Security Professional and Researcher

Georgios Nikitopoulos

How I got into this stuff

Posted at

My passion for computers and computer security began to blossom during my high school years. I grew up in a family that deeply valued education, as both of my parents were elementary school teachers. My father, a passionate enthusiast of computers, mathematics, and engineering, further nurtured this environment. At the age of 40, while working a full time job at the time, he decided to pursue a degree in Surveying Engineering and often shared his enthusiasm for his studies with me. My curiosity about how computers work was first sparked by interacting with flight simulators my father had installed on our family computer. By the age of 15 years old, I had decided to learn how to program. Since the public education system at the time offered no classes on programming, I embarked on a journey of self-study. Encouraged by my father, who had Visual Basic textbooks from his university studies, I began teaching myself Visual Basic.

By the time I was 18 years old I had already began to be deeply immersed in topics such as computer security and cryptography, purely out of curiosity. I had decided to pursue a degree in Electrical and Computer Engineering to further fuel my interest into these topics. During my five year Master of Engineering studies in the University of Thessaly I had began to finally start grasp the bigger picture of understanding how computers work. From electronic circuits, to digital circuit design, to computer architecture and operating systems. To more theoretic classes, such as probability theory, numerical analysis, linear algebra, differential equations, signal and systems, artificial intelligence, multi-agent systems etc. As well as very interesting, technical and very specific classes such as advanced telecommunications using Software Defined Radios.

During my masters thesis which coincided with the boom of Data Science, and the then more frequent use of Recurrent Neural Networks and Convolutional Neural Networks I had decided I wanted to use Machine Learning methods in order to find security bugs in source code as I was very curious on wether one could do such a task. To my surprise, carefully studying the literature at the time no available dataset existed at the time that contained labeled samples of source code (vulnerable, non-vulnerable) which could be used for training machine learning models. I made it my task to create such a dataset by locating security patches and use the patch differentials (pre and after patch versions of the code) to label code as vulnerable and non-vulnerable respectively. I then discovered that metadata about the security patch itself such as the commit message can be used by means of natural language processing in order to further locate more security patches in public code repositories. This allowed me to create the largest dataset of source code vulnerabilities at the time and I was excited to share my findings for the academic community to use. I had the pleasure to present my findings at the ESEC/FSE conference (2021). This experience further solidified my interest in academia, machine learning, natural language processing and computer security and equipped me with advanced skills.

Beyond academia, my professional interests have further shaped my research interests. While working at GRNET (Greek Research and Technology Network), which is the Greek NREN (national research and education network, GÉANT equivalent) as a security engineer, I got to apply my knowledge to practical challenges. I participated in a large number of security assessments, which included discovering vulnerabilities in digital applications that were intended for the Greek public sector. It was a great opportunity to get a pragmatic view of how Computer Security does have a significant impact in the national stability, public service efficacy as well as the nation’s infrastructure, economy and well-being of its citizens.