DNS tunneling is a technique by which a covert communication can be realized bypassing firewalls or other network packet filters. This is achieved by encoding the information in DNS queries and responses, the permeability of which through network filters is essential for the internet functionality. The goal of this thesis is to develop and implement a novel DNS tunnel that incompasses new encoding strategies to potentially achieve higher traffic volume and lower detectablilty compared to existing implementations. It should be explored, which DNS protocol features are viable for use and evaluated, how they comparatively perform compared to existing solutions.

Students interested in this topic are ideally expected to be knowledgable about networks and internet protocols, have prior experience in programming with Python and are proficient in working with Linux to the extend of setting up containerized applications, network configurations, and firewalls.

The Internet is a massive, complex system held together by a protocol from the 1990s called BGP (Border Gateway Protocol). The problem? BGP was built on trust, and that trust is now a critical vulnerability. Every day, BGP hijacks and route leaks redirect massive amounts of traffic, causing major outages, enabling cryptocurrency theft, and facilitating state-level espionage. We are looking for motivated students to join our cutting-edge research on routing security and RPKI. We have a variety of topics that range from the hunting down new vulnerabilities and attack vectors, to large-scale internet security evaluations, and secure protocol design.

Fuzzing is a technology for automizing the analysis of implementation against errors, bugs, and vulnerabilities. Modern fuzzing techniques have greatly accellerated the hardening of parsers and protocol implementations in particular. In our research group, we develop, utilize and innovate on fuzzing frameworks for Internet cryptographic protocols.

We are looking for motivated students to research, develop and integrate components that form part of our fuzzing frameworks. Topics may range from in-depth mutation strategies, integration of oracle techniques to solving complexity and scaling. Our main development languages are Rust and Python, so students are expected to have familiarity with or invovled interest in learning these languages. Moreover, students should be comfortable with working in Linux, navigating build and virtualization processes, and thoroughly documentating their work. Please get in touch for more details.

Denial-of-service (DoS) attacks aim to disable Internet infrastructure in a variety of ways. Distributed servers that independently or recursively request resources from the Internet are particularly vulnerable to abuse in distributed DoS (DDoS) attacks. The amplification factor of such systems is crucial: Can an attacker sending few messages trigger a large amount of traffic being sent to the victim? The goal of this thesis is to research, analyze, and evaluate mechanisms and attack vectors in Internet infrastructure that can be exploited for (D)DoS attacks.

Students interested in this topic should have background knowledge of distributed systems, Internet protocols, network components, and basic concepts of cybersecurity (or be willing to acquire this knowledge before starting the work). In addition, knowledge of C (possibly Python, Rust) and experience with Linux are required.

Both defending against and exploiting a software vulnerability draw on the same underlying understanding of its weakness. If this also holds true for large language models (LLMs), the consequence is clear: a model that is adept at defence is likely to be adept at attack, and guardrails merely conceal this tendency rather than eliminating it. However, this is difficult to measure directly because alignment and guardrails suppress offensive answers while leaving defensive ones largely untouched. Consequently, a naive comparison confuses capability with willingness to answer. This thesis measures both capabilities on the same vulnerabilities, once with guardrails active and once with refusal removed, and uses the difference as the quantity of interest. Both directions are scored by execution rather than wording, making them directly comparable. All work is carried out on open-weight models in an isolated environment, using only published datasets and jailbreak methods as measurement instruments.

Jailbreaking attacks are performed by providing specific inputs to a language model that leads to it providing outputs that are unsafe/unintended. With the advancement of Large Language Models (LLMs), they have also improved substantially in code completion and generation capabilities, and have become very prominent within the software development workflow, usually in the form of autocompletion/suggestion or vibe coding. However, code projects provide a greater number of exploitable vectors to perform jailbreaking attacks, e.g. variable names, file names, functions, comments, enabling evasion of current filtration methods used by LLMs to prevent them. The goal of this thesis is to develop a mitigation strategy to help prevent jailbreaking attacks within the code project setting

Deep agent systems use a hierarchy of agents, where a high-level agent assigns tasks to lower-level agents. This thesis focuses on two closely related parts of such systems: how prompts are assigned to lower-level agents, and how the agents are organised and work together within the overall system. The prompting strategy can influence the behaviour of individual agents as well as the performance of the full multi-agent system. At the same time, the way in which agents are connected, tasks are delegated, and results are passed back to higher-level agents may also affect the final result. The thesis will investigate these aspects in cybersecurity applications.

The internet is comprised of over a million networks, all of whom are owned by different entities and host a variety of services. The process of extracting information about these prefixes is difficult and complicated, especially in bulk. Any internet user can extract a subset of information on a per network basis by querying different online sources. However, most sources have incomplete, sometimes outdated information, and generating a correct network profile requires querying and parsing data from multiple sources with different formats, and extracting and processing information based on semantic context.

In this thesis, we want to bring order to the chaos. The aim is to develop an LLM-powered agent that collects, extracts and categorizes prefix information from multiple sources to create a dataset of internet prefix information. Students interested in this topic must have very good programming skills (any language), and either existing experience or very strong interest in learning how to use, train and refine LLMs. This topic requires familiarity or willingness to learn how to build RAG pipelines.

Much like our universe, the Internet is plagued by Background Radiation (IBR): millions of unsolicited packets sent daily to IPs and ports that were not prepared to receive them. The nature of these packets can be either benign (erroneously sent, service/scanner misconfigurations) or malicious (worms, DDoS backscatter, vulnerability scanners). Regardless of the nature of these packets, internet traffic pollution tells a story about the underbelly of the Internet: the orphaned misconfigured servers, the malware knocking on doors to find itself a new home, infected hosts (bots) scanning the internet for new peers, etc.

The purpose of this thesis is to analyze historical and recent data on background radiation, evaluate the IBR traffic, profile the sources and purpose of this traffic, and propose mitigation techniques. Students interested in this topic must have good programming skills in a language of their choice and familiarity with networking protocols.

DNS tunneling is a technique by which a covert communication can be realized bypassing firewalls or other network packet filters. This is achieved by encoding the information in DNS queries and responses, the permeability of which through network filters is essential for the internet functionality. The goal of this thesis is to develop and implement a novel DNS tunnel that incompasses new encoding strategies to potentially achieve higher traffic volume and lower detectablilty compared to existing implementations. Research should measure the current state of the DNS architecture and quantify the practicability of novel approaches.

Students interested in this topic are ideally expected to be knowledgable about networks and internet protocols, have prior experience in programming with Python and are proficient in working with Linux to the extend of setting up containerized applications, network configurations, and firewalls.