How to solve problems in state-of-the-art work with introductory knowledge

Question

Edit: I consulted with the professor regarding this matter today. (The reason why I didn't ask before posting the question was because I feared I might have lacked some understanding --- I mentioned I heard very few fellow students expressing the same concern)

She confirmed that even if a result was not quite successful at length, a group of students can still be deemed as having satisfied the assignment's requirements, so long as the students have tried to apply the knowledge in a state-of-the-art problem, which is proven by the report as well as the prototype submitted.

---

I am having an introductory taught module in Computer Systems Security in my last year as an undergraduate student. To clarify, its name or module handbook does not say it is introductory, but it has been arranged as the first module dedicated to Computer Systems Security in my major. It is a taught module because we have lectures and labs, and a final exam.

In a group assignment of this module, the professor has tasked us with

In this group project, students are required to do a project related to computer systems security. They have to choose a topic and then study the state-of-the-art work done related to that topic. Identify the shortcoming of the existing work and propose an enhanced security solution using technologies learnt in this module. In particular, each group should

1. Realize a prototype and elaborate the complexity of implementation;
2. Write a report in IEEE conference paper style A4 ...

, which in my understanding requires us to use the introductory knowledge taught to solve state-of-the-art problems (although we only need to propose and realize a prototype, and not need to evaluate and verify our solution).

This is too difficult in my opinion, but very few fellow students expressed similar concerns with me, so I haven't been confident enough to consult the professor with my concern. In addition, I learnt that the assignment of this module in the previous academic year has been effectively the same.

I do have some tentative ideas on how to do this:

1. read some state-of-the-art papers, and according to their Limitations, Related Works and similar sections, just paraphrase their description of the problems of their work
2. then, because the knowledge taught in the module is quite broad, just apply some related concepts anyway without describing the details (because I am not able to), and conjure a prototype based on that without knowing exactly if it's right or wrong.

However, this approach feels like academic dishonesty to me. Nevertheless, since the past year's assignment tasked the same requirements and I haven't heard of complaints from past students, I believe at least most students must have had an idea that I have not thought of. Therefore, I want to ask if there's any way to complete this assignment correctly without using something that is not so genuine like that idea of mine, given the background that I have described.

In particular, any idea for this would be very helpful to me:

• how to find state-of-the-art problems that can be truly solved with only such introductory knowledge.

Answer 1

The short answer is: "You don't". But maybe you get lucky - extremely lucky. Unless a field is extremely new, with few practitioners, those with experience have almost certainly covered all the ground that can be covered with only elementary knowledge.

But, you need to start somewhere, and the place to start is to examine what is already known (state of the art) and then make speculations or hypotheses about solutions and extensions. Many (probably most) of those will be untenable, but it is still part of the process.

Insight into a field is gained from practice. Once attained that insight can make it more likely that your hypotheticals have some merit. But you need the insight and therefore the practice.

I think your exercise is to get you to think in this way and make some hypothesis and then use what is known to examine it critically.

This isn't special to CS, by the way. Many fields use this process to come to things that might be true or are likely to be true (requiring insight) and then gathering the evidence that proves them right or wrong.

I think the professor's expectations about what you can actually accomplish are low and they are more interested in how you attack the problem. Do so honestly and critically. How is some hypothesis supported or not supported by the evidence? Make the "proposed solution" reasonable and then examine it critically.

Answer 2

Therefore, I want to ask if there's any way to complete this assignment correctly without using something that is not so genuine like that idea of mine, given the background that I have described.

The way the assignment is worded, I think this is very possible.

To begin with, I think the word "solution" in the assignment should be understood in the context of "security solution", i.e. a solution to the general problem of securing something. By my interpretation, you are not expected to identify and solve any specific open problem in a state-of-the-art system. I think your project would fulfil the assignment if you produce a prototype system which does not have that problem, even if it has other problems which the state-of-the-art system doesn't.

After that, even identifying shortcomings of state-of-the-art systems in cyber security does not necessarily require advanced knowledge of cyber security. A shortcoming doesn't have to be some technical vulnerability that requires a specially-crafted network packet to exploit. Consider remote authentication: the state of the art is to log in using a password, and add an optional extra authentication factor such as receiving a one-time code by SMS. This system has many shortcomings:

• Users choose passwords which are weak and/or guessable.
• Users write down their passwords, or share them with other people.
• Users are vulnerable to keyloggers or other malware which can steal passwords.
• Users forget their passwords.
• Users don't enable the second factor.
• One-time codes received by SMS are vulnerable to SIM jacking, where the attacker tricks or bribes the phone company into transferring the victim's phone number.
• One-time codes are still vulnerable to real-time phishing attacks.

Notably I didn't have to read any state-of-the-art research to think of any of these shortcomings. The state of the art in cyber security is generally that we have systems that are good enough most of the time, not systems that are perfect as far as we know.

And these shortcomings aren't even things we don't know how to address; all can be addressed by known means (e.g. password policies, mandatory 2FA, FIDO hardware keys). The reason these alternatives aren't widely used is because they introduce other shortcomings (e.g. user dissatisfaction, cost).

Security is all about trade-offs. By my reading, your assignment is fulfilled if you identify one issue with an existing system, and build a prototype for a system where you trade that issue off for a different one; your system doesn't have to be better overall in any measurable way. This can definitely be done with only introductory knowledge of security.

All of that said, since you are unsure and I'm not your professor, the best thing to do is approach your professor and ask for clarification. If you have an idea along the lines I outlined above, check with your professor whether your proposed project would meet the requirements.

Answer 3

I think that your confusion is just a misunderstanding of the sequence of tasks that they are asking for. From reading the part of the assignment you posted, I would paraphrase it in steps as:

1) Come up with a security solution of some sort, solution here meaning a mock product or piece of software. The topic of the solution, or software product, must be related to the security of a computer system.

Some examples might be:

• Program to store passwords securely.
• Code to detect if a request to a web server is from Googlebot or not.
• Web browser program that saves absolutely no files to disk, so there are no clues to it being used or what sites it visited.
• A program that sends or shows an alert if a certain file is changed.
• Any computer security product on the market that you can make a simplified version of. I looked on Amazon and just typed in 'computer security product' and the first result was a glue-on padlock, so maybe it could even be a physical security solution like that which you could make a prototype of.

2) After building your solution, or product prototype, you will then study what is being done related to it that is state of the art, or the most advanced version of what your product is and what new or novel solutions to the problem that your solution/product solves are being created. After studying what others on the cutting edge of that type of solution are doing, see if you can identify a shortcoming or flaw in your design that is addressed by others on the cutting-edge of that same type of solution or design, maybe something extra that they secure against that you had not initially thought of when making your prototype.

3) With your prototype and your list of potential flaws in your solution, or the weak spots of your security solution that could be improved, see if you can apply the things you are learning in the class to those weak spots or shortcomings in your solution and use what you have learned to improve upon them, and write a proposal of how the improvements to your solution might be implemented.

I hope that makes more sense, I understand how the particulars of the grammar can be kind of critical when you are deciding whether to commit to a class or not so it is natural to want to know the precise specifics of the project requirements, but from what I can see I think what they are basically saying is that you will be creating some type of security solution, and then through what you learn in the class and from studying the topic of your solution identify something that can be improved, and then write a proposal describing how that improvement might be implemented.