As cybersecurity and artificial intelligence intersect, they introduce both new capabilities and potential risks. To better understand these dynamics, Informatics students in INFO 492 devised cybersecurity attack and defense simulations for their final Capstone projects.  

INFO 492 offers an accelerated one-quarter alternative to the Informatics Capstone requirement, which typically takes two quarters to complete. Information School guest faculty member Frank Martinez designed the course this past fall around a central theme of cybersecurity and AI. 

Martinez organized students into groups, assigning each a specific industry focus in cybersecurity and designating whether the group would approach their project from an attacking or defensive perspective.

Munir Emam, Jacqueline Flynn, Charlotte Liu and Yuxin (Ellie) Wu were among the seniors who were assigned to simulate a cybersecurity attack using AI on the logistics operations side of an industry.

The group was tasked with creating their own synthetic industry and situation for attack. They chose to demonstrate AI-orchestrated cybersecurity attacks on logistics operations for pharmaceutical companies during their last mile of medication deliveries to patients. 

Emam said that when approaching the project, the group thought about what an attacker would want to gain from the logistics side of an industry.

“When we were thinking about who would want to attack logistics, it would be people who want maximum mayhem on the industry network, and the best way to do that would be to attack pharmacies,” he said. “The monetary losses would be great as well as the effect on the consumers.” 

Flynn added that Martinez encouraged his students to hone in on an example that would demonstrate the real-world impact of a cybersecurity attack. 

“The pharmaceutical industry is very time-sensitive. It relies on patients getting medication that is either life-saving or very important for their day-to-day lives, which shows a real and harmful impact if that industry were to get attacked,” she said. 

The team took the fall quarter to develop a realistic pharmaceutical delivery model referencing real networks in the Pacific Northwest. They also created an AI-powered attack system designed to disrupt the delivery network in their model. 

The group’s project demonstrated a successful attack despite the challenge of working at the accelerated pace of an intensive Capstone. 

Liu said that the fast pace of the course made for an abrupt transition into project development.

“We jumped right into the project and had to start designing and absorbing a lot of new concepts,” she said. 

They also had to shift their thinking to the attacker’s perspective, which meant moving away from the defensive mindset that typically generates a new product or a startup idea and is often associated with a Capstone project.

Emam said, “The defense side was more product-oriented for this class, while the attack side was more research-based.”

Because their project focused on demonstrating a cybersecurity attack, it did not produce a future startup or tangible product, but it did provide valuable insights into cybersecurity defense, team members said. The simulation could also guide future efforts, such as working with pharmaceutical companies to share what an attack might look like and how to defend against a similar threat.

“Even though we're attacking and it’s obviously causing harm, it shows the caliber of these models and what they can do. It can also inform us about how we can defend against them or how we can use them for defense,” Flynn said. 

From this experience, the group learned a lot about avoiding cybersecurity scams and also working in a fast-paced group setting. 

Wu mentioned that having good team members is an advantage when working on such a detailed project. “Team members are really important, and this team works together really beautifully,” she said. 

Team members also advised future Informatics seniors to not shy away from a challenge when looking to do an intensive Capstone. 

Flynn said, “If they are not familiar with the topic or the industry, I feel that it shouldn't deter them from taking it.”

“I think being uncomfortable in a space that you don't know can really help with improving your skills,” she said.