Maybe I could get more of these done with this.
I’ve seen several people talk about lacking ideas for research projects, often around DFIR or network security. Personally, I have the opposite problem: endless ideas for projects, often with the barest hint of a start, but not enough time to pursue them all. So I thought I’d publish a bit of a brain dump. I actually have made good progress on a few of these, and I have concrete plans around others (beyond just “wouldn’t it be cool if…”), but in any case I’d love to see other people pick them up and run with them.
If you do happen to get interested in any of the following, I wouldn’t mind a quick note to touch base to see about possibilities for collaboration or at least an acknowledgement in whatever you publish. Don’t interpret that as any sort of requirement, though; ideas have no value without execution, so all the hard work hasn’t even begun.
- Malware
- Classification across a large corpus
- Automated IOC extraction and publication
- Threat Actors
- Profiling systems, particularly based on OSINT
- Underanalyzed crime groups (e.g. drug cartels involvement in malware, spam, and fraud)
- Hacktivism motivations and methods
- Passwords
- Cracking lab setups
- Useful entropy calculations
- Quantitative analysis of incidents
- DDOS attacks (hard to get numbers on these)
- Defacements and low-level leaks
- Active Defense
- Honeypots and honeyclients
- Vocabulary or taxonomy on various methods
- Callback Trojans in documents
- C2 / RAT vulnerability research
