FST Graduate Research Topic

Research Topic: Cybersecurity: Network Intrusion Detection System (NIDS)
Suggested By: Harris Wang
Last Update: September 28th, 2025

Constrained Object Hierarchies (COH) provides a neuroscience-inspired theoretical framework for modeling Artificial General Intelligence (AGI). As a flexible and robust foundation, COH supports the representation of general intelligent systems across diverse domains. Formally, a COH is defined as a 9-tuple: O = (C, A, M, N, E, I, T, G, D) Where: C: Components – sub-objects organized hierarchically A: Attributes – state variables describing object properties M: Methods – executable actions associated with components N: Neural Components – adaptive models for learning and inference E: Embedding Neural Component – semantic representation of the COH I: Identity Constraints – rules ensuring object integrity T: Trigger Constraints – event-condition-action rules for dynamic behavior G: Goal Constraints – optimization objectives guiding intelligent behavior D: Constraint Daemons – real-time monitors enforcing system constraints Based on the COH framework, the modelling process and result of Network Intrusion Detection System (NIDS) in Cybersecurity are as follows: System Description and Significance: NIDS monitor network traffic for malicious activities and policy violations, providing critical protection for organizational infrastructure. Their significance has grown with increasing cyber threats, requiring systems that can detect novel attacks while minimizing false positives that disrupt legitimate business operations. Analysis and Design: The system must analyze network patterns in real-time, distinguish normal from malicious behavior, and respond appropriately to threats. Neural components enable detection of novel attack patterns through anomaly detection, while identity constraints enforce fundamental security policies. The hierarchical structure allows for coordinated response across network segments. Modelling Solution: C: {NetworkSensors, PacketAnalyzer, BehavioralProfiler, ThreatIntelligenceFeed} A: network_traffic, connection_logs, user_behavior, known_threat_signatures M: scan_packet(), correlate_events(), block_ip_address(), alert_admin() N: AnomalyDetectionModel for network flow, MalwareBehaviorClassifier E: Embedding of overall network security posture and threat level I: Traffic from blacklisted IP must be blocked (hard_rule) T: IF lateral_movement_detected THEN isolate_affected_hosts G: Maximize_detection_of_true_positives AND Minimize_false_positives D: ZeroDayDaemon detecting correlated low-severity anomalies indicating novel attacks The COH framework enables the NIDS to balance detection sensitivity with operational continuity, using neural components for adaptive threat recognition while constraint daemons provide meta-monitoring for evolving attack strategies. You may choose this topic and pursue one of the following routes: 📝 Essay Survey existing methodologies for modeling, designing, and implementing similar intelligent systems. Include: Literature synthesis COH framework analysis Critical evaluation of competing approaches 🛠️ Project Design and implement the system using the COH model. Include: System architecture and design Development and testing Demonstration of core functionality 🎓 Thesis Explore COH’s theoretical foundations in depth. Include: Proposed enhancements or extensions Implementation and evaluation Development of an advanced intelligent system grounded in COH principles