We have an open-ended project component for this class. You are expected to budget ~10hr/student for the project. Project topics can be anything related to computer security and privacy. You are free to pick a topic. If you can't find a topic, talk to me and we can find a suitable topic. There are five types of projects I am expecting you will do.

(a) Add security component to an existing project. If you are already working on a project (maybe as part of another class) which has a security component, for example, adding authentication to your website, adding TLS to your web service, ensuring disk encryption, checking for vulnerability in your code, etc.

(b) Explaining a recent security incident. You can pick one of the recent computer security incidents (such as an attack or a security feature rolled out by some company) and dive deep into their details. The task is to find what exactly happened, how they happened, what type of security vulnerabilities were there, and how to stop those incidents from happening in the future. This type of project should go beyond what one can find in, say, first page of Google search results or written in one blogpost.

(c) Systematization of knowledge. This type of projects will pick 4-6 recent research papers on a topic (e.g., defending buffer-overflow attacks, return-into-libc attacks, XSS attacks and defenses, etc.) You can pick a topic that you like, find a recent highly influential paper on that topic, look at their related works, or the works that cited that paper and identify another 3-5 papers that are very closely related to this paper and tries to solve the same problem. Then write a summary of those papers. The "systematization" is not just writing 4-6 independent summaries, instead it is about finding a coherent theme to connect the approaches and comparing their efficacies.

(d) Extending an existing security-related project. If you are already working on a security related project, you can extend that project too. However, you have to clearly outline which part of that project you are doing as a part of this assignment. If you are unsure whether the component is separate enough or not, please talk to me.

(e) Something else. If you want to do something completely different from the types I mentioned above, for example, you want to study "how misinformation flow through the Internet", or "how to create a new password-based encryption scheme", or something new as a part of this assignment, you can do that, but please consult with me to scope the project.

When you work on your project think about the following components.

(a) Motivating the problem - why should others care about the problem you are describing or trying to solve.
(b) A clearly outlined threat model - It is very important for every security related to work to clearly mention the goals and capabilities of the (hypothetical or real) attacker.
(c) Details of the methodology you followed/will follow to complete the project. (This may include how you find the papers, articles, how you measure the efficacies of an attack or a defense mechanism, etc.)
(d) Results of the investigation. Also, part of this section should be comparison with other related work that other researchers might have done.
(e) Final takeaways from the project (for you and for the reader.)
(f) Who did what (only for project report). Please have a short paragraph (4-5 sentences) saying which group member did what.
(g) Citation. You must cite every resource you used to complete the project; it is imperative that you give credits to the prior research works and articles that directly contributed to your project.

1. Project proposal

You are required to submit a project proposal by Nov 23. It carries 2% of points, but primary goal of this assignment is to ensure you start thinking about the project, make sure you have planned out your tasks, and expected outcomes. The proposal need not be longer than 1000 words (including references) and should contain:

The topic and motivation,
expected tasks to finish the project and who will do which task, with timeline, and
expected outcome for each task. You can use whatever formatting you want for this.

2. Project presentation

We will try recorded presentation this time. This will have two component:

(a) Recorded presentation. Every group will prepare a presentation of up to 10 minutes describing their projects. Make sure to motivate your problem, given clear threat model, and describe the results that you find. Not all members of the group have to talk during presentation (given the short time each group will have). We will post the lecture on a spread sheet, and let others watch and ask questions, interact with other groups, over Piazza. The recordings will be only shared with the class members.

(b) In-class Q&A. Everyone is required to see other groups' presentations before the class, and engage in Q&A. We will have short and quick Q&A session for each group to answer questions. Each session will be 3 minutes long.

I am anticipating around 18-20 teams, so we should be able to accommodate all groups in one lecture session.

3. Project Report

The length of your report should be 4-6 typeset pages, excluding bibliography and well-marked appendices. There is no limit on the length of appendices, but graders are not required to read them. You are encouraged use LaTeX and the ACM CCS template. You can checkout Overleaf for easy collaboration and LaTeX compiling. Whatever tool you use to write the report, please ensure it is in two-column format with a 10- or 11-point font.

You should follow the ACM Citation Style and Reference Formats. (If you use the Latex template above, it will automatically use the correct format.) You can export citations from Google Scholar (See this guide: Exporting Citations from Google Scholar - Google Tips & Tricks).

Your report should have the following sections: (Treat this as a guideline, you are not required to follow them ditto, except for the contribution section.)

Abstract. (~100 words)
Introduction.
Background & Related work. (This section should end with a subsection outlining "Threat model")
Methodology. (This section you explain the work you have done for the project, including if you have collected some data, how did you collect it and analyzed it, if you read some papers, how did you decide on those papers, how did you systematize the knowledge in those papers/articles.
Results. Your main findings from the project.
Conclusion.
Contribution. (Every project must include a section containing "who did what". This should not be longer than a quarter of a page (6-8 sentences).)