RSAC Security Scholar Poster Pitch-Off

### Overview At the RSA Conference Security Scholar Pitch-Off, hosted by Cecelia, four university security scholars presented their research in rapid five-minute pitches followed by five minutes of Q&A with industry judges Jamil Jaffer (National Security Institute), Ben Jun (HVF Labs), and Helen Patton (Cisco). The pitches spanned diverse cybersecurity challenges: offensive deception strategies, air traffic control vulnerabilities, adversarial evasion against machine learning malware detectors, and the environmental impact of crypto mining malware.

### Key Topics - **Aggressive Cyber Deception and Information Operations**: Marco Morrison (University of Washington, Bothell) addressed limitations in current deception tactics (such as passive honeypots and Canary tokens) by reframing cyber deception through the lens of information operations (IO), counterintelligence, and psychological operations (PSYOPs). - **Air Traffic Control (ATC) System Security**: Beth Chwialkowski (Embry-Riddle) evaluated how cyber attacks, specifically spoofing and replay attacks, affect airspace safety metrics, controller task load, and operational stress. - **Adversarial Evasion in Windows PE Malware**: Kshitiz Aryal (Tennessee Tech University) explored code-cave injection and custom code loaders designed to bypass machine-learning-based static malware detectors while preserving original binary execution. - **Cybersecurity and Environmental Impact**: Ansuv Sikka (University of California, Berkeley) analyzed the energy footprint of crypto mining malware compared to host defense systems (IDS/IPS) and explored intersections between security spending and environmental impact.

### Technical Details - **Information Operations Deception Framework**: Morrison highlighted existing tools like Cowrie (an SSH honeypot emulating a fake file system) and Portspoof (emulating signatures of arbitrary services to confuse Nmap scans) that obfuscate real infrastructure. Proposing an objective-first framework, he demonstrated how to target attacker behavior—specifically targeting credential theft (noted as involved in 49% of attacks) by designing a SQL honeypot providing fake, trackable credentials to introduce unreliability, aid attribution, and influence attacker perceptions. - **Empirical ATC Attack Simulation**: Chwialkowski conducted simulations with approximately 30 upper-level Embry-Riddle ATC students across nominal, spoofing, and replay scenarios. In the spoofing scenario, an attacker broadcast duplicate flight data causing aircraft icons to jump across screens; the replay scenario retransmitted past flight data for unresponsive aircraft. While nominal 30-minute sessions averaged 1 to 2 safety incidents (such as low altitude alerts or collision warnings), cyber attack scenarios caused incidents to jump to 14 to 16. Controllers reported elevated workload and stress on the task load index, driven by lack of prior training and fixation on aberrant targets at the expense of general airspace monitoring. - **Code-Cave and Perturbation Injection**: Aryal tackled evasion against academic standard end-to-end static ML malware detectors, MalConv and MalConv2. While baseline attacks yielded 16% and 4% evasion rates, his approach introduced a code-cave in sections such as .text, .data, and .rdata, paired with a small 10–12 line code loader that temporarily restored original bytes at runtime. Using gradient descent and Fast Gradient Sign Method (FGSM), evasion rates reached up to 98% without breaking binary functionality. - **Power Consumption Measurement**: Sikka developed an IDS/IPS using a Windows kernel module analyzing binary opcodes, paired with a recurrent neural network (RNN) trained to recognize and generate crypto mining opcode sequences. Benchmarking on a MacBook Pro running a Windows VM with a ~70 kWh charger, baseline power was ~40 kWh, running the IDS/IPS drew ~50–52 kWh, and active crypto mining drew ~60 kWh, demonstrating that preventative defense consumes less energy than unmitigated high-intensity malware.

### Takeaways - Cyber deception is most effective when driven by clear counterintelligence objectives rather than haphazard honeypot deployments. - Critical infrastructure operators such as air traffic controllers require specialized training and procedures to recognize cyber anomalies and maintain situational awareness during technology degradation. - Machine-learning malware detectors remain vulnerable to structural file perturbations, underscoring the ongoing need for structure-aware models, adversarial retraining, and resilient signature verification. - Cybersecurity defense can act as an environmental investment, where mitigating resource-heavy malware (e.g., crypto miners and ransomware) directly curbs wasted computing power.