http://hdl.handle.net/123456789/10343 Sun, 08 Nov 2026 20:58:14 GMT 2026-11-08T20:58:14Z http://hdl.handle.net/123456789/21856 Cryptography on Risc-V Systems: Ascon Algorithm on Cv32e40x Core Cv-X-If Based ISE using Pynq-Z1 Soc Fpga Ali Raza, 09-242242-001 In 2023 the National Institute of Standards and Technology (NIST) selected Ascon as the standard for lightweight cryptography (LWC), formalized as NIST SP 800-232. As Ascon becomes the basis for confdentiality, integrity and authentication on constrained devices, the cost of accelerating it on RISC-V is a pressing engineering question. RISC-V instruction set extension work has characterized Ascon authenticated encryption and hashing in detail, but three gaps remain: Ascon-MAC, Ascon-PRF and Ascon-PRFShort are largely unaddressed. Every comparable RISC-V work measures the CAESAR-era v1.2 specifcation rather than the standardized algorithms and none reports a single shared hardware permutation core measured on real silicon across the complete seven member family. This thesis therefore establishes what such an accelerator costs in performance, area and power on real hardware, and how its beneft is distributed across the seven members. A CV-X-IF tightly coupled Ascon-p accelerator was designed for a CV32E40X Embedded RISC-V core, synthesized and deployed on a Xilinx Zynq-7000 PYNQ-Z1 FPGA board. It occupies 597 LUTs and 368 flip-flops with no DSP or block RAM, and closes timing at 60 MHz with positive margin. The software baseline and the accelerated run execute on the same bitstream, differing only in one control register bit, and that baseline is hand-written RV32I assembly rather than the compiled C used in the comparable literature, making the ratios conservative. All 28 measurement points, spanning 0 to 1024 bytes and covering AsconAEAD128 under both associated-data conventions, passed NIST Known Answer Test verifcation in both modes. Speedups measured on hardware, not in simulation, range from 2.98x on the single call Ascon-PRFShort to 21.37x on Ascon-Hash256 at 1024 bytes. The area and timing are tool reports, power is a vectorless estimate, and no energy result is claimed. The beneft is not uniform. At a common 16 byte length the seven members span 3.41x to 11.12x from identical hardware, bounded not by the permutation they share but by the non-permutation work accompanying each call. To the author’s knowledge, this is the frst silicon measured characterization of a single shared Ascon accelerator serving the complete seven member SP 800-232 era family on a RISC-V core. Supervised by Dr. Syed Khawar Hussain Shah Thu, 01 Jan 2026 00:00:00 GMT http://hdl.handle.net/123456789/21856 2026-01-01T00:00:00Z http://hdl.handle.net/123456789/21857 Enhanced FGPA Implementations of Communication Protocol Receivers with Early Anomaly Detection Capabilities Naveed Iqbal, 09-242242-007 Communication protocols such as UART, and SPI remain widely used across embedded systems, avionics, automotive electronics, and industrial equipment. While these protocols are mature and reliable, their conventional receiver implementations generally report only basic errors (e.g., parity, framing, or synchronization faults). Such mechanisms are insuffcient for detecting subtle or intermittent anomalies caused by transmitterside inconsistencies, hardware degradations, signal integrity variations, or protocol-timing deviations. These irregularities often remain hidden in the testing phase. With advancements in Field-Programmable Gate Arrays (FPGAs), there is increasing potential to embed intelligent diagnostic capabilities directly within communication protocol receivers. This thesis proposes an enhanced approach of implementation and with integrated SelfMonitoring Receiver Implementation (SMRI) framework, a novel FPGA based approach that improves the existing receivers and integrates practical anomaly detection mechanisms into the receiver architecture itself. The SMRI framework is designed to identify issues that may not yet result in incorrect data reception but indicate an increased probability of failure under specifc conditions. The proposed research evaluates this framework using commonly used communication standard UART, and also give a brief touch to its use in SPI Protocol, demonstrating how builtin anomaly detection can enhance system validation, reliability, and predictive fault monitoring during early testing phases Supervised by Dr. Syed Khawar Hussain Shah Thu, 01 Jan 2026 00:00:00 GMT http://hdl.handle.net/123456789/21857 2026-01-01T00:00:00Z http://hdl.handle.net/123456789/21889 Enhancing Privacy and Security in Embedded Systems Through Edge Vpn Arshad Ullah, 09-242242-002 The proliferation of Internet of Things (IoT) and the success of rich cloud services have pushed the horizon of a new computing paradigm, edge computing, which calls for processing the data at the edge of the network. Edge computing has the potential to address the concerns of response time requirement, battery life constraint, bandwidth cost saving, as well as data safety and privacy. In this paper, we introduce the defnition of edge computing, followed by several case studies, ranging from cloud offloading to smart home and city, as well as collaborative edge to materialize the concept of edge computing. Finally, we present several challenges and opportunities in the feld of edge computing and hope this paper will gain attention from the community and inspire more research in this direction. Specifcally, the dataset has been generated using a purpose-built IoT/IIoT testbed with a large representative set of devices, sensors, protocols and cloud/edge confgurations. The IoT data are generated from various IoT devices (more than 10 types) such as Low-cost digital sensors for sensing temperature and humidity, Ultrasonic sensor, Water level detection sensor, pH Sensor Meter, Soil Moisture sensor, Heart Rate Sensor, Flame Sensor, etc.). Furthermore, we identify and analyze fourteen attacks related to IoT and IIoT connectivity protocols, which are categorized into fve threats, including, DoS/DDoS attacks, Information gathering, Man in the middle attacks, Injection attacks, and Malware attacks. In particular, we address the design of switches and control platforms with a focus on aspects such as resiliency, scalability, performance, security, and dependability Vas well as new opportunities for carrier transport networks and cloud providers. Last but not least, we analyze the position of SDN as a key enabler of a software-defned environment Supervised by Dr. Syed Khawar Hussain Shah Thu, 01 Jan 2026 00:00:00 GMT http://hdl.handle.net/123456789/21889 2026-01-01T00:00:00Z http://hdl.handle.net/123456789/21909 AI-Based Threat Intelligence and Anomaly Detection Framework for Hybrid Cloud Security Using Azure and Mitre Att&Ck Mohammad Abdurrehman, 09-242242-004 Traditional cyber security monitoring tools are heavily dependent on a static, signaturebased approach to identifying malicious activity. These can deal with known and knownto-be-known attacks, but are less effective in recognizing new or changing attack patterns, and often give false positives (alarms when there are no attacks) and false negatives (alarms when there are attacks). But this is exacerbated in hybrid cloud deployments, where on-premises systems and public cloud resources like Microsoft Azure contribute to a large and expanse of attack surface that is complex to monitor. This thesis proposes the design, implementation and evaluation of an AI-based Threat Intelligence and Anomaly Detection framework that can overcome these limitations. The system adds a machine learning layer which can learn the normal and abnormal network behaviors directly from the data without requiring hand-written rules, and then maps the generated anomaly predictions to structured threat intelligence that can be understood by analysts in the MITRE ATT&CK knowledge base. As part of this project, due to the lack of availability of real-time Azure Monitor or Azure Sentinel logs for training, the benchmark UNSW-NB15 intrusion detection dataset was used as a substitute data source. The system pipeline was intentionally designed to be data-source agnostic, meaning that the UNSWNB15 dataset can be replaced with a real dataset of Azure telemetry without changing the overall design of the system. Three machine learning models were used and empirically evaluated: an unsupervised model called the Isolation Forest baseline model, a supervised model called the Random Forest Classifier, and an unsupervised model called the Auto encoder-based deep learning model. The accuracy of the Isolation Forest is 54.82%, the Random Forest gives accuracy of 90.09% and F1-Score 0.9224, and the Auto encoder with tuning the reconstruction-error threshold gives accuracy of 68.34%. For the framework's main detection engine therefore, the Random Forest classifier was chosen. The detections created by the Random Forest model are then passed through the MITRE ATT&CK mapping layer which adds a tactic, technique, technique ID, severity rating and contextualizes a prediction of attack/normal (for instance, a prediction of DenialofService is mapped to the tactic, technique, technique ID, and a high severity rating to the event). All processed results are stored in a structured CSV file, and presented in aninteractive Stream lit dashboard with charts showing total events processed, alerts generated, severity distribution and MITRE tactic distribution, and a table of alerts that can be filtered. Experimental results show that supervised machine learning significantly outperforms the unsupervised baseline and the deep learning auto encoder on this dataset, and that the incorporation of MITRE ATT&CK into the anomaly detection meaningfully adds to the interpretability and operational utility of ML-based anomaly detection. The thesis ends with a discussion of the limitations of the framework, namely that it currently relies on an offline benchmark data set, not on the real Azure telemetry, and a roadmap for future work, in which the framework will be extended with real-time data ingestion, federated learning and automated response actions Supervised by Dr. Syed Khawar Hussain Shah Thu, 01 Jan 2026 00:00:00 GMT http://hdl.handle.net/123456789/21909 2026-01-01T00:00:00Z