by Justin DelVecchio | Nov 22, 2023 | Staff
Canisius Cybersecurity is a member of the U.S. Cyber Command (USCYBERCOM) Academic Engagement Network (https://www.cybercom.mil/Partnerships-and-Outreach/Academic-Engagement/). USCYBERCOM defends the nation, countering hostile cyber actors alongside our interagency, industry, and international partners. It has three main focus areas: Defending the DoDIN, providing support to combatant commanders for execution of their missions around the world, and strengthening our nation’s ability to withstand and respond to cyber attack.
Today, November 22, Canisius University will present to USCYBERCOM the work of Justin Del Vecchio, PhD, and his student researchers Andrew Perreault and Eliana Furmanek. Their research focuses on unique applications of large language models (OpenAI’s ChatGPT or Meta’s Llama) to auto generate software code from human natural language instructions. Large language models offer malware developers opportunities to easily engineer previously unseen malware. Concurrently, the models can make life harder on cyber attackers by creating ephemeral executables that are difficult to reverse engineer and are continually changing. This limits the ability of attackers to identify and exploit vulnerabilities.
Submitted by: Justin Del Vecchio, Assisstant Professor, Computer Science & Cybersecurity
by Justin DelVecchio | Jun 7, 2023 | Faculty
Common vulnerabilities and exploits fuel cyber attacks and warfare. We hear about them all the time. Notification and identification of these vulnerabilities used to be a hodgepodge. Information was decentralized. Affected vendors maintained their own, siloed assessments and acknowledgements. Virus detection engines used their own set of identified vulnerabilities. No common language or data representation format existed.
MITRE identified this as a problem in early 1999 [1]. They proposed a centralized repository of identified vulnerabilities. Industry, governments, and researchers would work hand in hand to identify and codify vulnerabilities. Fast forward 20 years. The MITRE Common Vulnerabilities and Exposure (CVE) database [2] has standardized vulnerability reporting. It has led to the development of numerous, other cybersecurity resources. An example is the MITRE ATT&CK knowledge base [3]. It lists adversary tactics and techniques based on real-world observations and matched to CVEs.
The time has come to centralize the reporting of data breaches in a similar, centralized and structured manner. Click here to read Justin Del Vecchio’s blog about what exactly a centralized, common enumeration of data breaches enables.
Submitted by: Justin Del Vecchio, PhD, Assistant Professor, Computer Science and Cybersecurity
by Justin DelVecchio | Feb 17, 2023 | Faculty
Lesson plans will always be in the hands of the human instructor. Always. The instructor brings the creativity to the plan. ChatGPT can do the monotonous tasks that might otherwise prohibit an instructor from considering particular elements of a plan. Here is an example.
I currently teach an introductory course on Java development targeted toward sophomore level students. It was time to review the concept of Java packages, a construct that organizes code files. The trusty book, Core Java for the Impatient*, gave a good description. I wanted to supplement it with a real world example.
My thought process was the following. Find an open source Java project. The project would be large and have many Java files and packages. I would total up the number of files, the number of directories, and use that as visual proof of the utility and need for packages. I wanted to convey that putting all your source code files in one directory simply is not a good idea. Source code files need to be organized logically by functionality. Java packages are the solution.
Could ChatGPT help me out with this task? Click here to find out what I learned.
Submitted by: Justin Del Vecchio, assistant professor, Computer Science and Cybersecurity
