Identifying Silent Vulnerability Fixes in Software Dependencies using Differential Static Analysis

Modern software relies on many open-source packages and library functions. These dependencies are a frequent source of security vulnerabilities in applications too. Most efforts to find vulnerable open-source library functions rely on vulnerabilities listed as CVEs (Common Vulnerabilities and Exposures) in NIST's National Vulnerability Database (NVD). There is evidence to suggest that many security vulnerabilities in libraries are fixed without any notice. I have used a method we call differential static analysis to find those silent fixes. For this research I have used PyGithub API and Flawfinder, Rats, Cppcheck and Sonarqube

MS Thesis:

AIDA

AIDA, the Ancient Inscription Database and Analytic system can be used to translate and analyze ancient Minoan language. The AIDA system currently stores three types of ancient Minoan inscriptions: Linear A, Cretan Hieroglyph and Phaistos Disk inscriptions. In addition, AIDA provides candidate syllabic values and translations of Minoan words and inscriptions into English. The AIDA system allows the users to change these candidate phonetic assignments to the Linear A, Cretan Hieroglyph and Phaistos symbols. Hence the AIDA system provides for various scholars not only a convenient online resource to browse Minoan inscriptions but also provides an analysis tool to explore various options of phonetic assignments and their implications. Such explorations can aid in the decipherment of Minoan inscriptions.

Link: https://digitalcommons.unl.edu/computerscidiss/174/


Guessing Password by learning the latent relations of the leaked passwords dataset

Password is the most famous and broadly used authentication method. It is famous because passwords are chosen by human-users and it is a personal key that only owned by the individual. We choose our password in a way that we can remember and use anytime, which makes those passwords vulnerable to guessing attacks. State-of-the-art password guessing tools like HashCat and John the Ripper (JtR) uses password generation rules, such as Append_d (e.g., “password123456”) or Leetspeak (e.g., ”password” becomes p4s5w0rd), besides regular password dictionaries. They can also extend their rules but it requires expert knowledge of rules and manual-analysis of password pattern, which increases the time to guess passwords significantly with the increment of different rules. Other approaches to increase password guessability are using Deep Learning to learn the underlying distribution of password using leaked passwords. Works on these approaches are “Fast, Lean and Accurate: Modeling Password Guessability Using Neural Networks” and “PassGAN: A Deep Learning Approach for Password Guessing”. The PassGan approach on RockYou testing set resulted with 31.62% matches and using HashCat it was 30.22%, which showed a little improvement in guessing password using theory grounded machine learning algorithm over human-generated password rules. We propose a novel approach using Variational Autoencoder (VAE) that learns the distributions of the passwords from a large data set of leaked passwords and approximates passwords by learning the latent relations. We are using VAE because it can model the latent variable more accurately and produce the probability of cracking a password, which indicates the weakness of a password. To summarize, our goal is to attack a user-given password and suggest the user about the probability of crackability of his password. We also intend to compare our results with “PassGAN” and “Fast, Lean and Accurate” approaches.

Undergrad Thesis:

Motion Tracking by Image Processing

There are different strategies to find out motions of each pixel. In our thesis we have used OpenCV library and OpenGL. Our objective of this thesis is to track the object in the test field using image processing. To complete our objective, we define a complete workflow as to rotate and move the camera, used a vehicle with attached camera so that the gap between the camera and the surface remain same. With this workflow and the above described way we calculate the six parameter model, which gives us three equations with three variables. To solve this very problem we used Guss-Jordan elimination rule.