As the first step in the process of writing a BSc/MSc thesis in my group, I usually ask you to sketch a thesis proposal before you start your actual project. While you may find this to be a burden at first, many years of experience have shown that this significantly helps students. This is why:
Let me emphasize that you will not be left alone in this exercises.
My group members and me will assist you in this process!
If you run into problems, have difficulties in setting priorities, or simply need a discussion partner, please reach out.
By no means this proposal is something that you fully have to solve completely on your own.
On the contrary, you may even be disappointed if you do, as it may require several adaptations if we see that our two views are not aligned yet.
It is important that we frequently communicate in this early phase of your project.
But do understand that it is your responsibility to drive this communication.
Your project, your baby, your duty.
We would like to give you some guidance on how to structure your thesis proposal. This is how your 4-6 page long thesis proposal can look like:
As simple as that. Put your name, the type of thesis (e.g., BSc Thesis), and a (preliminary) title.
You want to study if butterflies like the smell of block ciphers?
Great. This is the section in which you explain why this is important.
Introduce the reader to the domain that you're entering.
Do not show your solution for now, just show why the problem you'd like to work on is important.
In fact, try to convince the reader that the problem you'are about to (hopefully) solve is the most important thing of the world.
Don't overdo it of course, but readers should feel the relavance.
A few hints:
(i) You can assume general knowledge of Computer Scientists and standard security knowledge. No need to explain encryption, block ciphers, or buffer overflows.
Any technical details beyond standard knowledge should be briefly explained, or properely cited. In case of doubt, explain.
(ii) Do not present your solution here. This will go to a section much later ("Planned Methodology").
(iii) Similarly, do not go into much detail what others have done to solve this problem; this is part of the next section.
Show what others have done, and even more important, what has not been done.
I don't expect a list of 30 references that are marginally related to your work.
Rather, discuss 3-5 articles (peer-reviewed papers, theses, blog posts, ...) that are closest to your idea.
Briefly summarize (in a paragraph) what each article describes and does.
Then move on and discuss the limitations of this existing piece of science.
Convince readers that there is room for research on this topic still.
How to find related works? Use your favorite search engine.
For example, finding papers is easy using Google Scholar.
Once you have a good starting point, you should also check cross-references from and to papers that you already know.
Again, Google scholar can assist you here ("Cited by", "Similar Articles"), so does the article itself (see "Related Work").
A word of warning, though:
You will find many papers, even peer-reviewed, that are not necessarily good quality.
If you want to focus on well-known security conferences, you may want to look out for IEEE S&P, IEEE EuroS&P, USENIX Security, NDSS, ACM CCS, RAID, ACSAC, DIMVA or AsiaCCS.
Also some journals (e.g., ACM Transactions on Privacy and Security) or workshops (e.g., USENIX WOOT) are great.
Then again, there are plenty of unknown (seemingly) academic venues that contain half-baked ideas.
In case of doubt, please just ask.
Try to precisely phrase your problem here. Usually it helps to phrase 3-5 concrete research questions that you aim to study with your resarch. You may also want to formulate what you are not trying to solve. Also, it may help if you state your assumptions (e.g., "We assume that butterflies always fly and never sleep.") and a threat model / assumed attacker capabilities (e.g., "We assume that block ciphers cause transistors to emit electric radiation."). Do not forget to explain why these assumptions are realistic ("Indeed, as Darwin has observed [XYZ], butterflies have no eye lids and therefore do not sleep.")
You surely must have a general idea how to address the aforementioned problem statement. (If not, think of it now!)
Explain this idea here, and try to motivate why you think this can work.
List which tools and/or methodologies you plan to follow, and argue why you think they are promising.
Discuss potential alternatives.
Also brainstorm on risks on your way to success, and how you may mitigate them.
If you perform offensive research or study humans, you should also discuss ethics here.
Don't be afraid that you have to follow exactly what you mention this this section in the end.
Rather, see this as a good starting point to chose the best alternative.
Be prepared to argue why certain things turned out as bad options, though.
Finally, a short list of guidelines that I'll enforce:
© System Security at CISPA