The theoretical study of automata theory and formal languages is kind of moribund (meaning, you can probably still find interesting research problems to work on, but getting it published in top-level conferences and convincing someone to hire you once you graduate may be problematic). However, I believe there is also interesting work being done on applying formal language theory to internet threat/intrusion detection , etc., and this area seems much more hot right now.
Wagner and Dean, Intrusion detection via static analysis, IEEE Symp. Security and Privacy 2001
Wagner and Soto, Mimicry attacks on host-based intrusion detection systems, ACM Conf. Computer and Communications Security 2002
Giffin, Jha, and Miller, Efficient Context-Sensitive Intrusion Detection, NDSS 2004
Feng et al, Formalizing Sensitivity in Static Analysis for Intrusion Detection, IEEE Symposium on Security and Privacy 2004