Ideas for Final Year Project

MajesticDonkey

I posted this already in the Info Sec forum but didn't get too many responses, so I thought I'd post it here as well - this time more focused on development as opposed to security.

Does anyone have any thoughts on something I could do for my FYP?

Here's my OP in the other post:

Hi lads,

Just wondering what ideas ye might have for a Final Year Project for a UL Mobile Communications and Security (essentially Computer Science with a bit of electronics and more security) student...

Have any of you done your projects on something security-based in the past?

My strong points skill-wise would be Linux, Java, JavaEE+PostgreSQL, web-based stuff (PHP+MySQL) and Android development. Apart from those I have knowledge of cryptography (encryption, authentication, integrity, non-repudiation, hashing, key-management etc.), a bit of C, a small bit of Assembly and de-compilation, and some digital electronics.

Thanks for any help.

I've to have an idea submitted and signed off by Friday-week, the 25th.

All cool and completely unrealistic ideas also accepted.

Thanks.

everdead.ie

Given all the prism who ha you could look at encrypting data(serializable objects) between websites and databases so nobody can snoop your info.

It would be a bit fashionable and something actually nice to put on your CV.

MajesticDonkey

everdead.ie wrote: »

Given all the prism who ha you could look at encrypting data(serializable objects) between websites and databases so nobody can snoop your info.

It would be a bit fashionable and something actually nice to put on your CV.

Isn't this essentially SSL, TLS etc?

draiochtanois

This post has been deleted.

MajesticDonkey

draiochtanois wrote: »

This post has been deleted.

I was thinking that

I don't really want to reinvent the wheel either (within reason), so I think anything to do with web traffic encryption has been done and done again. With thousands of experts around the world putting millions of hours of work into R&D in this area, I think this is a non-runner.

draiochtanois

This post has been deleted.

MajesticDonkey

draiochtanois wrote: »

This post has been deleted.

Maybe expand on this a bit?

What do you mean by "replicated one"?

draiochtanois

This post has been deleted.

CreepingDeath

Meh, passwords are so yesterday !

Steve Gibson from the long running "Security Now" podcast is in the process of designing a new system for authentication, SQRL.

It's work in progress, but all open source/free.
Not sure if they've an Android client for it yet, or even a test server you can use/install for yourself.

MajesticDonkey

draiochtanois wrote: »

This post has been deleted.

Ah, that makes sense now

That's not a bad idea. There's an app called Keeper which does exactly this - not that I mind the fact that it exists already - but it's 20 quid per year for the service. I'd probably be interested in going open source if anything.

CreepingDeath wrote: »

Meh, passwords are so yesterday !

Steve Gibson from the long running "Security Now" podcast is in the process of designing a new system for authentication, SQRL.

It's work in progress, but all open source/free.
Not sure if they've an Android client for it yet, or even a test server you can use/install for yourself.

That's quite interesting. Must look into it a bit more and how it could be expanded to other areas.

rwg

MajesticDonkey wrote: »

Ah, that makes sense now

That's not a bad idea. There's an app called Keeper which does exactly this - not that I mind the fact that it exists already - but it's 20 quid per year for the service. I'd probably be interested in going open source if anything.



That's quite interesting. Must look into it a bit more and how it could be expanded to other areas.

most likely to be 20 quid because it requires storage space and security - both cost

MajesticDonkey

rwg wrote: »

most likely to be 20 quid because it requires storage space and security - both cost

Yes I'm aware of that. I'm not giving out about the price, it's just an observation.

MajesticDonkey

So does anyone else have any ideas they'd like to share?

fergalr

MajesticDonkey wrote: »

So does anyone else have any ideas they'd like to share?

I think that one of the biggest opportunities in the world is a private social network / communications platform. Like whatsapp/facebook etc, but where you don't need to trust the infrastructure, and where its resistant to metadata analysis. (which is non-trivial, btw).

If I was in your position, that's what I'd work on, I think.

I've actually considered paying someone (e.g. on elance etc) to work on prototypes in this area, and have been tossing around ideas in this area for several years. However, recently, I think there's now a realisation that this is something people are going to want, so there's now lots of teams working on variants of this sort of thing.

If I were you, I'd probably throw my hat into that ring. You could probably get an android prototype out over a FYP, if you were good.

Edit: btw, do you own what you develop? That's got to be a consideration if you are trying to choose between doing what will best satisfy a project spec, vs. if you are going to really put your heart into a project.

Colonel Panic

I think the concept of sandboxing processes is quite interesting. Both on an OS level basis and the IPC based security model you see in Chrome.

There's also the Akamai fix to OpenSSL which I think is worth looking at. mmap to partition off a chunk of memory with any requests outside it resulting in a segfault.

MajesticDonkey

fergalr wrote: »

I think that one of the biggest opportunities in the world is a private social network / communications platform. Like whatsapp/facebook etc, but where you don't need to trust the infrastructure, and where its resistant to metadata analysis. (which is non-trivial, btw).

If I was in your position, that's what I'd work on, I think.

I've actually considered paying someone (e.g. on elance etc) to work on prototypes in this area, and have been tossing around ideas in this area for several years. However, recently, I think there's now a realisation that this is something people are going to want, so there's now lots of teams working on variants of this sort of thing.

If I were you, I'd probably throw my hat into that ring. You could probably get an android prototype out over a FYP, if you were good.

Edit: btw, do you own what you develop? That's got to be a consideration if you are trying to choose between doing what will best satisfy a project spec, vs. if you are going to really put your heart into a project.

Thanks for that. This sounds interesting. Could you expand a bit on what you feel the social platform should be able to do? Is it basically a Facebook for intranet type thing?

EDIT: yes, I believe you own what you develop. I don't think anybody could say otherwise to be fair.

Colonel Panic wrote: »

I think the concept of sandboxing processes is quite interesting. Both on an OS level basis and the IPC based security model you see in Chrome.

This is also interesting. Do you mean similar to the Sanboxie program?

Sparks

You could always run some proper static analysis on OpenSSL - might be a bit dry, but you'd be left with a relevant and useful bit of work to point people at. You might even find something...

MajesticDonkey

Sparks wrote: »

You could always run some proper static analysis on OpenSSL - might be a bit dry, but you'd be left with a relevant and useful bit of work to point people at. You might even find something...

How would one go about this? Can you point me to some links to get started? Thanks

Sparks

MajesticDonkey wrote: »

How would one go about this? Can you point me to some links to get started? Thanks

I'd start by running it through every static analysis tool I could get a copy of that could grok C/C++ code (start with the wikipedia list and work your way onwards - lint and blast are what I've used in the past, but try everything). Then I'd run the code through builds with any compiler that could build the project, with every warning option turned on.
That should give you a list of all potential problems in the code, and then the work starts
You'd have to go through each suggestion, evaluate it (happily most of the time the evaluation is "false positive"), and then tabulate the "real" problems and then you could start suggesting solutions for those, especially if they're small easy fixes.

After that, if you've not torn out all of your hair, you could start feeding it to valgrind and other tools looking for memory leaks and that sort of thing; but I'd imagine the static analysis would give you more than enough for an FYP.

MajesticDonkey

One thing I just realised though...the Heartbleed bug was not found using static analysis because it was caused from an external variable. What do you think?

Sparks

MajesticDonkey wrote: »

One thing I just realised though...the Heartbleed bug was not found using static analysis because it was caused from an external variable. What do you think?

Good static analysis would have found the iOS bug, so it's worth doing anyway. Whether or not a static analyser would catch a code pattern that could cause a buffer overrun in every case, I don't know (though I doubt it), but it should flag the worst examples readily and should give warnings of cases where a buffer overrun *might* occur (which you then have to manually evaluate) -- I've seen pclint do that before.

Colonel Panic

Eric Lippert posted a blog article about Heartbleed and static analysis a couple of days ago that might interest you

http://ericlippert.com/2014/04/15/heartbleed-and-static-analysis/

Sparks

Good read, that.

MajesticDonkey

Colonel Panic wrote: »

Eric Lippert posted a blog article about Heartbleed and static analysis a couple of days ago that might interest you

http://ericlippert.com/2014/04/15/heartbleed-and-static-analysis/

Interesting read, thanks.

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

I'm going to post the supplied project specs here. Projects are allocated in order of preference, with people with higher grades getting first preference.

Image Recognition APIs
Image recognition methods are now available for developers from a host of vendors. This project will involve a comprehensive review of the available services and APIs that are currently offered across different platforms. Products will be assessed in terms of cost, ease of use, capabilities, scalability, etc. In addition, the use of a sample set of web APIs will be deployed, so as to demonstrate this technology and access it’s capabilities. Skills and knowledge required (but not limited to): Web & app development and programming.

Geospatial analysis of landmine clearance actions using Google Earth
In this project, a geospatial analysis of landmine clearance actions around the world will be undertaken using Google Earth as the visualisation tool. Here, information on landmine locations around the world in past and current conflict areas will be identified, along with actions (government and non-government) undertaken in landmine clearance will be identified and visualised. Google Earth, with a suitable database, will be used to allow a user to identify and see particular regions around the world where problems have been identified and corrective actions are undertaken. The work will be aimed to provide a suitable web based education tool for students to learn more about this aspect of global conflict. Hence, a range of suitable visualisation tools will be investigated to allow for an interactive and informative tool to be created.

Implementation of the CE4717 Stack-Based Microprocessor using an FPGA
The CE4717 Language Processors module defines a stack-based virtual machine similar to the Java VM as a target for the module’s project compiler. This machine currently only exists as a software simulation. In this project this software simulation will be implemented in hardware, as a soft microprocessor core (similar to Xilinx’s MicroBlaze) implemented on an FPGA. Areas of interest include how the virtual machine specification is to be reified into one suitable for hardware implementation (extra instructions needed to make hardware as opposed to a simulation, word size, instruction format), and possible implementation approaches (sequence controller, pipeline, etc.)
Suitable for students with an interest in microprocessor design, FPGAs and hardware description languages such as VHDL and Verilog.

PriWhisper, Acoustic Near-Field Communication for Smartphones
The recently reported PriWhisper project (see IEEE Internet of Things Journal) has proposed a novel way of implementing near-field communications for smartphones using acoustic (audio frequency) messaging. The clever part is that the acoustic modem is implemented completely in software on a smartphone. This project will implement such a soft modem for an android smartphone and will investigate the feasibility of the technique as a way to implement secure near-field communications for applications such as the exchange of credit-card information (or similar payment data, such as Google Wallet).
Of interest to students with a strong DSP and programming background. An Android smartphone or tablet is required.

A web based car engine ECU simulator
In automotive electronics an embedded computer manages the control of the engine. This device is an ECU (engine control unit). The ECU emits various messages so that the real-time performance operation of the engine can be monitored. While the car is being driven the speed, engine rpm, etc. can be monitored. Also the state of the various sensors, such as temperatures, pressure, oxygen level etc. can be monitored. The ECU messages can be monitored by connecting equipment to the diagnostic port on a car (the OBD II port) so that the sensors can be monitored. However, for developing such diagnostic equipment it is inconvenient to attach to a real car engine, so ECU hardware simulators are often used in place of the real engine. There have been some development efforts towards the realisation of software-based ECU simulators. This project proposes the development of such a software based ECU simulator. Further, the feasibility of hosting such a simulator on the web will be explored to ass
ess delay and response times etc. This project can be developed entirely on a PC without external hardware dependencies. The choice of operating system and programming language etc. can be decided later on, in discussion with the student.

Intel Galileo Controlled Toy Car
Interest in remote controlled vehicles is very high at the moment. This project uses an Intel Galileo module to control a toy car. The Car should be able to follow a line or navigate towards a light source, and should be autonomous. The project involves identifying a suitable car and interfacing it to the Galileo, as well as designing the sensor interface and developing the necessary software.

Investigation of BitCoin Server Architecture
BitCoin is an open source peer-to-peer payment system, effectively “ digital currency”
It uses a Virtual Private Cloud architecture it uses Network Layer (Firewall) and Transport Layer Security (SSL/TLS),fundamental to operation is the concept of Hot and Cold wallet servers.
Hot wallet servers are used to send/receive Bitcoin very quickly. The negative aspect of this is in the event that your hot wallet server is compromised, there is a high chance that you may lose all Bitcoin stored on this server.
Cold wallet servers are Bitcoins that are kept in cold storage. Examples of a cold wallet are USB drives, servers disconnected from the internet, brain wallets, and paper wallets. The cold wallet should only be accessible physically by an administrator. This project proposes an in-depth study of the technical/networking issues affecting BitCoin.

Wireless Analyser/Sniffer APP for Android
Wireless sniffer tools have many uses in commercial IT environments. Their ability to monitor, intercept, and decode data as it is in transit makes them useful for:
· Diagnosing and investigating network problems
· Monitoring network usage, activity, and security
· Filtering network traffic
The project requires a wireless packet sniffer APP to be developed for the Android platform to provide the services above – WiCAP, WiFinspect Apps are a good example.

Smart device using a Raspberry PI
Using the PI as the “web to device” interface with a Wireless or wired broadband connection the aim of this project is to turn a standard home entertainment device into a smart web enabled device. The PI is also to be used to provide a data download indicator (Actual Bits downloaded) on the device.

Obviously there are more than that available for choice, but those are the ones I'm most interested in.

Sparks

MajesticDonkey wrote: »

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

That's not as hard a problem as you'd think. It's like the PhD thesis selection problem - everyone thinks that the requirement to be novel means it has to be this great stonkin' revolutionary thing, but all it actually means is a small but solid incremental addition to the knowledgebase (seriously, ask anyone who's done one and in the STEM fields at least, they can give you a single number that was the novel thing their thesis added - and there's not much that's more surreal than seven years of someone's life being summed up by "2.2301" ). Same idea here - you do a proper audit of something that's not been audited yet (and openSSL's just the example in the news, you could pick almost any chunk of open source infrastructural code really) and you've created a new piece of work that has value and might even be publishable depending on what you found. It probably won't be very cool - but there's cool and there's worth doing and odds are quite high it'd be the latter. The latter always impressed me more, especially if the student thought of it themselves rather than picking it off a list.

I'm going to post the supplied project specs here. Projects are allocated in order of preference, with people with higher grades getting first preference.

Honestly, half of those (especially the bitcoin, android sniffer and raspberry Pi ones because they've been in the news so recently between MTG, the ACM article on taintdroid and the UCD Pi event) stink to high heaven of lecturers vying for FYP supervision numbers for quotas by making up the coolest-sounding projects they could think of inside of ten minutes. You'd be surprised how much that happens



Obviously there are more than that available for choice, but those are the ones I'm most interested in.[/QUOTE]

fergalr

MajesticDonkey wrote: »

Interesting read, thanks.

I suppose my problem at the moment is trying to find something that won't be too over the top work-wise, and obviously something that isn't substantial enough to be an FYP as well.

That is very wise of you.

Be careful to not take on an impossible project, that your supervisor doesn't know is an impossible project.

Often, from an academic point of view, FYP student time is completely free. FYP students are disposable and expendable.


The OpenSSL static analysis project that Sparks suggested is an extremely valid and worthwhile project.

However, I would be wary about taking it on as FYP, if I was in your position. (Not saying don't do it, but just be wary.)

- If you find another heartbleed bug, you'll win fame, and a great career in security research; but probably for your project supervisor.

- But if you find nothing (which is more likely - OpenSSL is one of the biggest threat surfaces in the world, finding bugs in it makes careers, so plenty of other people will probably have done all the low hanging fruit of static analysis on it before*.) If you find nothing, then you have nothing to show for your time. You'll be doing your final year project write up, and in your demo, and you won't have a nice app to show. You will have negative results. Negative results are extremely important and valuable, but totally undervalued. Partly because you can't tell them apart from someone that just did a bad job. So your life will be hard. Unless you find a very enlightened supervisor.


* (with the general exception, that when you assume that of course this thing is so obvious and so important that someone will have done it before - invariably no one has, (this is because everything is broken and nothing works, which is an important related issue.))


I'd also like to say:

Please read the second part of Sparks' post above mine again. Its very important. Normally, no one will tell you this, but Sparks has, so please read it twice.

Also, check if proposer has research experience in the area they are proposing a project in; also try talk to previous students of them on the quiet.

MajesticDonkey

Great, thanks lads.

awec

Are you more interested in doing a research type project or actually building something?

My only advice is this:

1. Don't bite off more than you can chew. Aim high but be realistic - do you want to spend every spare hour of the next year on it just to get it finished?
2. Don't do something that you aren't very interested in. You need to maintain enthusiasm for the entire year.

Remember that while it's all about getting a decent result you'll also likely be asked about it during your first graduate job interviews.

Research type stuff didn't interest me, it's too mundane and too boring for me so I built something instead.

Check with your college - sometimes they will have company-sponsored projects and you might find one that you find interesting. These are very good for setting you up for a job.

MajesticDonkey

awec wrote: »

Are you more interested in doing a research type project or actually building something?

I think I'd prefer something practical as opposed to research, but I don't mind too much because I'm pretty OK at writing long spiels about how something works.

awec wrote: »

My only advice is this:

1. Don't bite off more than you can chew. Aim high but be realistic - do you want to spend every spare hour of the next year on it just to get it finished?
2. Don't do something that you aren't very interested in. You need to maintain enthusiasm for the entire year.

Remember that while it's all about getting a decent result you'll also likely be asked about it during your first graduate job interviews.

Research type stuff didn't interest me, it's too mundane and too boring for me so I built something instead.

Check with your college - sometimes they will have company-sponsored projects and you might find one that you find interesting. These are very good for setting you up for a job.

Thanks for the advice.

MajesticDonkey

So I've decided to extend this:

Image Recognition APIs
Image recognition methods are now available for developers from a host of vendors. This project will involve a comprehensive review of the available services and APIs that are currently offered across different platforms. Products will be assessed in terms of cost, ease of use, capabilities, scalability, etc. In addition, the use of a sample set of web APIs will be deployed, so as to demonstrate this technology and access it’s capabilities. Skills and knowledge required (but not limited to): Web & app development and programming.

...to actually create an Image Recognition API (web-based) from scratch. I have some nice ideas for this, and it's really where my "area of expertise" is at the moment - web-based Java stuff. I may use Spring for the core of the API - some nice stuff in there for RESTful services, authentication and so on. Will probably use some sort of OAuth for access-token based access. To demonstrate it I'll probably create some sort of Android app.

Anyone have ideas that might be a nice addition to this?

CreepingDeath

MajesticDonkey wrote: »

...to actually create an Image Recognition API (web-based) from scratch.

Have you any experience with graphics and in particular Image Recognition ?
Artificial Intelligence / Image processing is a big area laden with a lot of math.

Even the term "image recognition" would need to be scoped as artificial intelligence in graphics is extremely fragmented with different algorithms for very specific processing tasks, eg. texture recognition, image segmentation, line detection, shape recognition, blob detection etc.

Does "image recognition" mean matching one image with another, or a subset of another, Eg. in the same way that Street View in Google maps can match photos, taken by users from different perspectives, of the same landmark. ( tricky )

Most image recognition APIs are written in C/C++ for processing speed, so some will not have a good Java interface.


Update.... actually, I see that task is to review them all, not necessarily to produce a working end product, just rip-off a few demo/examples of theirs.

MajesticDonkey

CreepingDeath wrote: »

Have you any experience with graphics and in particular Image Recognition ?
Artificial Intelligence / Image processing is a big area laden with a lot of math.

No current experience, but I do have basic knowledge in the area and it's something I'd have a big interest in.

CreepingDeath wrote: »

Most image recognition APIs are written in C/C++ for processing speed, so some will not have a good Java interface.

Yeah, fair point, but for the point of demonstration I don't think processing speed will be a big factor. Realistically, with a say a 14MP photo, what would be the difference between C(++)/Java? Less than a few seconds?
EDIT: anything I'm reading online is saying there's essentially zero difference between C and Java, but that the real speed increase comes with Python, because of native access to ImageMagick and so on.

CreepingDeath wrote: »

Update.... actually, I see that task is to review them all, not necessarily to produce a working end product, just rip-off a few demo/examples of theirs.

Yeah, a review of them is the supplied project but I don't really want to just to a review, so I decided to go for a project of my own and actually write an API.


The plan is to research the sh1te out of this for the next 2-3 months, a bit of code tinkering, and actually start building it once I go back to college in September. I don't think this is a completely unrealistic task, but it is a difficult one.

CreepingDeath

MajesticDonkey wrote: »

I decided to go for a project of my own and actually write an API.

I've messed around in this area in the past, it's complicated, but go for it.
You will need to narrow down what your API will do, because there's Ph.d thesis just on slightly faster/more accurate line detection algorithms, never mind writing a full API yourself from scratch.

Most of the complicated artificial intelligence documentation on graphics is in thesis form, which is written in math notation, so you won't easily find nice code snippets to plug into your work.

To date, I've sample code which reads the mjpeg video stream from a network webcam frame by frame (Cambozola), and I can optionally turn on/off certain filters for image processing.

Using the Java Advanced Imaging library ( JAI ), I've implemented sobel line detection, prewitt line detection, invert image colour ( negative image ), simple retinex colour conversion ( from sample code on the web ), subtract one image from another ( simple motion detection ), erode image, convole image, colour quantization and I found code on the web for "statistical region merging" which tries to segment an image into similar areas.
Histogram functions to analysis the colour of images, converting images to grey scale, blurring images, identifying horizontal and vertical lines, scaling images, and trying to put a name to an RGB colour.

I've also looked at "Grey Level Correlation Matrix" texture analysis, where you
try to match blocks of pixels by texture.

It's all interesting stuff, but you'd need to specialize in computer graphics to write some of the complicated math routines for any of the interesting stuff like texture recognition.

So I'd just caution you to narrow your API right down, computer graphics is a field in it's own right.

You might create a very simple API wrapper around an open source API out there to make it more accessible to others...

MajesticDonkey

CreepingDeath wrote: »

You might create a very simple API wrapper around an open source API out there to make it more accessible to others...

So yesterday I took the day off (work placement) to research this a bit more, and it turns out there's a small bit more to writing an image recognition algorithm than I thought

So what I've decided to do is as mentioned above - create a wrapper for an existing image recognition library (OpenCV to be exact), or more specifically, a web-based API which uses OpenCV as a backend. Using OpenCV also gives me an excuse to go learn C++.

Thanks to everyone for the help

CreepingDeath

I don't want to confuse you after you made a decision, but there's some Java wrappers (somewhat out of date I believe) for OpenCV already.
Maybe writing a project to use the libraries would give you a more defined project result.

One computer vision project idea I was thinking about was related to driving, being able to recogise road signs.
I doubt you can run it on something underpowered & small as a raspberry pi though...

The idea would be that you process the live video feed from a dashboad camera, detect the red bordered circular speed signs and display the current speed limit or play an audio file saying ( 5km, 10km, 30km, 50km etc )
There's already algorithms for detecting circles.

Or you could try read navigation road signs and determine what road the user is on. More for processing dashboard camera footage online, and working out where they were if you see a sign for eg. "Dundalk 30km".
Sort of automatic video geotagging for the likes of Google.

MajesticDonkey

CreepingDeath wrote: »

I don't want to confuse you after you made a decision, but there's some Java wrappers (somewhat out of date I believe) for OpenCV already.
Maybe writing a project to use the libraries would give you a more defined project result.

There are. They just use native functions to call the C++ library. What I'm going to do is to essentially create a web-based version of the image processing functionality of OpenCV. Obviously real-time video processing over the Web would not work.

CreepingDeath wrote: »

One computer vision project idea I was thinking about was related to driving, being able to recogise road signs.
I doubt you can run it on something underpowered & small as a raspberry pi though...

The idea would be that you process the live video feed from a dashboad camera, detect the red bordered circular speed signs and display the current speed limit or play an audio file saying ( 5km, 10km, 30km, 50km etc )
There's already algorithms for detecting circles.

This actually already exists, and was created by developers of OpenCV: http://itseez.com/products/adas/