Theses

Please reach out to us via email to ask for open BSc/MSc thesis projects! Once you picked a topic that we offered to you, the next step is to write a thesis proposal as an agreement on the direction and scope of the work.

Open BSc/MSc and Research Lab Thesis Projects

 Emergent Risks in Agentic AI (proposed by Nanda)
LLM-powered multi-agent systems enable autonomous planning, tool use, and collaborative decision-making, but their security properties are poorly understood. Unlike single-LLM settings, these systems introduce new attack surfaces through inter-agent communication, shared memory, delegation, and tool interactions, creating opportunities for manipulation, deception, and emergent harmful behaviour. This research aims to systematically explore and uncover previously unknown vulnerabilities in such systems by studying how malicious prompts, corrupted messages, forged agent identities, poisoned artifacts, or adversarial tool outputs can influence multi-agent workflows. The project will develop a comprehensive benchmark capturing realistic agent interactions and adversarial scenarios, enabling reproducible evaluation of system robustness across diverse frameworks. By revealing hidden risks and establishing the first structured methodology to analyze them, this work lays the foundation for building more secure, reliable, and trustworthy LLM-driven multi-agent ecosystems.  Cyber Range Benchmarks for LLM Agents (proposed by Nanda)
LLM-powered security agents are increasingly being evaluated on vulnerable machines and CTF challenges, but these settings often focus on isolated targets and short attack paths. This project aims to build a composable cyber-range benchmark by connecting multiple vulnerable virtual machines into realistic multi-host attack scenarios. Each environment will require agents to perform reconnaissance, exploit vulnerabilities, escalate privileges, discover credentials, pivot across networks, and move laterally to reach a final objective. The connections between machines will follow meaningful attack dependencies, allowing the benchmark to capture long-horizon exploitation and attack chaining. The project will also create reconfigured versions of these environments by changing network topology, host information, credentials, ports, and other nonessential properties. This will enable systematic evaluation of whether LLM agents can generalize their exploitation skills to unfamiliar environments rather than relying on memorized information from publicly available vulnerable machines.
 Signal Messenger DoS Analysis (proposed by Bogdan/Christian)
Signal is the de-facto standard when it comes to secure messenging. Its main security focus is on confidentiality and privacy guarantees. But does it also withstand DoS attacks that threaten the availability of Signal users or even centralized servers? For example, the support for out-of-order messages forces the receiver to update its ratchet N times, while the recipient does not have the same computational load. Similarly, Signal servers have to cache data (messages, rachet keys, etc.) of offline peers, opening up the room for server abuse. Finally, Signal allows users to operate a single account on several devices, and abusing one of the devices might open up DoS possibilities against the other. Ultimately, this student project should explore to what extent the Signal client/server implementation is susceptible to DoS abuse; not limiting the research to the scenarios mentioned above.

Ongoing Thesis/Research Projects

 Security Analysis of the ITMC SSO System (Fabian Kanefke, supervised by Prof. Rossow)
(under NDA)
 Autonomous Binary Exploitation with Large Language Models (Jonas Zunker, supervised by Nanda)
This thesis investigates whether LLM-driven agents can perform useful vulnerability analysis and con- trolled proof-of-concept exploit generation directly from compiled binary executables. We focus on memory-safety vulnerabilities in x86-64 Linux ELF and Windows PE binaries. The agent receives ac- cess to the binary and a controlled execution environment, but not to the original source code. It may use static and dynamic analysis tools, including disassemblers, decompilers, debuggers, fuzzers, tracers, and binary-analysis frameworks. The goal is not to build an unrestricted offensive system. The goal is to measure, in a reproducible and ethically controlled setting, which parts of binary vulnerability analysis can be automated by current LLM agents.
 Analyzing Sybil Adaptation in the Tor Network (Mathis Villalta, supervised by Bogdan)
Given that Sybil attacks are a critical component of many threats, improving their detection is essential. Tor already provides a Sybil detection tool, Sybilhunter. However, some threat actors have demonstrated to have successfully deployed Sybils, particularly considering how adversarial strategies and the broader networking landscape have evolved since 2016. The main goal of the thesis is to detect obfuscation techniques used by attackers to bypass Sybilhunter.
 Autonomous AI Agents for Solving Binary CTF Challenges (Rayen Guenenna, supervised by Nanda)
This thesis projects investigates the use of Large Language Models (LLMs) for automated vulnerability identification and exploit generation directly from compiled binary executables. Unlike traditional approaches that rely heavily on symbolic execution, fuzzing, or manual reverse engineering, the proposed framework treats binary exploitation as a reasoning and planning problem. By combining disassembly tools with LLM-driven semantic understanding, the system aims to identify exploitable program behaviors, infer vulnerability primitives such as buffer overflows and use-after-free conditions, and autonomously generate proof-of-concept exploits. The key objective is to evaluate whether LLMs can generalize exploit strategies across unseen binaries and real-world vulnerability classes, enabling more intelligent and scalable vulnerability discovery while maintaining controlled and ethical experimentation.
 Tracing Back Signal Users (Maurice Nocon, supervised by Bogdan)
This project aims to trace back a Signal protocol user to its current location.
 LLM-based Extension of the AmpPot Honeypot (Paul Thiele, BSc thesis supervised by Nanda)
This project aims to extend AmpPot with new protocols or unknown request of already-supported protocols by involving LLMs.
 Identifying IPv6 Address Scrapers in the NTP Pools (Mohsen Khakbazan, BSc thesis supervised by Eric)
The NTP pool is regularly used to host services with the main intention to harvest new IPv6 addresses, which are then included in IPv6 scan hit lists. In this work, we aim to identify which of the NTP servers misbehave that way and contribute to scanning.
 NAT Laser DoS Attack (Jonathan Flueren, MSc thesis supervised by Eric)
Network Address Translation (NAT) gateways are everywhere: from home routers to carrier-grade NATs performed by phone carriers or satellite network providers. NATs keep track of network connections and thereby implicitly filter which traffic passes them; that is, only packets belonging to "known" connections will pass through the NAT. This NAT-based traffic filtering severely limits the potential impact of DoS attacks as attackers are believed to have no control over NAT entries. In fact, it is common belief that attackers cannot send traffic to NATed devices (e.g., phones, Starlink users) directly due to NATing. But is that so? This project studies two threat models in which attackers aim to punch holes into NATs such that they suddenly can send traffic to devices which was not possible before. (1) We assume a web-attacker who can control to which sites (TCP or UDP) an attacker can create connections to. (2) We assume a same broadcast-domain attacker who receives the same signals as the attack target, e.g., because they share the same WiFi or 5G cell. We plan to hand out two separate topics following these two threat models.

Finished Thesis Projects

 Efficient Software-Based Memory Tagging (Simran Kathpalia, MSc thesis supervised by Apostolos)
Memory tagging is a highly promising technique aimed at making it more difficult to exploit vulnerabilities commonly found in code written in unsafe programming languages such as C. Architectures like ARM and SPARC implement it directly in hardware as an extension. There is no equivalent support in the x86 architecture, which has led researchers to attempt integrating it via software (e.g., here or here). However, this introduces significant runtime overheads, raising doubts about the practicality of the approach. This thesis aims to answer: (i) Why is it so difficult (in terms of overhead) to implement memory tagging in software? (ii) If implemented in software, is it really necessary to tag everything? (iii) Can we eliminate the overhead by combining other mitigations and carefully selecting what to tag? (iv) If so, how can we define the "crucial pointers" that need to be tagged?
 Identifying Cloud Spoofing Capabilities (Timo Wevelsiep, BSc thesis supervised by Eric)
Cloud providers should not allow one cloud tenant (VM) to spoof the address of another cloud tenant for outgoing communication. This thesis project studies if major public cloud providers actually forbid IP address spoofing across VMs within the same or different data centers.
 Cryptography Made Interactive: Development and Educational Evaluation of Learning Tools (Safa Aydin, BSc thesis)
This thesis project will explore methods to create interactive learning materials for the topic of cryptography.
 Website Fingerprinting on Starlink Traffic (Daniel Foelsch, BSc thesis)
Starlink as LEO satellite network providing Internet access to citizen and companies alike. Website fingerprinting is an attack technique to infer from encrypted traffic what website a target user visits. A workshop paper from 2024 [1] shows that fingerprinting can also be done on Starlink traffic, as long as the traffic is routed through Tor. Can similar attacks be performed without tunneling Starlink traffic through Tor (i.e., in the "normal" setting)? This thesis should explore this question, and also take into account potential effects of weather on Starlink communication.
 CGNAT Port Congestion DoS Attack (Anastasiia Rudakova, BSc thesis)
Carrier-Grade NAT (CGNAT) reserves dedicated (external) port ranges for each customer. E.g., Alice gets external ports 1024-2047, Bob gets 2048-3071, etc. This offers strong isolation guarantees across customers. At the same time, it limits the number of connections a client can open towards a certain destination. This thesis should explore if a web attacker can exhaust the number of connections (e.g., 1024 connections with reference to the example). The web attacker controls a website the target visits, which, e.g., could inject several Google-hosted resources; the attack target would fetch these resources in separate connections. Unfortunately, for a given destionation IP address (e.g., Google's), a web attacker can thus create many new connections, which exhausts more and more these available ports. This thesis topic should explore if this attack idea is practical, i.e., if it is possible to exhaust more than just a handful of external ports.
 Using Gamification to Improve Cybersecurity Awareness for German Citizens (Sophie Lages, BSc thesis)
Can we leverage game-based learning to improve awareness about cybersecurity for German citizens? Answering this question is subject to this BSc thesis project, in which the student performs a survey and based on that delevelops a browser-based game to illustrate typical cyber attack scenarios.
 Security Analysis of MQTT Services on the Internet (Hao-Yi Andy Chen, BSc thesis)
An "open" MQTT broker accepts connections from any client, which publish contents over a topic, and other clients subscribe to this topic will in turn get this content. According to Shadowserver, there are around 490k MQTT broker in IPv4, and 360k "open" brokers that accept anonymous logins (without requiring user-id or password). In pratice, many of such open MQTT brokers may use access control to limit the access to some particular topic, or give the user read-only permission. Having said this, the openness of such brokers and the implied security implications has never been studied, which is topic of this thesis. This thesis explores ways to learn how many topics exist, and how they are protected by access control. For unprotected topics, we study if there is any clients publishing content (potential data leaks) in a privacy-preserving fashion.
 Automated Amplification DDoS Scanner Identification for AmpPot (Jorrit Feldkemper, BSc thesis)
AmpPot is our amplification DDoS honeypot that helps us attributing scanners to otherwise-anonymous attack sources. Right now, we use simple heuristics to differentiate scanners from attack targets, such as traffic statistics. In this thesis, you explore if IP telescopes (i.e., routed but unused IP address ranges) can be used to identify scanners as such and if/how this can be coupled with AmpPot.
 Automated Protocol Extension for AmpPot (Christofer Reppenhorst, BSc thesis)
AmpPot is our amplification DDoS honeypot that helps us attributing scanners to otherwise-anonymous attack sources. AmpPot emulates a small number of protocols in a very limited fashion, and thereby misses both new amplification protocols as well as new amplification vectors for known protocols. In this project, students should explore automated ways to extend the protocols and supported message type for AmpPot. The core idea is to leverage attacker-originating scan requests observed at AmpPot (i.e., requests for currently-unsupported protocols/messages) to extend AmpPot's feature support in an automated manner.
 Machine Learning-driven OSINT Analysis Framework for Cybersecurity Threat Detection (Niclas Gritzan, BSc thesis)
Cyber Threat Detection's main goal is to identify potential threats before they can impact an organization. The thesis will involve the design, implementation, and evaluation of a framework that tackles this problem. The approach is to leverage Machine Learning techniques to analyze OSINT data from diverse sources such as websites, databases, and logs. The evaluation aims to demonstrate its effectiveness in improving cybersecurity by automatizing repetitive and time-consuming tasks carried out by malware analysts.
 Side Channel Resistant ML Classifiers via In-Memory Processing (Fabian van Rissenbeck, BSc thesis)
RAM with in-memory processing (PIM) allows computing workloads to be shipped directly to where data is stored. Instead of involving a CPU, PIM bars leverage a data processing unit (DPU) to perform computation tasks directly on the memory. PIM mitigates the bottleneck of large data transfers on the system bus. At the same time, PIM also avoids shared resources (such as CPU caches) that are susceptible to side-channel attacks. In this thesis, the student should implement popular ML classifiers (e.g., decision trees) on PIMs and measure/study if this mitigates side-channel attacks. Concretely, the student will work on the UPMEM PIM architecture, leveraging an existing SDK that supports C, Python, and Rust.
 Fuzzing for Application-Layer Loop Vulnerabilities (Jonathan Flueren, BSc thesis)
Application-layer loops are a new (IEEE S&P 2024, May 2024, Pan and Rossow) Denial-of-Service attack vector that can be abused for link-flood attacks. Existing work laid the foundation for such attacks, observing that they are possible in principle for a few UDP-based protocols. In this BSc project, we will use fuzzing to systematically find loop vectors in contemporary network protocols.
 Hardware-agnostic Website Fingerprinting with an Unprivileged Android App (Erik Schmidt, BSc thesis)
Typical website fingerprinting assume an on-path adversary that can extract traffic characteristics from TLS communication to infer which website a user visits. We want to explore if Linux/Android non-privileged users can achieve the same attack by just relying on per-NIC traffic statistics (e.g., from /proc/net/dev). That is, instead of being able to see each and every packet, the app would spy on global packet/byte counters to infer the traffic profile of other apps. The goal of this thesis is to show that this attack is possible even if the training and testing datasets stem from different hardware. That is, the thesis should study if models generalize from one Android device to the next, and if not, how this can be fixed (e.g., using augmentation).
 Minimalistic ML-Based Evasive DGA Models (Maximilian Obrebski, BSc thesis)
Bots can use Domain Generation Algorithms (DGAs) to resolve precomputed domains for their C2 servers. As simple DGAs are prone to network-based detection due to characteristic patterns, researchers discovered that ML-based alternatives can bypass detection [1]. However, they leverage ML models that are huge (in the megabytes range), which is impractical. This thesis should explore if one could generate ML-based DGAs with similar evasion capabilities that however have a much smaller code base (kB range).
 BGP Route Origin Validation: Analyzing the Impact of Compromised Infrastructure Components (Armin Peukert, BSc thesis)
This thesis analyzes the security risks of a compromised RPKI/ROV caches.
 Practical Implications of TCP Spoofing (Simon Engmann, BSc thesis)
This thesis analyzes the severity of popular network services with respect to spoofed TCP connections.
 Malware Classication Using Frequent Itemset Mining on Static and Dynamic Features (Lars Richter, BSc thesis)
In this project, we aim to apply frequent itemset mining to detect Windows malware based on static features.
 Exploring Anycast Infrastructures (Ege Girit, BSc thesis)
In this project, we aim to find all anycast locations of a given BGP-based IPv4 anycast address.
 Security Analysis of Open LoRaWAN Networks (Marcel Leuering, BSc thesis)
This thesis explores the security of LoraWAN-based networks such as TTN.
 Timing Side Channels in the Linux TCP/IP Stack (Marcel Kühn, BSc thesis)
This thesis tries to find, exploit and mitigate timing side channels in Linux's TCP/IP stack.
 Network-based Fuzzing: A Look into the Security of Bots and Malware (Daniel Kilimnik, BSc thesis)
This thesis aims to find vulnerabilities in malware network handling using fuzzing.
 Automatic Exploitation of Vulnerable ERC20 Contracts (Tristan Hermanns, BSc thesis)
This projects extends teEther with capabilities for ERC20 (tokens) support.
 Techniques for DNS-based User Tracking (Florian Wellner, BSc thesis)
This thesis searches for alternativ ways to track Web users using DNS caching.
 Identifying Cryptojacking Malware in Sandnet (Mara Schulze, BSc thesis)

This thesis is concerned with finding cryptojacking malware in the dynamic analysis platform Sandnet, primarily using network behaviors, but potentially expanding to host-level behavioral observations.
 Fuzzing Microarchitectural Side Channels (Daniel Weber, BSc thesis)
 Remote Timing for Architectural Side Channels in Browsers (Daniel Weber, CySec project)
This project will explore the possible timing sources in modern browsers that can be used for side-channel attacks. As an aftermath of recent Spectre-like vulnerabilities, browsers intentionally make their timing sources (e.g., performance.now) less precise; thus, making it harder for attackers to measure the timing differences, e.g., between cached/uncached memory accesses. This project will use network communication as an alternative source for timing information. The outcome of this project will be (i) showing that the network communication is not stable/reliable timing source, or (ii) showing that network packets can be used to measure subtle timing differences for microarchitectural attacks. Further reading: [NetSpectre]

 Empirical Study of the Sality P2P Botnet Ecosystem (Sebastian Walla, MSc)
 Inter-Contract Analysis of Ethereum Smart Contracts (Roman Tabachnikov, BSc thesis)
This project will extend teEther, a static analysis and vulnerability detection tool for Ethereum smart contracts, to model interaction between multiple contracts. This will allow teEther to find vulnerabilities like the Parity wallet vulnerability, wherein a faulty default selector in a frontend contract allowed to call an initialization routine in a backend contract. Furthermore, contract interaction modelling may also be used to detect reentrancy vulnerabilities, a common class of smart contract vulnerabilities currently not supported by teEther. Further reading: [teEther]

 Denial of Service Attacks Against Streaming Protocols (Yassir Kozha, BSc thesis)
Online media streaming services are ubiquitous: NetFlix, YouTube or almost all TV channels, to name but a few. There are various streaming protocol implementations out there. Most popular is DASH, an HTTP-based streaming protocol using commodity web servers. Others, like T-Entertain, use UDP/RTP, and also Google's proposal for QUIC (HTTP over UDP) may be used for streaming. Finally, researchers have also proposed alternative streaming protocols. While the protocols are optimized for the normal benign setting, it is unknown if and how an attacker can degrade the performance of these streaming protocols using novel denial-of-service techniques. This project aims to close this gap by studying the streaming protocols in detail. Further reading: [1] [2] [3]

 Identifying Network Tarpits in Malware (Sebastian Walla, BSc thesis, 09/2018)
 Analysis of Linux-based Malware (Janosch Gräf, BSc thesis, 07/2018)
 Cross-Architecture Binary Comparison (Alexandro Sanchez Bach, MSc thesis, 09/2017)
 Large-scale Analysis of Online Ads (Pascal Dupre, BSc thesis, 07/2017)
The use of malicious ads on the Web is alarmingly increasing. Criminals use malicious JavaScript to perform a number criminal activities including DDoS attacks or malware distribution campaigns. To date, little is known about the features these malicious ads can rely on, e.g., APIs, execution time, etc. --- This project aims at filling this gap and we are looking for a student willing to undertake a large-scale analysis of online ads and distribution networks. Further reading: [1] [2]

 Analysis of Core Internet Service Operators (Andrey Chernov, MSc thesis, 05/2017)
The Internet is built on top of a number of core network services, e.g., IP routing, DNS, or email exchange, which are offered by private and governmental organizations. Recent events showed these organization may, intentionally or unintentionally, be part of large-scale malicious activities including state-sponsored cyber espionage. We are seeking for a BSc/MSc student to undertake a large-scale study of the basic Internet services with the goal to answer the following questions: Which core organizations 'run' the Internet? What parties can influence/inspect typical electronic communication (such as email)?

 New Server-Side Request Forgery Attacks (Sebastian Becking, BSc thesis, 04/2017)
Server-side request forgery is an emerging family of attacks in which an attacker can generate HTTP requests from a vulnerable server. In the past, these attacks were used to exploit vulnerabilities in private servers or to exfiltrate password files from local disks. Despite anecdotal evidence, it is unclear the size of this new threats. The goal of this project is to study this new threat considering other possible exploitation including code injection and data amplification.

 IoT Malware Analysis (Alexandro Sanchez Bach, Practicum, 03/2017)
 Online Banking Integrity Countering Web Injects (Ferdinand Jost, BSc thesis, 03/2017)
Banking trojans use browser hooking in order to manipulate banking sessions of users. For each banking website, the attackers create banking-specific web injects that are targeted towards the structure and layout of a banking site and help to manipulate the site. The attackers use such manipulations for phishing attacks, or to subvert the banking transactions of online banking users (e.g., manipulating the destination account of a wire tranfer). The goal of this project should be to analyze if the bank can inject integrity-checking code into the banking web site, which -- without the need for additional software -- ensure that user-entered data is not tampered with on the way to the bank. Further reading: [1]

 Scambait - A Fully Automated Scam Baiting Tool (Dominic Deuber, MSc thesis, 03/2017)
 Performance Evaluation of Software Hardening Techniques (Markus Bauer, gradschool project, 10/2016)
 Security of Hardened Web Browsers (Christian Faber, BSc thesis, 10/2016)
 Code Patterns Extraction for Client-side JavaScript Web Applications (Lukas Subel, MSc thesis, 06/2016)
JavaScript is an event-driven and language used in the client side of web applications. While Javascript enables the creation of dynamic and interactive interfaces, at the same time, it makes it hard for web scanners to explore attack surface and test for vulnerabilities. The goal of this thesis is to study common patterns used by JavaScript programs focusing on UI events, network operations, and event dependencies.

 Time-to-Live Based Attribution (Jonas Bushart, BSc thesis, 05/2016)
 Extracting and Modeling Typosquatting Errors from Large-scale Passive DNS Data (Frederic Endner-Duehr, MSc thesis, 05/2016)
Typosquatting is the phenomenon of users with fat fingers entering wrong domain names accidentally (e.g., googke.com). Dozens of papers deal with typosquatting: describing the techniques, analyzing how attackers register and abuse typosquatting domains, or detecting typosquatting domains. However, it is unclear how prevalent typosquatting actually is. The goal of this project will be to analyze how many victims actually visit typosquatting domains. The student will analyze Passive DNS data and register promising typosquatting domains. During the analysis phase, the thesis will measure and evaluate the behavior of users once they visit the "wrong" domain.

 Exhaustive Search for ROP Gadgets (Xiaofan Zhang, MSc thesis, 08/2015)
ROP persists to be one of the primary techniques for software exploitation. To ease the process of creating ROP exploits, tools like Q and Mona automate the search for ROP gadgets. However, these tools are limited, as they ignore semantics of instructions or their side effects. We propose ROOPZ33, a novel semantic-based tool to exhaustively find ROP gadgets. We introduce a new search algorithm and use the SMT solver Z3 to explore and verify gadget candidates. With the new algorithm, we outperform existing gadget finders. We demonstrate this by revealing ROP chains for binaries that are secured by Orp (IEEE S&P 2012), thus evading a popular approach destroying ROP gadgets.

 Detecting Hardware-Assisted Virtualized Systems (Michael Brengel, MSc thesis, 09/2015)
Virtualization has become an inevitable technique to scale up the analysis of malicious code, such as for malware analysis or shellcode detection systems. Frameworks like Ether, ShellOS, and an ever-increasing number of commercially-operated malware sandboxes rely on hardware-assisted virtualization. A core technology is Intel's VT-x, which - compared to software-emulated virtulization - is believed to be stealthier, especially against evasive attackers that aim to detect virtualized systems to hide the malicious behavior of their code.
In this thesis, we propose and evaluate low-level timing-based mechanisms to detect hardware-virtualized systems. We build upon the observation that an adversary can in- voke hypervisors and trigger context switches that are noticeable both in timing and their side-effects on caching. We have locally trained and then tested our detection methodology on a wide variety of systems, including 240 PlanetLab nodes, showing a high detection accuracy. As a real-world evaluation, we detected the virtualization technology of more than 30 malware sandboxes. Finally, we demonstrate how an adversary may even use these detections to evade multi-path exploration systems that aim to explore the full behavior of a binary. Our results show that VT-x is not sufficiently stealthy for reliable analysis of malicious code.

 Attack Surfaces of Mobile Banking Apps (Fabian Schwarz, BSc thesis, 09/2015)
More on more people use banking apps to view and manage their banking accounts on their mobile device. It is unclear how these banking apps protect against potential attackers that manage to infiltrate the smartphone. Are you able to analyze the security of up-to-date banking apps? Which attack scenarios can you see once the mobile device is infiltrated, separating between non-root and root access? Further reading: [1]