MSCO Master's Reports & Theses

AI-Driven Advanced Malware Creation: Challenges in Modern Cybersecurity
This report explores the offensive use of GenAI in the creation of sophisticated, adaptive and evasive malware. Unlike traditional malware, which often relies on static signatures and predictable behaviors, AI-generated malware can autonomously modify its code, evade detection in real time and adapt to varying environments. Focusing on an offensive perspective, this report does not cover defensive strategies in depth but aims to highlight the growing threat posed by AI-driven cyberattacks. Through a comprehensive literature review, the report examines malware classification, including polymorphic, metamorphic and advanced AI-enhanced malware types.

Keywords: Generative AI, AI-Generated Malware, Polymorphic Malware, Metamorphic Malware, Offensive Cybersecurity, Advanced Evasion Techniques, DeepLocker, BlackMamba, EyeSpy, ChattyCat, RATGPT, Occupy AI

Risk Assessment of US Domain Maritime Smart Ports That Have Foreign Investments
This report examines cybersecurity vulnerabilities across US maritime ports, focusing on those classified as smart ports along with those with foreign investments. Using open source intelligence (OSINT), the study analyzes 690 domestic maritime ports, revealing the presence foreign-manufactured cranes with remote capabilities, unsecured systems that increase the risk of cyberattacks and the role that foreign controlled ports play. The findings highlight the need for stronger cybersecurity frameworks and further research into foreign involvement within US ports.

Keywords: Smart ports, Cybersecurity, OSINT, ZPMC cranes

Hacktivists and How to Grade Them: A Threat Matrix Methodology
Hacktivist groups present a unique challenge in cyber threat assessment because they often operate with strong ideological motivations leading to heightened persistence, symbolic target preferences, and a desire to create information effects in addition to cyber effects. At the same time, reporting on hacktivist activity is often inconsistent, exaggerated, or difficult to verify, making structured assessment difficult. While existing cyber risk methodologies provide useful ways to assess vulnerabilities, incidents, or traditional cyber-criminals, they do not fully account for the characteristics which make hacktivist groups distinct as threat sources. This paper addresses that gap by developing a methodology for assessing hacktivist groups in a way that is structured, repeatable, and defensible and is rooted in established cyber and intelligence assessment tradecraft. 

The methodology presented in this paper scores hacktivist groups on six threat factors to provide a generalized threat score, which is then modified through a contextual adjustment based on the relevance to a potential target. The threat scores are paired with a separate confidence rating to communicate how strongly the underlying evidence supports the assessment. To demonstrate the methodology, it is applied to two real hacktivist groups across two different target contexts. The results show that the methodology can distinguish between generalized threat and target-specific relevance, and that a group with a lower generalized score may still become the more significant threat based on potential victim context. The primary contribution of this work is a practical process for evaluating hacktivist groups as threat sources in a way that is more appropriate than existing approaches. 

Zero-Trust Verification of AI-Generated Code Through Proof-Carrying Security Types
AI coding assistants generate insecure code at substantial rates. Pearce et al. [1] report that roughly 40% of Copilot completions in security-sensitive tasks contain weaknesses, and Perry et al. [2] show that assistants can reduce security while increasing developer confidence. Sandoval et al. [3] and Khoury et al. [4] report similar trends. The dominant defense is pattern-based static analysis, which enumerates known vulnerability structures. That approach cannot verify semantic fixes and does not scale to the open world of libraries that AI uses. A dedicated literature review chapter surveys five families of defenses against insecure AI-generated code (pattern-based static analysis, LLM auditors, formal taint systems, secure-by-construction generation, and runtime sandboxing) and distills four recurring gaps that motivate the contribution. This thesis proposes the Type System Paradigm for AI code security verification. The assistant declares security semantics in PCST contracts that list sources, sinks, transformations, and ordered witness paths. ACUTIS verifies these contracts using a property lattice and set-based boundary constraints, with Zero Trust defaults for undeclared behavior. The verifier maintains true zero enumeration and returns an ALLOW or BLOCK verdict. ACUTIS runs as an MCP server for Python and JavaScript. Study 1 evaluates the verifier on 136 CVEFixes samples with oracle contracts and achieves F1 = 1.0000 with perfect precision and recall. Study 2 evaluates the full pipeline on 40 natural-language prompts; treatment with ACUTIS reduces vulnerabilities by 62.5% compared to control (p = 5.96x10^−8), with zero regressions. A methodological finding follows from the evaluation: Semgrep measures only a 15% reduction because pattern matching detects structural changes but cannot validate semantic escaping, while manual review confirms 62.5%. These results show that formal verification and AI semantic understanding are complementary and that the Type System Paradigm provides a practical route to securing AI-generated code.

Keywords: AI-Generated Code Security, Proof-Carrying Security Types, Zero-Trust Verification, Formal Verification

A Forensic Readiness Framework for Improving Incident Response in Serverless Cloud Investigations

Cloud adoption into enterprises has become more prevalent as businesses move workloads from existing infrastructure to cloud-native applications or utilize serverless platforms. Serverless computing platforms like AWS Lambda allow businesses to scale and operate their workloads without maintaining servers but can present serious gaps when conducting digital forensic investigations. Conventional digital forensics involves having operating systems, memory, and persistent storage to gather artifacts from; however, serverless environments are composed of ephemeral resources which can limit the amount of forensic evidence remaining after execution. This paper aims to present a forensic readiness framework for increasing artifact preservation and investigative visibility into AWS serverless applications. To accomplish this goal, an AWS laboratory environment was built with AWS Lambda, CloudTrail, CloudWatch Logs, Identity Access Management (IAM), and Amazon S3. Two investigative scenarios were designed to challenge forensic readiness: Lambda lifecycle abuse and logging tampering. This paper will test the proposed framework by comparing artifact availability, completeness of evidence, ability to reconstruct timelines, and investigative visibility between a baseline AWS configuration and a forensic ready AWS configuration. The intended contribution of this research is to provide organizations with a framework they can use to proactively preserve digital evidence and increase their ability to reconstruct incidents during serverless cloud investigations.

Keywords: Cloud Forensics, Digital Forensics, Forensic Readiness, Incident Response, AWS Lambda, Serverless Computing

AI Minimalism: Necessity-First Security Design for Intelligent Systems

The rapid integration of artificial intelligence into cybersecurity operations has outpaced the ability of existing governance frameworks to ensure secure, accountable deployment. While numerous AI security frameworks exist, including those from NIST, ISO, ENISA, and the European Union, they exhibit thematic convergence without operational convergence: frameworks increasingly agree on the categories of risk that matter but diverge on how organizations should translate governance intent into enforceable system design. This thesis argues that AI security failures stem less from insufficient capability and more from excessive, unjustified complexity coupled with weak policy-to-implementation translation, a condition termed policy drift.

This thesis introduces AI Minimalism, a Necessity-First, human-centric framework for optimizing AI use in cybersecurity systems. A comparative analysis of ten major global AI security frameworks, evaluated against a four-question rubric assessing necessity, minimalism, human oversight, and operationalization, demonstrates that no existing framework systematically addresses necessity-based design, architectural minimalism, or governance-to-audit traceability. The AI Minimalism framework addresses these gaps through four integrated components: (1) Necessity-First security design, which requires every AI component to justify its inclusion before deployment; (2) human-centric enforcement through risk-tiered Challenge Gates that calibrate oversight to decision criticality; (3) Governance as Code, which translates external framework requirements into structured, machine-readable, version-controlled artifacts; and (4) Policy as Code, which renders internal governance executable, auditable, and subject to continuous drift detection. Feasibility is demonstrated through an illustrative walkthrough in an enterprise-style environment, tracing a complete policy lifecycle from external framework update through governance artifact creation, enforcement logic deployment, and audit evidence generation. The findings suggest that secure AI is achieved not through greater capability or additional complexity, but through justified, minimal, and accountable system design.