Ideas for Final Year Project

MajesticDonkey · 14-04-2014 1:58pm #1

I posted this already in the Info Sec forum but didn't get too many responses, so I thought I'd post it here as well - this time more focused on development as opposed to security.

Does anyone have any thoughts on something I could do for my FYP?

Here's my OP in the other post:

Hi lads,

Just wondering what ideas ye might have for a Final Year Project for a UL Mobile Communications and Security (essentially Computer Science with a bit of electronics and more security) student...

Have any of you done your projects on something security-based in the past?

My strong points skill-wise would be Linux, Java, JavaEE+PostgreSQL, web-based stuff (PHP+MySQL) and Android development. Apart from those I have knowledge of cryptography (encryption, authentication, integrity, non-repudiation, hashing, key-management etc.), a bit of C, a small bit of Assembly and de-compilation, and some digital electronics.

Thanks for any help.

I've to have an idea submitted and signed off by Friday-week, the 25th.

All cool and completely unrealistic ideas also accepted.

Thanks.

everdead.ie · 14-04-2014 2:32pm

Given all the prism who ha you could look at encrypting data(serializable objects) between websites and databases so nobody can snoop your info.

It would be a bit fashionable and something actually nice to put on your CV.

MajesticDonkey · 14-04-2014 2:41pm

everdead.ie wrote: »

Given all the prism who ha you could look at encrypting data(serializable objects) between websites and databases so nobody can snoop your info.

It would be a bit fashionable and something actually nice to put on your CV.

Isn't this essentially SSL, TLS etc?

draiochtanois · 14-04-2014 2:53pm

This post has been deleted.

MajesticDonkey · 14-04-2014 3:01pm

draiochtanois wrote: »

This post has been deleted.

I was thinking that

I don't really want to reinvent the wheel either (within reason), so I think anything to do with web traffic encryption has been done and done again. With thousands of experts around the world putting millions of hours of work into R&D in this area, I think this is a non-runner.

draiochtanois · 14-04-2014 3:06pm

This post has been deleted.

MajesticDonkey · 14-04-2014 3:13pm

draiochtanois wrote: »

This post has been deleted.

Maybe expand on this a bit?

What do you mean by "replicated one"?

draiochtanois · 14-04-2014 3:18pm

This post has been deleted.

CreepingDeath · 14-04-2014 3:26pm

Meh, passwords are so yesterday !

Steve Gibson from the long running "Security Now" podcast is in the process of designing a new system for authentication, SQRL.

It's work in progress, but all open source/free.
Not sure if they've an Android client for it yet, or even a test server you can use/install for yourself.

MajesticDonkey · 14-04-2014 3:33pm

draiochtanois wrote: »

This post has been deleted.

Ah, that makes sense now

That's not a bad idea. There's an app called Keeper which does exactly this - not that I mind the fact that it exists already - but it's 20 quid per year for the service. I'd probably be interested in going open source if anything.

CreepingDeath wrote: »

Meh, passwords are so yesterday !

Steve Gibson from the long running "Security Now" podcast is in the process of designing a new system for authentication, SQRL.

It's work in progress, but all open source/free.
Not sure if they've an Android client for it yet, or even a test server you can use/install for yourself.

That's quite interesting. Must look into it a bit more and how it could be expanded to other areas.

rwg · 14-04-2014 7:26pm

MajesticDonkey wrote: »

Ah, that makes sense now

That's not a bad idea. There's an app called Keeper which does exactly this - not that I mind the fact that it exists already - but it's 20 quid per year for the service. I'd probably be interested in going open source if anything.

That's quite interesting. Must look into it a bit more and how it could be expanded to other areas.

most likely to be 20 quid because it requires storage space and security - both cost

MajesticDonkey · 14-04-2014 10:19pm

rwg wrote: »

most likely to be 20 quid because it requires storage space and security - both cost

Yes I'm aware of that. I'm not giving out about the price, it's just an observation.

MajesticDonkey · 16-04-2014 12:04pm

So does anyone else have any ideas they'd like to share?

fergalr · 16-04-2014 7:23pm

MajesticDonkey wrote: »

So does anyone else have any ideas they'd like to share?

I think that one of the biggest opportunities in the world is a private social network / communications platform. Like whatsapp/facebook etc, but where you don't need to trust the infrastructure, and where its resistant to metadata analysis. (which is non-trivial, btw).

If I was in your position, that's what I'd work on, I think.

I've actually considered paying someone (e.g. on elance etc) to work on prototypes in this area, and have been tossing around ideas in this area for several years. However, recently, I think there's now a realisation that this is something people are going to want, so there's now lots of teams working on variants of this sort of thing.

If I were you, I'd probably throw my hat into that ring. You could probably get an android prototype out over a FYP, if you were good.

Edit: btw, do you own what you develop? That's got to be a consideration if you are trying to choose between doing what will best satisfy a project spec, vs. if you are going to really put your heart into a project.

Colonel Panic · 17-04-2014 1:04am

I think the concept of sandboxing processes is quite interesting. Both on an OS level basis and the IPC based security model you see in Chrome.

There's also the Akamai fix to OpenSSL which I think is worth looking at. mmap to partition off a chunk of memory with any requests outside it resulting in a segfault.

MajesticDonkey · 17-04-2014 9:25am

fergalr wrote: »

I think that one of the biggest opportunities in the world is a private social network / communications platform. Like whatsapp/facebook etc, but where you don't need to trust the infrastructure, and where its resistant to metadata analysis. (which is non-trivial, btw).

If I was in your position, that's what I'd work on, I think.

I've actually considered paying someone (e.g. on elance etc) to work on prototypes in this area, and have been tossing around ideas in this area for several years. However, recently, I think there's now a realisation that this is something people are going to want, so there's now lots of teams working on variants of this sort of thing.

If I were you, I'd probably throw my hat into that ring. You could probably get an android prototype out over a FYP, if you were good.

Edit: btw, do you own what you develop? That's got to be a consideration if you are trying to choose between doing what will best satisfy a project spec, vs. if you are going to really put your heart into a project.

Thanks for that. This sounds interesting. Could you expand a bit on what you feel the social platform should be able to do? Is it basically a Facebook for intranet type thing?

EDIT: yes, I believe you own what you develop. I don't think anybody could say otherwise to be fair.

Colonel Panic wrote: »

I think the concept of sandboxing processes is quite interesting. Both on an OS level basis and the IPC based security model you see in Chrome.

This is also interesting. Do you mean similar to the Sanboxie program?

Sparks · 17-04-2014 1:01pm

You could always run some proper static analysis on OpenSSL - might be a bit dry, but you'd be left with a relevant and useful bit of work to point people at. You might even find something...

MajesticDonkey · 17-04-2014 2:00pm

Sparks wrote: »

You could always run some proper static analysis on OpenSSL - might be a bit dry, but you'd be left with a relevant and useful bit of work to point people at. You might even find something...

How would one go about this? Can you point me to some links to get started? Thanks

Sparks · 17-04-2014 2:07pm

MajesticDonkey wrote: »

How would one go about this? Can you point me to some links to get started? Thanks

I'd start by running it through every static analysis tool I could get a copy of that could grok C/C++ code (start with the wikipedia list and work your way onwards - lint and blast are what I've used in the past, but try everything). Then I'd run the code through builds with any compiler that could build the project, with every warning option turned on.
That should give you a list of all potential problems in the code, and then the work starts

You'd have to go through each suggestion, evaluate it (happily most of the time the evaluation is "false positive"), and then tabulate the "real" problems and then you could start suggesting solutions for those, especially if they're small easy fixes.

After that, if you've not torn out all of your hair, you could start feeding it to valgrind and other tools looking for memory leaks and that sort of thing; but I'd imagine the static analysis would give you more than enough for an FYP.

MajesticDonkey · 17-04-2014 2:35pm

One thing I just realised though...the Heartbleed bug was not found using static analysis because it was caused from an external variable. What do you think?

Sparks · 17-04-2014 2:42pm

MajesticDonkey wrote: »

One thing I just realised though...the Heartbleed bug was not found using static analysis because it was caused from an external variable. What do you think?

Good static analysis would have found the iOS bug, so it's worth doing anyway. Whether or not a static analyser would catch a code pattern that could cause a buffer overrun in every case, I don't know (though I doubt it), but it should flag the worst examples readily and should give warnings of cases where a buffer overrun *might* occur (which you then have to manually evaluate) -- I've seen pclint do that before.

Colonel Panic · 17-04-2014 4:30pm

Eric Lippert posted a blog article about Heartbleed and static analysis a couple of days ago that might interest you

http://ericlippert.com/2014/04/15/heartbleed-and-static-analysis/

Sparks · 17-04-2014 4:39pm

Good read, that.

MajesticDonkey · 17-04-2014 4:42pm

Colonel Panic wrote: »

Eric Lippert posted a blog article about Heartbleed and static analysis a couple of days ago that might interest you

http://ericlippert.com/2014/04/15/heartbleed-and-static-analysis/

Interesting read, thanks.

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

I'm going to post the supplied project specs here. Projects are allocated in order of preference, with people with higher grades getting first preference.

Image Recognition APIs
Image recognition methods are now available for developers from a host of vendors. This project will involve a comprehensive review of the available services and APIs that are currently offered across different platforms. Products will be assessed in terms of cost, ease of use, capabilities, scalability, etc. In addition, the use of a sample set of web APIs will be deployed, so as to demonstrate this technology and access it’s capabilities. Skills and knowledge required (but not limited to): Web & app development and programming.

Geospatial analysis of landmine clearance actions using Google Earth
In this project, a geospatial analysis of landmine clearance actions around the world will be undertaken using Google Earth as the visualisation tool. Here, information on landmine locations around the world in past and current conflict areas will be identified, along with actions (government and non-government) undertaken in landmine clearance will be identified and visualised. Google Earth, with a suitable database, will be used to allow a user to identify and see particular regions around the world where problems have been identified and corrective actions are undertaken. The work will be aimed to provide a suitable web based education tool for students to learn more about this aspect of global conflict. Hence, a range of suitable visualisation tools will be investigated to allow for an interactive and informative tool to be created.

Implementation of the CE4717 Stack-Based Microprocessor using an FPGA
The CE4717 Language Processors module defines a stack-based virtual machine similar to the Java VM as a target for the module’s project compiler. This machine currently only exists as a software simulation. In this project this software simulation will be implemented in hardware, as a soft microprocessor core (similar to Xilinx’s MicroBlaze) implemented on an FPGA. Areas of interest include how the virtual machine specification is to be reified into one suitable for hardware implementation (extra instructions needed to make hardware as opposed to a simulation, word size, instruction format), and possible implementation approaches (sequence controller, pipeline, etc.)
Suitable for students with an interest in microprocessor design, FPGAs and hardware description languages such as VHDL and Verilog.

PriWhisper, Acoustic Near-Field Communication for Smartphones
The recently reported PriWhisper project (see IEEE Internet of Things Journal) has proposed a novel way of implementing near-field communications for smartphones using acoustic (audio frequency) messaging. The clever part is that the acoustic modem is implemented completely in software on a smartphone. This project will implement such a soft modem for an android smartphone and will investigate the feasibility of the technique as a way to implement secure near-field communications for applications such as the exchange of credit-card information (or similar payment data, such as Google Wallet).
Of interest to students with a strong DSP and programming background. An Android smartphone or tablet is required.

A web based car engine ECU simulator
In automotive electronics an embedded computer manages the control of the engine. This device is an ECU (engine control unit). The ECU emits various messages so that the real-time performance operation of the engine can be monitored. While the car is being driven the speed, engine rpm, etc. can be monitored. Also the state of the various sensors, such as temperatures, pressure, oxygen level etc. can be monitored. The ECU messages can be monitored by connecting equipment to the diagnostic port on a car (the OBD II port) so that the sensors can be monitored. However, for developing such diagnostic equipment it is inconvenient to attach to a real car engine, so ECU hardware simulators are often used in place of the real engine. There have been some development efforts towards the realisation of software-based ECU simulators. This project proposes the development of such a software based ECU simulator. Further, the feasibility of hosting such a simulator on the web will be explored to ass
ess delay and response times etc. This project can be developed entirely on a PC without external hardware dependencies. The choice of operating system and programming language etc. can be decided later on, in discussion with the student.

Intel Galileo Controlled Toy Car
Interest in remote controlled vehicles is very high at the moment. This project uses an Intel Galileo module to control a toy car. The Car should be able to follow a line or navigate towards a light source, and should be autonomous. The project involves identifying a suitable car and interfacing it to the Galileo, as well as designing the sensor interface and developing the necessary software.

Investigation of BitCoin Server Architecture
BitCoin is an open source peer-to-peer payment system, effectively “ digital currency”
It uses a Virtual Private Cloud architecture it uses Network Layer (Firewall) and Transport Layer Security (SSL/TLS),fundamental to operation is the concept of Hot and Cold wallet servers.
Hot wallet servers are used to send/receive Bitcoin very quickly. The negative aspect of this is in the event that your hot wallet server is compromised, there is a high chance that you may lose all Bitcoin stored on this server.
Cold wallet servers are Bitcoins that are kept in cold storage. Examples of a cold wallet are USB drives, servers disconnected from the internet, brain wallets, and paper wallets. The cold wallet should only be accessible physically by an administrator. This project proposes an in-depth study of the technical/networking issues affecting BitCoin.

Wireless Analyser/Sniffer APP for Android
Wireless sniffer tools have many uses in commercial IT environments. Their ability to monitor, intercept, and decode data as it is in transit makes them useful for:
· Diagnosing and investigating network problems
· Monitoring network usage, activity, and security
· Filtering network traffic
The project requires a wireless packet sniffer APP to be developed for the Android platform to provide the services above – WiCAP, WiFinspect Apps are a good example.

Smart device using a Raspberry PI
Using the PI as the “web to device” interface with a Wireless or wired broadband connection the aim of this project is to turn a standard home entertainment device into a smart web enabled device. The PI is also to be used to provide a data download indicator (Actual Bits downloaded) on the device.

Obviously there are more than that available for choice, but those are the ones I'm most interested in.

Sparks · 17-04-2014 4:52pm

MajesticDonkey wrote: »

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

That's not as hard a problem as you'd think. It's like the PhD thesis selection problem - everyone thinks that the requirement to be novel means it has to be this great stonkin' revolutionary thing, but all it actually means is a small but solid incremental addition to the knowledgebase (seriously, ask anyone who's done one and in the STEM fields at least, they can give you a single number that was the novel thing their thesis added - and there's not much that's more surreal than seven years of someone's life being summed up by "2.2301"

). Same idea here - you do a proper audit of something that's not been audited yet (and openSSL's just the example in the news, you could pick almost any chunk of open source infrastructural code really) and you've created a new piece of work that has value and might even be publishable depending on what you found. It probably won't be very cool - but there's cool and there's worth doing and odds are quite high it'd be the latter. The latter always impressed me more, especially if the student thought of it themselves rather than picking it off a list.

I'm going to post the supplied project specs here. Projects are allocated in order of preference, with people with higher grades getting first preference.

Honestly, half of those (especially the bitcoin, android sniffer and raspberry Pi ones because they've been in the news so recently between MTG, the ACM article on taintdroid and the UCD Pi event) stink to high heaven of lecturers vying for FYP supervision numbers for quotas by making up the coolest-sounding projects they could think of inside of ten minutes. You'd be surprised how much that happens

Obviously there are more than that available for choice, but those are the ones I'm most interested in.[/QUOTE]

fergalr · 17-04-2014 7:12pm

MajesticDonkey wrote: »

Interesting read, thanks.

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

That is very wise of you.

Be careful to not take on an impossible project, that your supervisor doesn't know is an impossible project.

Often, from an academic point of view, FYP student time is completely free. FYP students are disposable and expendable.

The OpenSSL static analysis project that Sparks suggested is an extremely valid and worthwhile project.

However, I would be wary about taking it on as FYP, if I was in your position. (Not saying don't do it, but just be wary.)

- If you find another heartbleed bug, you'll win fame, and a great career in security research; but probably for your project supervisor.

- But if you find nothing (which is more likely - OpenSSL is one of the biggest threat surfaces in the world, finding bugs in it makes careers, so plenty of other people will probably have done all the low hanging fruit of static analysis on it before*.) If you find nothing, then you have nothing to show for your time. You'll be doing your final year project write up, and in your demo, and you won't have a nice app to show. You will have negative results. Negative results are extremely important and valuable, but totally undervalued. Partly because you can't tell them apart from someone that just did a bad job. So your life will be hard. Unless you find a very enlightened supervisor.

* (with the general exception, that when you assume that of course this thing is so obvious and so important that someone will have done it before - invariably no one has, (this is because everything is broken and nothing works, which is an important related issue.))

I'd also like to say:

Please read the second part of Sparks' post above mine again. Its very important. Normally, no one will tell you this, but Sparks has, so please read it twice.

Also, check if proposer has research experience in the area they are proposing a project in; also try talk to previous students of them on the quiet.

MajesticDonkey · 17-04-2014 8:59pm

Great, thanks lads.

awec · 17-04-2014 10:49pm

Are you more interested in doing a research type project or actually building something?

My only advice is this:

1. Don't bite off more than you can chew. Aim high but be realistic - do you want to spend every spare hour of the next year on it just to get it finished?
2. Don't do something that you aren't very interested in. You need to maintain enthusiasm for the entire year.

Remember that while it's all about getting a decent result you'll also likely be asked about it during your first graduate job interviews.

Research type stuff didn't interest me, it's too mundane and too boring for me so I built something instead.

Check with your college - sometimes they will have company-sponsored projects and you might find one that you find interesting. These are very good for setting you up for a job.

MajesticDonkey · 18-04-2014 10:44am

awec wrote: »

Are you more interested in doing a research type project or actually building something?

I think I'd prefer something practical as opposed to research, but I don't mind too much because I'm pretty OK at writing long spiels about how something works.

awec wrote: »

My only advice is this:

1. Don't bite off more than you can chew. Aim high but be realistic - do you want to spend every spare hour of the next year on it just to get it finished?
2. Don't do something that you aren't very interested in. You need to maintain enthusiasm for the entire year.

Remember that while it's all about getting a decent result you'll also likely be asked about it during your first graduate job interviews.

Research type stuff didn't interest me, it's too mundane and too boring for me so I built something instead.

Check with your college - sometimes they will have company-sponsored projects and you might find one that you find interesting. These are very good for setting you up for a job.

Thanks for the advice.

MajesticDonkey · 22-04-2014 10:28am

So I've decided to extend this:

Image Recognition APIs
Image recognition methods are now available for developers from a host of vendors. This project will involve a comprehensive review of the available services and APIs that are currently offered across different platforms. Products will be assessed in terms of cost, ease of use, capabilities, scalability, etc. In addition, the use of a sample set of web APIs will be deployed, so as to demonstrate this technology and access it’s capabilities. Skills and knowledge required (but not limited to): Web & app development and programming.

...to actually create an Image Recognition API (web-based) from scratch. I have some nice ideas for this, and it's really where my "area of expertise" is at the moment - web-based Java stuff. I may use Spring for the core of the API - some nice stuff in there for RESTful services, authentication and so on. Will probably use some sort of OAuth for access-token based access. To demonstrate it I'll probably create some sort of Android app.

Anyone have ideas that might be a nice addition to this?

CreepingDeath · 22-04-2014 4:46pm

MajesticDonkey wrote: »

...to actually create an Image Recognition API (web-based) from scratch.

Have you any experience with graphics and in particular Image Recognition ?
Artificial Intelligence / Image processing is a big area laden with a lot of math.

Even the term "image recognition" would need to be scoped as artificial intelligence in graphics is extremely fragmented with different algorithms for very specific processing tasks, eg. texture recognition, image segmentation, line detection, shape recognition, blob detection etc.

Does "image recognition" mean matching one image with another, or a subset of another, Eg. in the same way that Street View in Google maps can match photos, taken by users from different perspectives, of the same landmark. ( tricky )

Most image recognition APIs are written in C/C++ for processing speed, so some will not have a good Java interface.

Update.... actually, I see that task is to review them all, not necessarily to produce a working end product, just rip-off a few demo/examples of theirs.

Ideas for Final Year Project

Comments