Cybersecurity is an important part of a balanced breakfast for all Khoury students. But for eight students in particular, it’s a passion that’s driven them to excel at a national level — again, and again, and again.  

Northeastern University’s Collegiate Cyber Defense Competition Team (NUCCDC) recently returned from their third consecutive trip to the National Collegiate Cyber Defense Competition, with a seventh-place distinction to add to their third straight regional gold. While the team’s members credit CCDC with helping them to develop everything from technical capabilities to leadership skills and career opportunities, what sets NUCCDC apart is the quality of its community.  

Collegiate cyber defense is a circuit of competitions in which teams of up to eight cybersecurity students defend a corporate-style computer network from cyber attacks while maintaining its functionality. Teams are given networks that mirror real-world environments, then spend two days trying to protect their network against industry professional “red team” hackers — all while fielding customer calls and answering questions from “executives” as an IT department would.  

NUCCDC’s co-captain, fourth-year cybersecurity and economics major Federico Cassano, put it even more simply: It’s like two days of running a corporate network that’s being attacked by a national state hacker. 

READ: Federico Cassano teaches AI models to correct their own mistakes 

For March’s northeastern regional competition in New York City, NUCCDC was a hydroelectric company. They received infrastructure typical of a midsized business — including an HR portal, email server, and company website — as well as more application-specific tools like a dam control board and power monitor. 

“We were holding very strong through the second day until the last hour, when the red team managed to take down our entire network through a single vulnerability we didn’t even know existed,” said Charlie, a third-year computer engineering and computer science major. “Despite being almost completely locked out — we literally couldn’t reach a single one of our machines — we still fought, frantically looking up documentation and trying everything we could to reconnect.” 

Although the team didn’t regain control, they did find the root issue the hackers had exploited and wrote a detailed incident response. It was enough; NUCCDC took first place and advanced to the national competition in Texas.  

Nationals function a little differently than regionals. For one thing, teams work with much older equipment than at regionals, mirroring most real-world corporate cybersecurity environments. For another, they had some sense of what they were in for at regionals; at nationals, the equipment and environment are kept secret until about 20 minutes before the competition. This year, they were tasked with performing the role of an HR service provider and given — among other machines — an unconfigured Palo Alto-brand firewall. 

“We plug in all the machines, and the network doesn’t work, so we need the old network up immediately,” Cassano explained. “We plug everything back into the original switch and the switch is not giving the IPs anymore. We were stuck!” 

Because the firewall wasn’t working, their network was vulnerable to attacks by the red team hackers. But the team would not only be scored on the security of their machines; they had to maintain the secure functioning of their services, too. The process of unplugging from their original switch and rerouting through the malfunctioning firewall interrupted the flow of data through their network, causing the company’s “customers” to no longer have access to its HR services. The clock was running, and NUCCDC was losing points.  

Even with support from Palo Alto employees who were at the competition recruiting, it took about two hours of mapping out the network, digging through mountains of documentation, re-configuring equipment, and carefully scanning for abnormalities to get the network up and running again. 

“They did a fantastic job improvising in a very difficult situation and recovering even though it seemed like all of the odds were against them,” said NUCCDC alum-turned-coach Simon Bruklich. “I think that’s what we do best — just staying cool under pressure.”  

The @Northeastern team is a well-oiled machine, collaborating seamlessly to defend against the @CCDCRedTeam. #teamwork #CyberDefense #NCCDC pic.twitter.com/45PikvZ50p

— National CCDC (@NationalCCDC) April 25, 2024

The time lost to fixing the firewall dropped the team to seventh place in a field of ten, but the chance for gold is only one of the reasons that NUCCDC team members care about their sport. 

“Prior to joining the team, I had absolutely zero experience with the Windows operating system, besides basic browsing and use cases,” said co-captain and fourth-year cybersecurity major Ali Bobi. “After my two years of competing, I have acquired the skills that could easily allow me to become a professional sysadmin. I know how to harden Windows domain controllers, configure GPO, and work with Active Directory.” 

“Incident response is one of those skills that this competition is really good for; we don’t learn it in school or even on co-op because it’s typically reserved for security management to make these decisions,” Bruklich added. “It’s sort of like professional sports; you wouldn’t put somebody who’s never played football into an NFL stadium and tell them ‘good luck.’ Practicing and having experience in the ‘minor leagues’ does a great job to prepare students for what they will face in industry.” 

CCDC helps its members to hone softer skills too.  

“The skills that I’ve built the most, almost entirely subconsciously, are delegation, leadership, and professionalism,” Charlie said. “This is a perspective that is very difficult to get in a classroom environment — there aren’t a lot of courses that give you 20 servers and tell you to get cracking!” 

Both hard and soft skills are important to make the most of the professional opportunities that competitive cyber defense offers. This year, SpaceX sponsored the national competition, and employers ranging from the NSA to Scale AI to Nightwing (formerly a business unit of Raytheon) to Palo Alto sent recruiters to scout up-and-coming talent. 

“It’s even better than a job fair because employers get to see your skills. Most of the job fairs, you give them your resume and that’s it; for these competitions, they often have you fill out a very specific form with CCDC in the title,” said Bruklich, who now works as a cyber systems exploitation researcher with MIT Lincoln Laboratory. “Our members and alumni are getting jobs at top companies like Microsoft and Google — I myself worked at Apple — and I attribute a lot of that to what I’ve learned in CCDC and at Khoury College.”  

For others, the joy of solving a tricky puzzle is motivation enough. 

“I’ve been doing cybersecurity competitions since high school. They’re just very fun, because it makes you think outside of the box,” Cassano said. “We don’t shout at each other or insult each other; even in the stressful moments, we realize this is just a game.”  

Whatever the members’ personal motivations, as a team, they are already thinking about how they can prepare for next year’s attempt at that elusive national gold.  

“What I think we do really well on a technical level is threat hunting — finding viruses and malware on a computer and getting rid of them. What I’d like to focus on more for next year is preventing those viruses and malware from getting on the computers in the first place,” Bruklich said. “If we’re not secure within two or three minutes, the red team hackers are already on our machines.” 

The team is always focused on developing their talent pipeline. New members typically spend a year as alternates before joining full-time; interested students at all levels can complete a take-home test exercise at the beginning of the fall semester. Multiple team members also recommended taking “Systems Security” with Kaan Onarlioglu to learn to think about cybersecurity at a high level.  

Just as critical as any classroom skill, though, is being a team player. Between weekly practices, late nights, and competition travels, NUCCDC members go from mock-coworkers to genuine friends who support one another’s challenges and celebrate each other’s wins.  

“In our group chats, our alumni keep in touch; they’re still very active. It’s not like once you leave the team, you’re just gone,” Bruklich said. “The sense of camaraderie, just seeing how close the team was, was really awesome.” 

Khoury professor Arjun Guha and doctoral student Yangtian Zi recently co-authored a research paper on generative AI and large language models (LLMs). The paper, titled “How Beginning Programmers and Code LLMs (Mis)read Each Other,” was featured at the ACM CHI conference in May.

READ: Khoury researchers showcase college-record 28 works at CHI 2024

Motivated by the spread of LLMs like ChatGPT and their own experience with model development, Guha and Zi worked alongside Wellesley College’s Sydney Nguyen and Carolyn Jane Anderson, as well as Oberlin College’s Hannah McLean Babe and Molly Feldman, to gather 120 students from their schools, all with limited coding experience. Through several 75-minute Zoom calls, the researchers attempted to teach the students to complete three coding exercises. But instead of writing code themselves, the students would instruct the AI models to write it.

“If ChatGPT or other generative AI models can write code, then programming is going to be obsolete eventually,” Zi says. “But this is not really the case, because there’s a higher level of difficulty in learning how to code.”

“As I was using this technology when it first came out, I was heavily relying on my technical vocabulary,” Guha adds. “So, I thought that these wild claims that now anyone can write code were probably bunk, and I sort of set out to disprove them.”

When determining what types of problems would be asked of the students, tasks were selected from previously used assignments and exams.

“We know that students can do [these tasks] themselves; they can write the code directly because they’ve completed the class successfully,” Guha adds. “But when we asked [the students in our study] to not write the code directly, but to tell the model in English to write the code for them, they had a really hard time doing it successfully.”

This was because the students lacked coding experience; namely, they were unfamiliar with Python syntax and coding terminology, and thus couldn’t accurately describe the problems to the AI models.

“People still sometimes give detailed explanations, but it’s still incorrect,” Zi says. “This leads to students entering the prompt in a way that misleads the AI to generate code that is not intended for the problem.”

Part of the project’s mission was to empower students with tools to help them succeed in coding, especially for students already at a disadvantage due to a gap in resources.

“’We’ve put a lot of effort in nationally, but also here [at Khoury College], to close the gaps that emerge in our lower-level classes,” Guha says. “With a little bit of extra experience, you can use this technology effectively. However, if first-generation college students have a harder time using this technology or don’t understand how to leverage it, that’s not good for the gaps that we’re trying to close.”

So in short, these models are not rendering coding instruction, or computing education as a whole, obsolete. The team emphasized that having some technical knowledge was important to completing these coding tasks, with AI merely serving as a helpful launching point. Zi adds that students who are unfamiliar with Python syntax and terminology would likely find it especially difficult to ask the models specific questions.

“Understanding the concept of programming is still very important even in this age of generative AI,” Zi says.

But despite the challenges they pose for inexperienced coders, and despite the difficulty of using them properly without sufficient accompanying resources, the researchers say that the models can benefit users who understand coding principles, and that the LLMs have been a positive advancement overall.

“They can do a lot of good,” Guha says. “And we’re trying to make them better.”

More than two dozen Khoury College undergraduate students recently returned from an exciting adventure in Belgium, complete with data instruction, software solutions, and cultural exploration.

The Dialogue of Civilizations: Data & Software in International Government and Politics enabled students to engage with international policymakers and data scientists working in Brussels — the European Union’s administrative center — while earning credit toward their degrees and pursuing challenging, relevant academic work. Courses were taught by Khoury College teaching professors Eric Gerber and Mark Fontenot, as well as guest lecturers.

For rising second-year student Nalika Palayoor, who was primarily interested in the life sciences before college, such a program wasn’t an obvious choice a couple of years ago. She decided to attend Northeastern based partly on an info session held by Khoury faculty member Laney Strange, who, Palayoor says, “made me feel like I could potentially do data science.”

She tried a data science class this past year, ended up enjoying it, and declared a combined major in data science and biochemistry. Palayoor has also involved herself with Women’s Community of Code, a Strange-advised group which has helped Palayoor feel included and welcomed in computer science — and allowed her to give back.

“We host coding workshops for girls and women in the community that haven’t had experience with coding,” she says. “It’s amazing to show them that they can do this too.”

Palayoor found a similarly supportive community on the Belgium Dialogue.

“I built a good relationship with the professors and connected with students beyond just the people that I got to know during my first year,” she says.

Students were based just outside of Brussels in Leuven, which dates to the ninth century. They stayed in picturesque dormitories at the Irish College, a historic institution founded in 1607 and surrounded by cobblestone roads and medieval architecture. The group also embarked on a weekend trip to the tiny country of Luxembourg.

For fellow rising Khoury second-year Bobby Palazzi, the opportunity to go on a Dialogue was part of his initial interest in Northeastern.

“One of the people that I talked to before I came to Northeastern mentioned that they were going on a Dialogue in the Middle East,” he remembers. “I saw pictures of them at the pyramids and it seemed like an awesome experience.”

While in Belgium, Palazzi explored all that Brussels had to offer, including a concert and myriad other cultural activities.

“It’s so fun to explore the city on [Lime] scooters and it’s really cheap,” he says.

Palayoor mentions a trip to NATO’s headquarters in Brussels as a highlight, as well as learning to make pastries at a French pastry shop.

While on the trip, data science majors took “Foundations of Data Science,” in which they worked on subjects ranging from tensors and applied linear algebra in standard numerical computing libraries to data science tools such as Jupyter Notebooks. Computer science majors took “Database Design,” which focuses on relational database management system use cases. Students in a combined track of both majors completed “Special Topics in Data Driven Application Development,” a project-based course where student teams sourced data, created minimally viable product software solutions, and implemented those MVPs in a software stack.

Palazzi worked with a small team of fellow students to create an app that invited users to indicate their preferences for weather, public transit, education, and more, then used those preferences to match users with the countries they’d most enjoy living in. The app even connects them with moving companies.

Palayoor’s project was a travel app which allows travelers to input data — including travel dates, destination, origin, and other preferences — then feeds these data points into a regression model that predicts flight and hotel costs. Artificial intelligence and data regulation, both particularly keen interests of hers, played a role in the app.

“It’s definitely going to have a big impact on my future years here at Northeastern,” Palayoor says of the experience. “I made some really close friends in Belgium. I also feel like I came out of this trip a much more confident data science student … I think getting to know the professors better and getting to know a close group of students made me feel like in the future, I can connect with more professors and students beyond the people I got to know during my first year of college.”

Palazzi concurs.

“The best part of this Dialogue was the relationships that I made, because obviously I got close with all of the students I was with, but also with both of the professors,” he says, recalling the time he and his peers stayed up late to watch the Celtics win the NBA Finals on a projector — all while they worked on their Dialogue projects. “The Dialogue was one of the best experiences I’ve ever had. And it goes so quickly, so take advantage of it.”

---