Internship Programmes

File Profiling

Discipline: Computer Engineering / Computer Science / Electrical Engineering preferred

Project Description:
Background.  The current generation of anti-virus products and network intrusion detection systems that relies on signatures is ill-suited for detecting zero-day attacks and polymorphic worms with obfuscated exploit code. Detecting these types of malicious software is even harder when they are embedded within other file types, e.g. Microsoft Office documents, Portable Document Format (PDF) files. N-gram analysis is one of the methods to profile the contents of a file or file type. An n-gram is an n-length byte sequence and it can be a useful feature in both content-based anomaly and misuse detection in files.

Objectives.  The researcher shall build on existing tools to construct accurate content models and to test the robustness of these models against real-world files. The ultimate goal of this project is to build a content-based anomaly and misuse detector.

What the student is expected to gain

1) Knowledge of security concepts, e.g. anomaly and misuse detection, that would be useful for work in the IT security industry
2) Programming experience that would be useful in the software engineering and related industries
3) Deserving candidates who successfully demonstrate the concepts / prototype would be funded to attend a relevant overseas/local conference

Pre-requisite:
Strong independent thinking and initiative
Familiarity with C/C++ and the PERL scripting language