The Architecture, Engineering, and Construction (AEC) industry is grappling with the growing challenge of improving communication and collaboration. As projects become more intricate, the need for seamless interoperability—where systems and teams can easily exchange and understand information—becomes even more critical. This research delves into a socio-technical approach designed to address both the technical and non-technical obstacles that hinder seamless integration and interaction across various systems and stakeholders. By conducting an in-depth review of existing literature and engaging with industry professionals, the study identifies key challenges such as fragmented information sources, misaligned organizational strategies, and complex contractual relationships.

The framework proposed in this research aims to bridge these gaps by combining ontology development and semantic web technologies with middleware integration, which should enhance data exchange and improve standardization. On the non-technical side, the framework emphasizes the importance of collaboration across organizations through coalition-building, the development of standardized contracts, and ensuring strategic alignment.
Ultimately, this research not only presents a practical solution to the interoperability challenges in the AEC industry, but it also contributes to the larger conversation on digital transformation within the sector. By aligning technical innovations with organizational strategies, the proposed framework has the potential to improve productivity by encourage innovation. The study highlights the importance of integrating both technical and organizational perspectives in order to create scalable and effective solutions.

This thesis investigates the impact of market-specific factors on user acquisition for the HomeID app across various international markets. Utilising a qualitative approach, the study integrates primary data from semi-structured interviews with stakeholders and secondary data from internal company documents. Key findings reveal that cultural relevance, technological readiness, economic conditions, and administrative regulations significantly influence user acquisition. The research underscores the importance of tailored strategies for different markets, highlighting the need for localised marketing efforts, community engagement features, and adaptive pricing models. These insights provide a strategic framework for enhancing user acquisition and sustaining growth in diverse international contexts.

The internet's infrastructure relies heavily on Autonomous System Numbers (ASNs) for efficient and reliable data routing across complex networks. This thesis investigates the policies governing the allocation and management of ASNs across the five Regional Internet Registries by employing a mixed-method approach, including content analysis, surveys, and interviews. The study examines the potential impacts of recent policy changes, particularly the introduction of maintenance fees at RIPE NCC and APNIC as these fees could disproportionately affect smaller stakeholders.

The research highlights regional differences in ASN policies and the effects on stakeholders. It also explores the broader consequences of these policies for the global internet infrastructure. Based on the findings, several recommendations are proposed to harmonize policies, improve transparency, and ensure that the governance of ASNs remains responsive to the evolving needs of the Internet. The study concludes by addressing the critical balance between financial sustainability for RIRs and the accessibility of resources for diverse stakeholders.

The emergence of the Data Marketplaces is the latest iteration in the phenomenon of data-driven transformation of the world. Data marketplaces have emerged as a new form of data-driven business models which enable trading of data between the data owners/providers and data consumers by providing the necessary technological and non-technological infrastructure. These features present an alternative to the cumbersome logistics currently involved in searching, buying and selling data; thus, simplify the data supply chains between the data-driven business entities. However, they suffer to take off into mainstream success because of a myriad of reasons. Of all the reasons, 2 of them are focused in this thesis. Firstly, the difficulty involved in architecturally enabling a data marketplace platform as the prospective enabling technologies are still immature. Secondly, the uncertainty associated with the commodification of data which comprises of the intellectual property enforcement of data (data ownership), privacy and confidentiality breach (threats), regulatory ignorance (implication of GDPR), reluctance of businesses from participating because of the previous reasons et cetera. This reason is collectively referred as due to the uncertainty around the threat landscape of the data marketplaces. Multi-Party Computation (MPC) technology provide a solution to these problems. Through its capabilities to preserve the confidentiality of data architecturally and thereby securing the interests of the data actors with respect to the uncertainty of the threat landscape around data, MPC can enable safe and secure data sharing between data actors. This characteristic of MPC can help data marketplaces to overcome their challenges and foster their realisation. However, since MPC cannot handle the scale of real-life application, it is not mature enough yet to be incorporated into real-life data marketplaces. An EU funded project called SafeDEED: Safe Data-Enabled Economic Development, proposes to overcome the scalability issue and intends to achieve the maturation of MPC for real-life application. Building upon this forecast, a research was conducted to investigate the implication of the maturation of MPC technology towards the 2 problems faced by data marketplaces, architectural and threat landscape; and the same is documented in this thesis.

Companies today are continually looking for new ways to digitize and automate their processes in order to maximize productivity and efficiency. Existing academic research has shown the efficiency and benefits of process automation using Robotics Process Automation (RPA). Through preliminary research, we observed that most of the companies have stagnated in a pilot or proof of concept of implementing RPA phase which implies that they are still learning how to manage RPA. The success of scaling up RPA lies in proper governance that may establish guidance, processes and mechanisms to manage and control the RPA activities in order to realize the expected benefits from technology. It is vital to assure that RPA robots are efficiently used, running as expected and following the security controls within the organization. There is a void in the academic literature which means that the current study does not provide a sufficient understanding of RPA governance, and there is no existing proper governance model for managing RPA. Therefore, the main goal of this master research is to develop a governance model for Robotics Process Automation using design science methodology from a management and operational perspective. The developed RPA governance model is based on the synthesis of the literature on RPA, IT and BPM governance and the findings from the case study analysis.

Malicious software such as botnets are a threat to society and increasingly so through Internet of Things (IoT) devices. The large volume, pervasiveness and high vulnerability of IoT devices make them low hanging fruit for malicious actors. Currently, the biggest threat for insecure IoT devices is Mirai, a botnet which is deployed for DDoS attacks. Home users often fail to detect and resolve Mirai on their IoT devices. For this reason, Internet Service Providers (ISP) increasingly take efforts to increase remediation. Sending their infected customers a notifications containing cleanup instructions is currently the most feasible measure on a large scale. However, previous studies point out that it is not clear how people process these notifications, if they comply with it and how this effects the remediation rate and speed. The central research question of this study is ‘What is the role of IoT device end users in Mirailike bot remediation?’. We have conducted an eight-week experiment at the KPN Abuse Desk that notifies customers about abuse incidents. 177 Mirai-infected consumers have been randomly assigned to a walled garden notification (i.e., a quarantined environment), an e-mail notification, or control group. All subjects within the experiment have been tracked for two weeks to estimate the infection time and are contacted afterward for interview purposes. Male consumers and consumers younger than 54 years possess relatively more often a Miraiinfected device compared to other consumers. Both e-mail and walled garden notifications are effective in reaching consumers, informing them and encouraging them to take action. The majority of consumers do not follow the recommendations provided by the notification. In contrast, the number of actions that are performed while not mentioned in the notifications is remarkably high. Since many consumers asked for additional help, we conclude that consumers appear don’t have a full understanding of how to tackle the problem. In the control group, several consumers remediated Mirai unintentionally. However, these cases do not explain all observed remediation. Using two survival analysis modeling techniques, we find that consumers placed in a walled garden have a 29% to 85% shorter infection time than other consumers. We conclude that there is a discrepancy between stated behavior and the actual behavior of consumers. Although we cannot observe all cleanup efforts of consumers, we observed that awareness of the Mirai-infection and the intention to comply with the recommended actions influence that unobserved behavior. Gender also influences the unobserved behavior. Women clean up their device quicker than men while their statements during the interviews contradict this. One explanation is that women may unintentionally clean up their device. We conclude that age, consumer market, device type and customer satisfaction have no significant influence on remediation. We believe that it is unlikely that all unexplained remediation can be attributed to the unobserved behavior. We thus cannot explain all observed remediation from the user perspective. Therefore, we argue that future work must also focus on the attacker perspective. Since we only observed Mirai-infections, we cannot exclude the possibility that competing malware confiscated infected devices within our experiment. In addition, novel Mirai variants may have evolved scanning behavior which obstructed proper detection of infected bots.

Understanding target selection is a step before making a suitable proactive measure to address the complex issue of banking malware in online banking landscape. Despite several previous studies, gaps in the research of target selection are still present like the lack of attention to the non-targeted entities, the presence of other potential factors and the change in the landscape itself. Seeking to address the gaps, this research is conducted to find out what characteristics related to online banking services can affect the likelihood of the malware attack to them. The research starts with literature review to identify characteristics which can potentially explain the target selection, in accordance to aspects of Routine Activity Theory (RAT). Next, data about malware attack and the list of banks as well as several external data like language and authentication factor of online banking were collected and processed for quantitative analysis. Several metrics to approach the actual attack count were proposed and other metrics were extracted from the data. Some interesting findings were captured, like, within the period February 2014 – November 2017, from 5,039 banks in the EU, 1,188 banks were without any online banking services and from 3,851 banks with an online banking service, 1,802 banks were found targeted and 2,049 not targeted. Some malware variants were also seen performing targeted attacks. Meanwhile, it is found from explanatory analysis that some characteristics maintain their significance in explaining the likelihood of attack, like the presence of English and two-factor authentication. Services offering English language were seen to be more attacked. Contrarily, services which implemented 2-factor authentication were found to receive fewer attacks, although more entities with such authentication were targeted. Meanwhile, some other variables were getting less significant when more controlling factors are taken into account, indicating that some variables were relatively more or less important than others. Future work is needed in order to enhance the model so that more plausible conclusion can be obtained, such as improving and adding more data as well as including more factors, especially those that are financial and market related.

Currently, DDoS attacks have become inevitable for financial services and their threat keeps rising. Numerous researches have focused on the technical since the rise of DDoS amplification attacks. However, there is less understanding regarding their target selection on financial services. This research uses a mixed method approach to capture factors that influence cybercriminals in their selection of victims. Via data from amplification DDoS honeypots, various factors are identified and explanatory models are provided. In addition, financial cyber security experts are consulted to assess their perspective on target selection. The analysis demonstrates that certain countries have significantly higher or lower victims, which can partially be explained through country level factors such as the ICT development and Normal GDP Per capita. In addition, the ICT development influences the duration of the attack significantly. The findings also indicate that organizational size, as measured by market value, showed a limited effect on the number of attacks. Contrary, experts regarded the size as a highly influential factor. The analyses furthermore demonstrate that financial organisations incur significantly more attacks on Friday than on any other day. Moreover, the experts mention additional target selection factors such as,
reputation, media attention, patching, having capable employees, and mitigation parties. Finally, this paper reflects on the implications of these findings for the financial sector and related sectors.