Course Description Format

 

TITLE                     : Research in Information Security

Course Code           : CSE540

CREDITS                  : 4

TYPE-WHEN           :

FACULTY NAME   : Sanjay Rawat

 

PRE-REQUISITE    : programming languages (C/C++, Python), operating systems, compilers, introduction to security.

OBJECTIVE             : This course is intended to introduce students the exciting world of information security research. The main focus of this course would be on non-cryptographic security research i.e. topics related to software vulnerabilities, malware, intrusion detection/prevention systems. The renowned Cryptographer Dr. Bruce Schneier once said that “.. security is a chain and is as strong as its weakest link. Cryptography is already a string link, problem lies somewhere else- in networks and software ….” Following the aforementioned suggestion, the course is designed to introduce software security issues and state-of-the-art in techniques to address those issues. At the end of the course, the students should:

  1. understand the various issues in software security;
  2. understand the techniques that are applied in order to address security issues;
  3. understand the majority of the attacks that hamper the security of the networks, e.g. bug exploitation (aka hacking);
  4. learn basics of malware analysis and defensive techniques;
  5. learn basics of program analysis (static and dynamic program analysis) that are applied to analyze software for vulnerability detection;
  6. get familiar with the state-of-the-art in security research to lay foundation for their advance research. 

 

COURSE TOPICS  :          

            The entire course is divided into 3 modules:

A.   Software vulnerability Analysis:

  1. Non-web software vulnerabilities (low level bug, e.g., buffer overflow, use-after-free etc.)
  2. Binary code analysis
  3. Static program analysis
  4. Dynamic program analysis (fuzzing)
  5. Application of SAT/SMT solvers for security
  6. Application of evolutionary computing/ machine learning for security program analysis
  7. Web specific vulnerabilities and their analysis (e.g. XSS, CSRF, SQLinjection etc.)

 

B.   Malware Analysis:

  1. Introduction to reverse engineering (x86 code only)
  2. Obfuscation techniques
  3. Android malwares
  4. Biologically inspired approaches to malware detection

 

C.   Intrusion Detection System:

  1. Machine learning approaches for IDS/IPS
  2. Autonomic security
  3. Critical infrastructure security approaches.

PREFERRED TEXT BOOKS:

The course is mainly based on research articles and notes given by the instructor.

 

*REFERENCE BOOKS:

 

*PROJECT: Student can choose some topic that can be extended to major project for the master degree or advance research. However, if student choose to work on the project during the course, they can do. So, this is optional.

GRADING:

20%: Mini Project
15%: In-class paper presentation
15%: Hands-on assignments (2)

15%: mid term
35%: End exam

 

OUTCOME:

The students will be well aware of state-of-the-art in non-cryptographic security issues and their proposed solutions. The student will also get to know about the opportunities that exist in the research space. Some of the topics are very practical from industry point of view, especially when it comes to proactive approach to security i.e. security during development process.

 

REMARKS:

The course is highly flexible in its contents and approach. Based on the student’s participation and interest, the course may progress in a particular direction.