Projects

Cellular Automata for Anomaly Detection

Term Paper for Course on Biologically-Inspired Algorithms

Abstract: This paper describes the use of cellular automata paired with a generative neural network architecture for anomaly-based intrusion detection. The benchmark dataset ADFA-LD consisting of attack and benign Linux system-call traces was used to evaluate this method. Our results show that there was no improvement in the performance of this method compared to past research on this dataset.

• Basically we generate CA patterns for syscall sequences and use Generative NN to differentiate between normal and abnormal samples training them on CA patterns (which are just images)
• We do this with the assumption that there will be unique patterns for attack sequences
• This assumption did hold, however the results showed no significant improvement over past research, and there other downsides to using this method (space, resources, etc..)

js-mal-catcher

Detection of Malicious Javascript, Term paper for course "Machine Learning for Applications in Cybersecurity"

Abstract:Malicious JavaScript detection is vital to ensure a safe internet browsing experience. Obfuscation techniques have evolved in benign and malicious scripts in recent years, hindering detection efforts. We propose and evaluate a two-tier architecture that incorporates BERT embeddings in a Bi-LSTM neural network using features extracted from bytecode instructions that deem obfuscation irrelevant. While our method did not beat the baseline in all metrics, it scored a 98% f1 score without pretraining an embedding model, making it a viable solution when pretraining on a custom corpus is not feasible. Index Terms—machine learning, obfuscation, cybersecurity

• This was a fun but challenging course, I learned alot
• I did mostly the preprocessing and data collection steps
• We generated byecode instructions, and collected API call traces by overwriting built-in functions using v8 and puppeteer
• With these methods we were able to observe the functionality of the script, without performing deobfuscation, and both would highlgiht patterns of calls that may consistent with malicious javascript.

fishtrace

Event tracing and introspection for Linux using libebpf

Written in golang, using grpc for event forwarding and mongodb for storage. Uses sockets and buffered queue to merge data streams from multiple sources. Used as a base model for other projects.

As shown below a 3-d force graph was used to visualize the relationships between processes, and between applications and files, resulting in a some interesting visuals. Nodes are scaled by number of syscalls they make. Different colors correspond to different types of objects (parent, child, file, etc.)

The most dense clusters are Firefox processes

AI Predator-Prey

A simple predator-prey simulation with Q-Learning and Deep Q-Learning.

In the single-agent environment, we have prey and food. The goal of the prey is to eat the food:

In the multi-agent environment, we have prey (green), predator (blue), and food (red). Below shows predators chasing prey:

GIS: Fossil Clustering

For a course in GIS, a rather trivial but well put together project.

An analysis of the clustering of Canadian Fossil Data

Started: Oct 2020, Finished: Dec 2020 Used: dash, numpy, geopandas

Implemeneted and analysed the following algorithms: Graham Scan, k-means, CLARANS, BIRCH, Agglomerative Hierarchical Clustering: Average, and Minimum Linkages, and DBScan

Honors Project: ebph testsuite

• ebpH TestSuite and Automation Server Done for my Honors Project, Fall 2020.
• Will provide a more detailed description at a later date.
• Involved repeatedly training and testing the ebpH Intrusion Detection System. Learned alot of valuable skills, the most important being how to approach defensive security from an offensive perspective. It was a very interesting project, the ebpH IDS is pretty neat. I also wrote a jenkins-like application for scheduling and logging. Below are some snapshots:

Magneto: Anomaly Detection in Electromagnetic Data

From the Space Apps Hackathon in 2019. We were national finalists.

We were given electromagnetic data from weather stations around Canada and tasked with finding anomalies, as well as displaying the data, and predicting the values at a new station.

We used the correlation between the values at the different stations to identify anomalies.