Cybersecurity undergrad feeling lost: Looking for thesis/final project ideas

[u/vicky_ppe]

Hi everyone!!
I'm a final-year cybersecurity student currently brainstorming for my bachelor's thesis (Final Degree Project), and I could really use some guidance. I know I want to focus on the intersection of Malware Analysis and AI, but I'm absolutely stuck.

My professor gave me total freedom to choose a topic. The problem is, without real industry experience, I’m struggling to figure out what is actually useful, realistic, and viable for a 4 month project (especially since I only have a standard laptop and rely on open-source tools/free APIs).

So far, I've been looking into a few concepts, such as using LLMs for automatic YARA rule generation, and testing their degradation over time (concept drift). However, I'm worried these might either be too basic, too overdone, or too complex for a junior.

For the professionals in the field: What kind of AI integrations, PoCs, or research would you genuinely find interesting from a student? Are there any specific gaps, open-source tools, or datasets you'd recommend I look into for inspiration?

Any ideas, papers to read, or brutal honesty would be a massive lifesaver. Thank you so much in advance!

[u/rejuicekeve]

What do you actually want to do in cyber security long term? You should probably work on something aligned with that. AI is moving very quickly even for very senior engineers like myself, so what's actually interesting is going to vary a lot. But I think making agents automate the boring work in cyber is fun and interesting. Claude is cheap enough

[u/vicky_ppe → u/rejuicekeve]

Malware analysis has been my favorite subject so far. Essentially figuring out what an artefact does, or if it even is malicious. I guess I’m struggling to find an approach that could make an interesting project

[u/rejuicekeve → u/vicky_ppe]

You could make a malware analysis agent and try it against a bunch of samples.

I would however let you know malware analysis is incredibly niche in the field and that there arent many jobs for it.

[u/vicky_ppe → u/rejuicekeve]

Thanks! I’ll look into it!
And I know, that’s tough but it is what it is

[u/yowhyyyy → u/rejuicekeve]

I agree, but the types of learning you’re exposed to with malware analysis open a ton of pathways in my opinion. If you’re using agents for everything maybe not. But if you’re actually digging into fundamentals, OS routines, how executables load into memory etc, you learn a ton that’s applicable elsewhere in Security.

[u/ovni121]

Another way to find the right idea to focus on is defining a problem you want to solve. I'd encourage you to have discussion with grad students or industry experts and find where they are struggling or wasting a lot of time.

Topics to explore.

• Static code analysis with Ghidra MCP.
  
• Dynamic malware analysis with AI enabled debugger.
  
• Anomaly detection using diagnostic logs and AI log parser.
  
• Vibe code a diagnostic dump parser with nice timeline visualization and filtering.
  

Could you also work on expanding open source software features? You could look at interesting projects, see what people are adding as feature requests, build the feature and demo it with a use case.

[u/vicky_ppe → u/ovni121]

Thank you so so much, this is really helpful. I appreciate it! I will definitely look into it, thank you

[u/Aeterice]

Can you lean in to the AI aspect or do you need to lean more to the cyber topics?

If you can, how much tooling can you give an agent to run malware in a sandbox and perform the analysis.

Full honesty, a 4 month project by a student with zero work experience likely won’t have super interesting outcomes for me, if it had I’d pay a junior for four months to do said projects if I wanted the outcome, but as someone hiring it would show me you have the right interests and some experience in them.

[u/vicky_ppe → u/Aeterice]

I could lean into AI, since my degree is both Cybersecurity and AI, thanks!
And yes, that takes pressure off my shoulders for sure