Generative Security Application Engineering

Instructor: Wu-chang Feng
Class: EB 325, T 5:30pm-8:50pm
Office hours: time
Contact and discussion: TA:
Resources
Generative AI and Large Language Models (LLMs) are upending the practice of cybersecurity and have the potential to automate away many of the manual, time-consuming tasks in the field. This course explores the range of Generative AI systems that are available and examines their utility in a range of common cybersecurity tasks such as vulnerability discovery, reverse-engineering, threat intelligence analysis, code generation, command generation, configuration generation, phishing, and social engineering. Each week, students will utilize a variety of LLMs and LLM agents towards automatically addressing common problems in cybersecurity.

Schedule

Week Topic Assignments
1 Course overview, Accounts Setup, Using LLMs, Programming with LLMs Labs
2 LangChain Tour (Basics, Chains, RAG) Labs
3 LangChain Tour (Agents) Labs
4 MCP Labs
5 Securing generative applications Labs
6 Code generation Labs
7 Command and configuration generation Labs
8 Code summarization and reverse engineering Labs
9 Vulnerabilities and exploitation Labs
10 Threat intelligence, Social engineering Labs
Finals week Final project Due Thurs @ 11:59pm

Assignments

Labs and notebook
Lab assignments will be given each class covering the course material. You will perform each one, while maintaining a lab notebook in a Google Doc that documents your progress. The notebook should also include responses to prompts that are in bold in the labs. When screenshots are requested, they must include your OdinID within them. Notebooks should be exported as a PDF file and include a table of contents generated by Google Docs. Submission will be done via adding, committing and pushing the file to your private git repository. Use the following naming convention to submit your notebooks.
  • notebooks/Labs<week_number>.pdf e.g. notebooks/Labs1.pdf
The notebook will be graded based upon the following rubric:
  • Neatness and organization
  • Completeness
  • Inclusion of OdinID or project identifier in screenshots
Late submissions
Always turn in what you have done on-time. All late work submitted will have a 20% deduction. If you submit any late work, it will be graded at the end of the last week of class. Late work must be placed in the late directory in your GitLab repository and named according to the due week. Use the following naming convention for late work: late/LabsX.pdf. For example, a late addendum to Labs1.pdf should be submitted as late/Labs1.pdf. Late work will not be graded beyond the last week of class.

Homework screencasts
For certain weeks, you will practice building your own application that applies Generative AI towards solving a problem and perform a screencast walkthrough of it. Instructions and rubrics for each homework will be given as they are assigned.

Final project
Based on the course content, a final project will be assigned for you to build a more substantial application that applies LLMs and generative AI towards solving cybersecurity problems of your choosing. Details will be provided towards the end of the course.

Course objectives

  • Test modern generative AI models across tasks.
  • Program applications that utilize generative AI models.
  • Exploit generative AI applications and secure them from attack.
  • Apply generative AI towards solving problems in cybersecurity such as vulnerability discovery, reverse-engineering, threat intelligence analysis, code generation, command generation, configuration generation, phishing, and social engineering.
  • Utilize emerging research in AI to solve security problems.

Policies

Grading
Attendance 10%
Lab notebooks 30%
Homework screencasts 35%
Final project 25%
Attendance and in-class exercises
Attendance is graded and will be taken at the beginning of class. One absence is allowed with no deduction regardless of the reason. You do not need to notify the instructor. Participation in the Slack channel is encouraged. You are expected to follow this code of conduct when communicating.
Academic misconduct
  • Includes allowing another student to copy your work unless specifically allowed by the instructor.
  • Includes copying blocks of code from external sources without proper attribution
  • Results in a grade of 0 for the assignment or exam.
  • Results in the initiation of disciplinary action at the university level.