Ask HN: Looking for Research Ideas in Cybersecurity (Graduate Student)

1 hogexmox 4 7/23/2025, 4:45:16 AM
Hi HN,

I'm a graduate student currently looking for a research topic in cybersecurity. I'm especially interested in analyzing source code to predict or detect vulnerabilities, but I've hit a bit of a wall and could use some fresh ideas.

If you know of any interesting or socially impactful problems—whether technical, theoretical, or policy-related—I'd really appreciate your suggestions. Anything is welcome. Thanks!

Comments (4)

jonahbenton · 11h ago
You don't mention what wall you ran into looking at source for vulnerabilities, but- with the rapid rise of LLM generated source code, at the file, module and whole repo via agents level, a systematic analysis of vulnerabilities commonly introduced by such models, of prompt types that introduce more or fewer vulnerabilities, of agentic patterns that detect vulnerabilities, etc etc- this is a HUGE space that seems nearly completely unexplored.
hogexmox · 11h ago
The main challenge I’ve faced is that my direction has felt vague, and honestly, I’ve lost sight of what kind of research is truly needed in this area right now.

My long-term goal is to develop a way to measure how secure a given software library or component is—essentially, to help developers assess the safety of a library before deciding to use it. Traditional vulnerability scanning hasn't been effective at uncovering unknown vulnerabilities in this context, so I’ve been exploring predictive approaches instead. In other words, I want to analyze code characteristics to estimate the likelihood of future vulnerabilities or assess the current security risk.

There are already many machine learning–based approaches for this kind of analysis, but I find myself unsure of what exactly should be done next. With the rapid advancement of LLMs, I also feel that LLM-based methods might soon overtake traditional machine learning approaches. But keeping up with LLMs is a challenge in itself, given how fast the field is evolving.

hogexmox · 11h ago
On the other hand, investigating the types of vulnerabilities that LLMs are likely to introduce does indeed seem like an unexplored area. That’s a great idea—thank you very much for the suggestion.
jonahbenton · 8h ago
Gotcha, yeah, hear you about the current state of vuln assessment. Many commercial vuln detect tools that work at the source level are very mature; the most critical recent issues have been supply chain- a trustworthy library suddenly becoming untrustworthy- and which could be scored (evaluating contributor behavior in the repo on top of the code itself). But google and other folks are all over oss supply chain security now, so it is more commercial/mature than research.

Going after LLM generated code will present the opposite problem- instead of "oh someone is doing this and someone is doing that and so and so is doing the other thing, what could I possibly do", you have "there is this problem and this other problem and that other other thing and no one is really paying attention to any of this, how can I pick just one thing to do." Still a tough problem but a better landscape for a researcher, looking for ways to contribute. Good luck.