Babak AminAzad, PhD

I work with the Bot Management ML team at Cloudflare as a systems engineer and my focus is on designing and developing robust bot detection schemes including research for novel browser fingerprinting methods and building machine learning models to detect unwanted bot traffic.

I worked with the Bot Management team at Cloudflare as an intern for the summer of 2021. My focus was to build fingerprinting methods for emerging web protocols to detect bot traffic.

I worked with the Bot Management team at Cloudflare as an intern for the summer of 2020. My focus was on bots that target Cloudflare. I implemented a scalable red teaming platform that automated bot attacks against the Bot Management platform.

Website Monitoring and Deface Detection Service:
In this project an application was developed to monitor national banks’ websites and alert the CSIRT team if a downtime or a deface takes place. Important features of this application includes:

• Monitoring Script addition to the page
• Monitoring redirection to another domain
• Checking for addition of specific words to pages
• Checking for change in the HTML source of website greater than a predefined threshold
• Monitoring DNS records status
• Monitoring WHOIS entry changes and expiration
• Integration with Qualys SSL Labs to produce reports about SSL configuration

Banking Websites’ SSL Configuration Report and Hardening Guide:
This project spanned over 35 national banks’ internet banking websites, SSL protocol configuration of these sites was studied, factors like security against SSL vulnerabilities (Heartbleed, POODLE, FREAK, LogJam etc.), certificate signature algorithm and cipher suites negotiated with clients were taken into consideration and a hardening report was delivered to their admins to address the issues.
Mobile Banking Software Security Report and Secure Android Development Guide:
The android version of mobile banking applications of 35 national banks was studied, features like secure software distribution, frequent updates, tamper detection and integrity verification, secure communication channel to the server, cryptographic protocols, insecure data storage and presence of source code protection was tested, during this study several high impact vulnerabilities were found and reported. Lastly, a secure android development guide was produced to address common pitfalls in applications tested during this study.

Our task at Ontech was to upgrade a legacy, windows based sector specific ERP software to a multi user, web based application, this was a web development project but due to abundance of features it had, the design and implementation of it was quite a challenge.