Student team triumphs at national cybersecurity competition

A team of four UVic students came home champions from a national competition in October, for a software solution to help small businesses achieve cybersecurity.

Six finalist teams were invited to present their solutions at the People in Cyber Conference in Toronto on Oct. 19. The UVic team, which won the $3,000 grand prize, impressed the judges with a package that included a working web application—not just a concept.

“We presented something that actually works and the judges really liked that,” said Chandula Kodituwakku, a third-year computer science student. “After the conference, some of the judges spoke to us and said it was a very good idea and could be a tool that all organizations could use. They said now we just need a business plan.”

Over the summer, teams that entered the Cybersecurity Higher Education Contest were asked to consider that most small businesses have very little cybersecurity protection because they are so focused on day-to-day operations and lack the expertise and resources to prevent a cyberattack. Increasing numbers of cyber-criminals are targeting the small business sector as “low-hanging fruit,” from which they can steal confidential information, disrupt business operations and launch third-party attacks on other organizations.

The UVic team, CyberTORia, focused its solution on phishing emails, which try to get small business employees to part with personal or sensitive information.

“Phishing attacks are one of the most common reasons there are data breaches, so our goal was to assess how vulnerable a small business’s employees are to these attacks and to make them aware,” said Kodituwakku.

The UVic team wanted to educate small business employees in a way that was both personalized and engaging.

The team’s resulting Cyber Risk Assessment Tool, CyberRAT, is a web application that uses both data analytics and natural language processing—a branch of artificial intelligence that deals with how computers and humans interact using natural language—to assess how vulnerable a particular user is to phishing attacks. Based on open-source intelligence, which collects data from publicly available sources, it scans the internet, including social media channels, to find any sensitive information that could be used against a person. This information could include breached accounts or information that identifies a person, such as date of birth, their mother’s name, and so on. Based on the information gathered, CyberRAT assigns an online security score, displays where the person’s sensitive data is exposed, and then recommends how to safeguard the information.

Kodituwakku learned about the contest during a summer co-op work term at RBC Royal Bank in Toronto, and asked one of UVic’s co-op coordinators to put him in touch with other UVic students who also had an interest in cybersecurity.

“When I initially met the group I said, ‘More than the cost of the trip, this is going to be a great experience, a great opportunity to network, and something you can put on your resume if we win.’”

Two team members—Pranay Rai and Abhishek Chatrath, both in fourth-year software engineering—had already begun early work on the web application as part of their Capstone project. The fourth student, Denzel Cheung, also in fourth-year Software Engineering, rounded out the team, which worked around regular classroom activities.

“It was challenging because it was after mid-terms,” said Kodituwakku. “We had to meet up in the evenings. We skipped some classes to practice our presentation. But it was worth it in the end.”