Ever since the invention of the Internet, more and more computers are connected throughout the world. Though this has brought numerous new inventions used every day, like social media, e-commerce, and video conferencing, it also opens up new opportunities for cyber criminals. As the intrusion detection systems used to identify malicious behavior in a computer network can generate large amounts of alerts, methods have been developed to aid security analysts in gaining insights into what is happening on the network. Of course, there is always room to improve these methods, which is the topic of this thesis. Currently, one of the state-of-the-art methods uses state machines to model the alert sequences. State machines are a good fit as they can extract the context of different alerts, but they cannot extract information like parallelism between different alerts. That is where field process mining comes in, with process mining algorithms being able to extract parallelism from sequential data. In this thesis, state-of-the-art algorithms from process mining are evaluated for modeling alert datasets from intrusion detection systems with the aim of improving the current methods. As a comparison, different methods for learning state machines also tested for the same data. The results of the evaluation and comparison show that the state machines perform better in modeling the alert datasets with respect to explaining the data. On the other hand, thee process mining algorithms were not able to construct sound models for the datasets, and a fourth mining algorithm gave false implications about the data. Furthermore, the possibility of combining state machines with process mining was also tested, with the idea that the combination can use the state machines to extract context and the process miner to extract parallelism. This method did not yield any improvements for the alert datasets tested, but that does not mean it is not viable in other cases.

The majority of the courses in the Computer Science Bachelor at the Delft University of Technology use so called lab sessions to provide an opportunity for students to ask questions about course material and get feedback on their assignment. In order to optimally support the students, teaching assistants, or TAs, are appointed to assist the lecturer during the lab sessions. With the number of students in the Bachelor quickly growing, the process of manually recruiting students to become a TA and assigning the TAs to lab sessions is becoming infeasible.

This project aims to ease the process of gathering and scheduling TAs. In order to achieve this goal, the Teaching Assistant Management platform, or TAM, has been developed. All parties involved in the process of appointing TAs can use TAM to provide their input. Lecturers can register their courses on TAM, students are able to indicate their interest to help with different courses and representatives from Education and Student Affairs can validate the application of the interested students. Using this input, TAM is able to automatically create a schedule by assigning TAs to lab sessions. To provide an algorithm for the automatic generation of schedules, a model based on the minimumcost max flow problem is created. Due to complications with the implementation of the minimum-cost max flow model, the schedule generation is handled by a linear solver: Gurobi. By modeling the constrains for a schedule to be considered valid, Gurobi is used to process the input of the users into an optimized schedule.

TAM consists of three components: a MySQL database, a backend written using Spring, containing the business logic and the implementation of the scheduler, and a frontend website created with Vue to provide an interface to the users. The frontend and the backend are connected using a REST API.

A unique aspect of the project is the live deployment of TAM. At the end of the fourth week, the first version was deployed, allowing interested students to submit their course preferences. Subsequent features have been deployed iteratively. During the development, muliple problems have been encountered. The team underestimated the time required to learn the new technologies, as well as the time needed to maintain a system in production. Furthermore, configuring Single Sign-On required more time than expected.