Federico Cassano - Cybersecurity Portfolio

Welcome to my Portfolio!
It looks like WebGL is not enabled.
Although It's a security practice to disable it (since it can be used to fingerprint your browser), this website heavily relies on WebGL to display 3D graphics.

Intro

Hello and welcome to my portfolio. I am Federico Cassano, an international student from Milan. I am part of Northeastern University's class of 2025 where I'm studying in the combined major B.S. Cybersecurity and Economics program. I am very passionate about all things computers. I started my journey in CS from a very young age by coding a gaming server network to now creating machine learning applications, operating systems, compilers, programming languages, web applications and most importantly, security appliances. I am also very interested in how corporations and companies manage their assets and how to secure them.

I attended a technical institute in Milan as my secondary education, where I studied a mix of mathematics and computer science subjects such as programming languages, systems and networks, IT project management, and telecomunications. For my final year of high school I attended North Broward Preparatory School as a dorm student to strengthen my academic curriculum and study abroad while still being enrolled in my Italian school. In May of 2021 I graduated NBPS with Excellence Honors in Cybersecurity and Economics, while transitioning to my current university.

You may wonder how I made this 3D website (enable WebGL in your browser if you can't see it). I used a combination of three.js and mathematics to create objects, then i made the icons clickable using a ray-casting beam that intercepts those objects. You can find the code for this website here.
Why the "46" website icon? 46 is the hexadecimal ascii value for the character "F", which is the initial of my name.

Occasionally, I also write guides and writeups on programming-related topics on my blog.
You can find my blog here: blog.federico.codes

Academic Publications

Federico Cassano, Ming-Ho Yee, Noah Shinn, Arjun Guha, Steven Holtzen. Type Prediction With Program Decomposition and Fill-in-the-Type Training. arXiv preprint arXiv:2305.17145, 2023
Noah Shinn, Federico Cassano, Beck Labash, Ashwin Gopinath, Karthik Narasimhan, Shunyu Yao. Reflexion: Language Agents with Verbal Reinforcement Learning. arXiv preprint arXiv:2303.11366, 2023
Federico Cassano, Charles Bershatsky, Jacob Ginesin. SafeLLVM: LLVM Without The ROP Gadgets!. arXiv preprint arXiv:2305.06092, 2023
Donald Pinckney, Federico Cassano, Arjun Guha, Jonathan Bell, Massimiliano Culpo, Todd Gamblin. Flexible and Optimal Dependency Management via Max-SMT. IEEE/ACM International Conference on Software Engineering (ICSE), 2023
Donald Pinckney, Federico Cassano, Arjun Guha, Jonathan Bell. A Large Scale Analysis of Semantic Versioning in NPM. 20th International Conference on Mining Software Repositories (MSR), 2023
Federico Cassano, John Gouwar, Daniel Nguyen, Sydney Nguyen, Luna Phipps-Costin, Donald Pinckney, Ming-Ho Yee, Yangtian Zi, Carolyn Jane Anderson, Molly Q Feldman, Arjun Guha, Michael Greenberg, Abhinav Jangda. A Scalable and Extensible Approach to Benchmarking NL2Code for 18 Programming Languages. IEEE Transactions on Software Engineering (TSE), 2023

Highlighted Projects

OpenTau AI Type-Inference

OpenTau is a system that uses finetuned large language models for Gradual Type Inference. Implemented Type-Inference for TypeScript and Python using a structured program decomposition algorithm. The client is written in Rust.

Stiletto Compiler

Stiletto is a compiler for a multi-paradigm (functionally focused) language. It features type-inferred structs, first-class functions and methods, tuples, garbage collection and more.

Pantegana Botnet

Pantegana is a HTTPS Botnet written in Go. It can be used to test anti-malware software and IPS/IDS. Currently, Pantegana is not being detected by major anti-virus software like Kaspersky and Malware-Bytes.

Searx encrypted search engine

I modified Searx, which is a open-source search engine that combines all popular search results from google, duckduckgo, bing, etc... I made so that every search and image lookup goes through a Morty encrypted socket and queries are proxied with filtron to ensure confidentiality and integrity (as long as you trust me).

Mobile Inventory App

A cross-platform inventory application written in Flutter. It utilizes Firebase as it's backend as well as it's own API for pictures of items. It features QR Codes, Item Borrowing and personal database creation.

Arch based OS

My Archlinux-based operating system that i use daily, i use XFCE as my desktop environment and dwm as my window manager.

Teddy for Cancer Patients

Teddy is an API written in Go that predicts the probability of being diagnosed with cancer by using natural language processing and machine learning.

Certifications

GIAC GFACT

GIAC Foundational Cybersecurity Technologies

CEH v11

EC-Council Certified Ethical Hacker v11 - Ethical Hacking Methodologies and Countermeasures

MITx - 6.00.2x

Introduction to Computational Thinking and Data Science

MITx - 6.00.1x

Introduction to Computer Science and Programming Using Python

Hackathons and CTFs

Collegiate Cyber Defense Competition 2023

Partecipated in the 2023 Collegiate Cyber Defense Competition as a Blue Team member, where our team placed 1st in the Northeast Region.

CyberForce 2022 Red Teamer

Volunteered as a Red Teamer for CyberForce 2022, where I played as against Blue Team partecipants by hacking into their defences.

National Cyber Scholarship Competition Spring 2021

Placed as a Finalist and Scholar. I was awarded the scholarship amount of $2500, access to the SANS Cyber Foundations course and the GFACT certification.

National Cyber League Spring 2021

Placed 28th out of 4180 in the Individual game and placed 16th out of 922 in the Team game.

CyberPatriot XIII

My team placed Platinum and won all of the rounds before the national finals. I personally worked on the Linux boxes. The scripts and checklists i used can be found here.

HudsonAlpha Virtual Tech Challenge 2021

My team won in first place by building an application that predicts cancer diagnosis using Machine Learning. We were awarded $1000 and HudsonAlpha gadgets.

Truth can only be found in one place: the code.
- Robert C. Martin

Work History

Trail of Bits - Dec 2022 - Jan 2023

Winter Intern: Supply Chain Security

Researching AI dependency auditing and supply chain attack mitigations for Rust with Security Engineer Hamid Kashfi.

Khoury College of Computer Science - May 2022 - Present

Research Assistant, Part-time

Researching mitigation strategies for supply chain attacks with PhD. Donald Pinckney and Prof. Arjun Guha
Designed a dynamic analysis framework with gVisor, Docker and Rust to collect strace logs for npm packages.
Defined a set of SMT constraints that minimize vulnerable npm packages’ CVE score for an arbitrary dependency graph.

Khoury College of Computer Science - Sep 2022 - Present

Teaching Assistant: Compiler Design and Fundies 1 Accelerated, Part-time

Developed an autograder for the Fundies class
Contributed to raco fmt, which is an auto formatting tool for Racket programs
Designed blockchain assignment, students had to code a PoW miner and a crypto wallet