Mewni Alahakoon

Smart Card Vulnerabilities in Sri Lanka: A Security Assessment Across Service Providers

M. Alahakoon, A. P. Sayakkara, B. Weerasinghe, and A. Wickramasekara

In Proceedings of the International Conference on Advances in ICT for Emerging Regions (ICTer 2025), Communications in Computer and Information Science (CCIS), Springer, 2026.

Weaponizing the Unknown: Zero-Day Exploits as Tools of Cyberwarfare and Their Impact on Global Security

M. Alahakoon

BCIS Emerging Scholars Symposium (ESS 2025), Bandaranaike Centre for International Studies, Colombo, Sri Lanka.

Systematic review of USB security: attacks, defences and open challenges

M. Alahakoon and A. P. Sayakkara

Literature review in progress; survey article planned.

Independent Researcher

USB and Peripheral-Interface Security

In collaboration with Dr. Asanka P. Sayakkara, UCSC, University of Colombo · Colombo, Sri Lanka

• Conducting an ongoing systematic literature review of USB security [3], covering USB4, USB-C Power Delivery, Thunderbolt, and malicious cable implants.
• Developing an attack-layer × attacker-capability taxonomy that spans the physical to the application layer, and surveying host-side defences such as device authorisation, firmware signing and kernel DMA protection.
• Mapping open problems where attack classes remain unstudied or proposed defences lack independent evaluation.

Postgraduate Researcher

Master’s Thesis

UCSC, University of Colombo · Supervisor: Dr. Asanka P. Sayakkara · Colombo, Sri Lanka

• Led the first systematic, cross-provider security assessment of NFC payment cards issued in Sri Lanka, covering cards from nine banks under a defined proximity-attacker threat model [1].
• Designed an original quantitative security-scoring model combining read success, read latency, distance resistance and wallet-shielding resistance across 11 experimental scenarios.
• Ran data-extraction (Flipper Zero), jamming (nine cards) and replay (five cards) experiments at 13.56 MHz with HackRF One and GNU Radio; jamming was defeated by EMV anti-collision and signal modulation, while replay was limited by SDR frequency drift.
• Showed that the principal risk lay in the wider payment ecosystem rather than in card cryptography: card data exposed over NFC could be misused where online merchants apply incomplete validation.

Postgraduate Researcher

Zero-Day Exploits in Cyberwarfare

UCSC, University of Colombo · Sole-authored study [2] · Colombo, Sri Lanka

• Conducted a qualitative comparative case study of Stuxnet, WannaCry and Pegasus, using thematic coding of state motives, offence–defence imbalance and security impact.
• Showed how stockpiling and the exploit market create an offence–defence asymmetry; assessed governance gaps against the U.S. Vulnerabilities Equities Process and the Tallinn Manual 2.0.

Undergraduate Researcher

BSc Thesis

University of Plymouth (delivered at NSBM Green University) · Supervisor: Mr. Chamindra Attanayake · Homagama, Sri Lanka

• Designed a real-time, multi-stage detection architecture for zero-day ransomware on Windows, combining pre-execution static analysis of downloaded executables with behavioural monitoring of file, directory and registry activity.
• Implemented the static-analysis stage as a two-model pipeline: a random-forest classifier over PE-file features and a convolutional neural network trained on 9,639 malware images from 25 families (Microsoft malware dataset).
• Deployed both models as a FastAPI service (Python, scikit-learn, TensorFlow/Keras).

Student Volunteer Researcher, Conex Research

International, UK-based student research organisation · Remote

Contributed to space-mission proposals through background research, Python scripting, and mission analysis in NASA’s GMAT.