host a variety of services. The process of extracting information about these prefixes is difficult and complicated, especially in bulk. Any internet user can extract a subset of information on a per network basis by querying different online sources. However, most sources have incomplete, sometimes outdated information, and generating a correct network profile requires querying and parsing data from multiple sources with different formats, and extracting and processing information based on semantic context.

In this thesis, we want to bring order to the chaos. The aim is to develop an LLM-powered agent that collects, extracts and categorizes prefix information from multiple sources to create a dataset of internet prefix information. Students interested in this topic must have very good programming skills (any language), and either existing experience or very strong interest in learning how to use, train and refine LLMs. This topic requires familiarity or willingness to learn how to build RAG pipelines.

Much like our universe, the Internet is plagued by Background Radiation (IBR): millions of unsolicited packets sent daily to IPs and ports that were not prepared to receive them. The nature of these packets can be either benign (erroneously sent, service/scanner misconfigurations) or malicious (worms, DDoS backscatter, vulnerability scanners). Regardless of the nature of these packets, internet traffic pollution tells a story about the underbelly of the Internet: the orphaned misconfigured servers, the malware knocking on doors to find itself a new home, infected hosts (bots) scanning the internet for new peers, etc.

The purpose of this thesis is to analyze historical and recent data on background radiation, evaluate the IBR traffic, profile the sources and purpose of this traffic, and propose mitigation techniques. Students interested in this topic must have good programming skills in a language of their choice and familiarity with networking protocols.

DNS tunneling is a technique by which a covert communication can be realized bypassing firewalls or other network packet filters. This is achieved by encoding the information in DNS queries and responses, the permeability of which through network filters is essential for the internet functionality. The goal of this thesis is to develop and implement a novel DNS tunnel that incompasses new encoding strategies to potentially achieve higher traffic volume and lower detectablilty compared to existing implementations. Research should measure the current state of the DNS architecture and quantify the practicability of novel approaches.

Students interested in this topic are ideally expected to be knowledgable about networks and internet protocols, have prior experience in programming with Python and are proficient in working with Linux to the extend of setting up containerized applications, network configurations, and firewalls.