ADVANCE CRT - Doctoral Theses
Permanent URI for this collection
Browse
Recent Submissions
Item Detecting targeted interference in the Internet of Things(University College Cork, 2024) Morillo, Gabriela; Roedig, Utz; Pesch, Dirk H J; Science Foundation IrelandThis thesis investigates targeted jamming interference detection to enhance security in the Internet of Things (IoT) infrastructures. The study starts by assessing the critical role of IoT system monitoring in securing large networks, emphasising the need for automated solutions to detect and mitigate threats, ensuring continuous and reliable operations. This provided insight into how interference monitoring solutions should be implemented. The development of this kind of detector is important as naturally occurring interference requires a different response than targeted interference attacks. A significant portion of the thesis is dedicated to addressing vulnerabilities in the Narrowband-Internet of Things (NB-IoT), a Low Power Wide Area Network (LPWAN) radio technology required for large-scale IoT deployments. Initially, it looks specifically into how interference with NB-IoT synchronisation signals can lead to Denial of Service (DoS) attacks, highlighting the need to prevent and mitigate such vulnerabilities. A novel attack on the initial communication steps is provided in this investigation. To address these challenges, this work introduces a novel method for detecting targeted interference at the User Equipment (UE) level in NB-IoT networks. Our solution utilises network performance data and subframe loss rates to differentiate between targeted attacks and naturally occurring interference, which is critical as they require different responses. The costs associated with designing dedicated detectors for each technology, including established and upcoming ones, are high. Therefore, we propose a technology-independent approach to detect targeted interference across various IoT networks. This solution, designed to function on resource-constrained IoT devices, analyses packet loss rates and patterns to detect the presence of targeted attacks. This detection technique has been proven through comprehensive assessments using several IoT technologies, including NB-IoT and IEEE 802.15.4 GTS, demonstrating its effectiveness in distinguishing targeted interference from natural interference. This work advances the state of the art in detecting malicious interference in IoT environments by introducing a technology-independent targeted interference detection method capable of operating on resource-constrained IoT devices. Unlike prior research, which has primarily focused on machine learning IDS or including additional hardware for their solutions, our approach monitors packet loss rates and patterns across different wireless communication technologies (e.g. Narrowband Internet of Things and IEEE 802.15.4) to perform statistical anomaly detection. This is the first research to propose and validate a comprehensive, technology-independent framework that effectively distinguishes between targeted attacks and natural interference, thereby significantly enhancing the security and resilience of heterogeneous IoT deployments. Overall, our research emphasises the importance of robust monitoring systems and innovative defence mechanisms to safeguard IoT infrastructures against evolving and emerging threats while also contributing valuable insights and tools to enhance the resilience of critical IoT applications.Item Uncertainty in Recommender Systems(University College Cork, 2024) Coscrato, Victor; Bridge, Derek G.; Science Foundation IrelandRecommender Systems have emerged as a powerful tool in the information era. Due to the overwhelming number of items (products and services) currently offered on digital platforms, it is often necessary to use a system capable of ranking the items and offering those that are most relevant to each user. These systems typically use historical user-item interaction data to build models that can predict the relevance of each item to the user. There has long been a focus on increasing recommendation accuracy through the development of new prediction models. However, this is just one of the ways to improve these systems. It is also possible to equip them with new tools that extend their functionality in different ways. The tools that we focus on in this dissertation are uncertainty estimators. The problem of uncertainty is relevant to Recommender Systems in at least two ways: prediction uncertainty and label uncertainty. Prediction uncertainty is the expected imprecision of the predictions given by the system's model. Label uncertainty is the chance that interactions used to learn the prediction model are mislabeled. This dissertation reports by far the most extensive study of these two types of uncertainty, offering a varied set of methods for their estimation, ranging from heuristic data metrics to novel uncertainty prediction models. In overview, this dissertation is the largest compilation of methods for estimating prediction uncertainty and label uncertainty in Recommender Systems to date. This collection includes already-existing methods -- that we survey, rewrite in a common notation, implement, make available under an open license, and compare in-depth -- and many original methods, some that derive directly from existing work, but others that involve complex modeling. We divide our work into three branches: prediction uncertainty in explicit feedback-based systems, prediction uncertainty in implicit feedback-based systems, and label uncertainty in implicit feedback systems. While this dissertation proposes new uncertainty estimation methods, the novel work in this dissertation is not restricted to new estimation methods. We also propose new techniques for evaluating prediction uncertainty estimators. Furthermore, we present and validate novel ways of using uncertainty estimators to improve the operation of a Recommender System. At the core of our research program, and for each of the three branches cited above, we have rigorous validation of our prediction and label uncertainty estimation methods through large-scale, reproducible empirical studies on publicly available recommendation datasets that unveil important insights into the performance and usefulness of the proposed methods. These studies include both the novel and surveyed uncertainty estimation methods, and make use of the novel uncertainty evaluation techniques that we propose. This work can be an important mechanism for promoting new research on this topic that is still largely unexplored in the world of Recommender Systems. Thus, this dissertation is a contribution to the field of Recommender Systems, not just in terms of an all-encompassing compendium of uncertainty estimation methods for practitioners, but also in guiding future work. Given that the landscape of Recommender Systems continues to evolve, our work is poised to shape the discourse about uncertainty in the field.Item Secure coding in organisations: practice, culture, motivations and tensions(University College Cork, 2024) Ryan, Ita; Stol, Klaas-Jan; Roedig, Utz; Science Foundation IrelandThis thesis considers how to measure and improve secure software development in organisations. The thesis comprises three studies; a literature review, a large-scale survey of software developers, and a study comprising interviews with software professionals. The work is motivated by the continuing high prevalence of vulnerabilities in software. The proliferation of cybercrime, cyber espionage and other online issues, and their relationship to insecure software, are examined during the literature review study. The literature review also uncovered two main secure-coding influences on software developers; personal attributes such as knowledge and motivation, and environmental factors like secure coding pressure, resources and support. These observations led to the development of the Software Developer Security Archetypes; a two-dimensional framework designed to provide a vocabulary for thinking about software developers and their software security context. Also in this first study, 25 unhelpful assumptions in software security research were identified and documented. These include, that secure-coding activities will be reflected in artefacts, and that findings from a single study are final. The literature review suggested that some organisations pay lip service to code security without providing the requisite time and leadership support, a phenomenon sometimes called a ‘checkbox’ attitude to secure coding. The second study was designed to investigate this contradiction and other aspects of secure development. It entailed a secure coding development survey (n=962). Industry-based research was leveraged to construct a lightweight, empirically-based set of questions to measure practice. A further set of questions grounded in the literature review was included to investigate security culture. Survey respondents worked in environments with a broad range of secure-coding approaches. Comparison of secure coding practice and culture measurements showed indicators of a checkbox attitude to software security in some organisations. Small organisations, isolated and solo developers and freelance workers used fewer secure development practices, and their secure-coding tool use was limited. Secure coding requires specific technical knowledge. The answers to secure software training questions indicated that only 39.6% of respondents had been offered secure coding training. When offered, training did not always have the qualities required to make it effective, such as relevance and frequency. The third study comprised a series of interviews with software developers and senior managers, that sought their views on how software-security prioritisation by senior management affects secure development. The factors that motivate senior management in organisations to prioritise software security were investigated. Interview analysis showed that awareness and knowledge of security, breaches in other organisations, and regulatory and legal obligations were considered organisational software security motivators. This research indicates that increasing the software security obligations of organisations and other entities producing software is essential to increased software security. However, such measures may have unintended consequences, such as the stifling of innovation.