The rise of the Internet of Things (IoT) has introduced levels of convenience never seen before, but also presents a significant cybersecurity challenge. Especially the insecure nature of many of these IoT devices fuels the emergence of advanced IoT botnets. The Gorilla botnet is a potent example of such IoT botnets and took the internet by surprise in September 2024. That month alone, Gorilla has been responsible for over 300,000 Distributed Denial-of-Service (DDoS) attacks across 100 countries. Although inspired by earlier botnets like Mirai and Gafgyt, Gorilla exhibits unique characteristics and attack strategies that remain largely unexplored.

This thesis conducts a detailed analysis of the Gorilla botnet, focusing on its communication patterns, infection strategies, and attack behaviors. By executing Gorilla’s malware samples in a controlled environment, the study captures insights into its command-and-control (C2) communication and attack strategies. Key findings include the identification of a flaw in Gorilla’s implementation, which could aid future detection efforts, and the discovery of its preference for UDP-based attacks targeting gaming-related services.

Through this work, we contribute a dataset and analysis framework that sheds light on Gorilla’s operations, highlighting its similarities to and deviations from the original Mirai botnet. The findings provide insightful observations, enabling improvements in defenses against IoT botnet threats.

Ray tracing has experienced increasing adoption in various spaces of computer graphics. The ReSTIR (Reservoir-based Spatiotemporal Importance Resampling) family of techniques has enabled several orders of magnitude speedups in light transport simulation algorithms which rely on ray tracing.

We introduce an extension to WRS (Weighted Reservoir Sampling), a key component of ReSTIR, to reduce the occurrence of duplicate samples in multi-sample reservoirs. Further, we show how samples from multiple reservoirs can be combined in an MIS-style estimator as opposed to resampling from them. Lastly, we combine these two components to compute optimal weights for this estimator in a similar vein to OMIS (Optimal Multiple Importance Sampling).

Our direct lighting proof of concept implementation demonstrates the efficacy of our WRS extension, lowering the variance of ReSTIR, particularly with difficult lighting arrangements. Further, our MIS-style estimator shows a significant improvement compared to ReSTIR. In problem domains where resampling produces a function value for integration, such as path tracing, this comes at no additional cost. Lastly however, optimal weights do not appear to be beneficial for our approach.

Within the field of \emph{cyber threat intelligence} (CTI), healthcare institutions are one of the most targeted organizations by cybercriminals. To mitigate future attacks on their digital infrastructures, healthcare institutions can collaborate and exchange security logs. These logs include data such as IP addresses, malware hashes, and other indicators of compromise. By identifying shared elements across different datasets, threats that are harmful to a greater number of organizations---and thus, pose a more significant risk---can be highlighted to detect common attack patterns. These attack patterns could then provide insight into understanding how cyber criminals operate on a larger scale. However, disclosing locally collected CTI could compromise a hospital's security posture and reputation since it reveals vulnerabilities or attack techniques used by hackers. Furthermore, this cyber threat data is often sensitive. That is why the threat data needs to be shared in a privacy-preserving manner. \emph{Multiparty private set intersection} (MPSI) is a solution that allows parties to find the intersection of all their sets without learning anything of the other inputs. Although, in many cases, the condition that an element be present in all sets is too restrictive. A potential threat is still worth investigating even if it only appears in a portion of sets. Therefore, we focus on \emph{threshold multiparty private set intersection} (T-MPSI). However, not all T-MPSI schemes perform equally depending on the context. Our goal is to determine what makes a T-MPSI protocol effective for application in medical CTI sharing. To do so, we analyze four state-of-the-art T-MPSI protocols in terms of security, theoretical communication and computational complexities, and practical runtime performance.

With the rapid growth in data collection, efficient data processing is critical. Dimensionality reduction methods, like t-distributed stochastic neighbour embedding (t-SNE), compress high-dimensional data into embeddings that preserve the key features of the datasets making data less sparse and easier to process further. Recent improvements suggest that using hyperbolic space for data representation can benefit embeddings. As it is a new technique, it remains computationally expensive. Previous work suggests that a Barnes-Hut approximation with a polar quadtree can be applied to the Poincaré disk model to approximate the result of hyperbolic t-SNE and accelerate its calculation. However, the polar quadtree is proposed as a solution to accelerate the calculation without exploring alternative approaches. Aiming to close this gap, we propose an acceleration method using Barnes-Hut approximation with a Cartesian quadtree. We experimentally compare our acceleration method to a polar quadtree and showcase its lower execution time without the loss of quality of the embeddings.
Implementation and scripts for the experiments and plots are available at https://github.com/Sne4kers/hyperbolic-tsne

This paper investigates a method for accelerating hyperbolic t-SNE — a popular high-dimensional data visualization technique. In particular, it focuses on building a hyperbolic t-SNE variant that uses a different model of hyperbolic space (called the Lorentz Hyperboloid model) for representing the low-dimensional embeddings. An acceleration algorithm based on a tree data-structure is then used to achieve a better asymptotic runtime complexity compared to the original version. The paper then compares this implementation with other alternatives — including accelerated variants — and shows that it computes embeddings of better quality at a similar rate.

In this work we aim to implement a variaton of the acceleration of hyperbolic t-SNE done by Skrodzki et. al. [19]. This variation aims to embed the points in the Klein Disk model of hyperbolic space instead of the Poincar ́e Disk model using an altared version of a polar quadtree to speed up the computation in a similar fashion as the Barnes-Hut scheme for the Euclidean versino of t-SNE. We analyze our results to prove our acceleration works for the Klein Disk model and compare the efficiency of our implemen- tation to the one for the Poincar ́e model in terms of quality of results and runtime.

Dimensionality reduction is an important task in high-dimensional data visualisation. Among the popular algorithms for achieving this is t-SNE, which aims to preserve local neighbourhoods in the lower-dimensional embeddings. While t-SNE traditionally works in Euclidean space, embedding in hyperbolic space offers several advantages, specifically for data of arbitrary size and exponential growth, such as tree-based structures. We propose a new solution to approximate and accelerate the calculation of t-SNE gradients using a uniform grid structure. This new method produces embeddings with better neighbourhood preservation than previous solutions, while also providing better runtime performance.

This research evaluates the performance of Meta's Code Llama 7B model in generating comments for Java code written in Polish. Using a mixed-methods approach, we conduct both quantitative and qualitative methods to discover the model's accuracy and limitations. We preprocess a dataset of Polish Java code from GitHub, apply a Fill-in-the-Middle objective for code comment completion, and evaluate the results using BLEU and ROUGE-L metrics. Additionally, we manually evaluate approximately 1150 generated comments and document the encountered errors. Based on the findings, we iteratively develop a taxonomy of errors using an open coding approach.

Through an expert evaluation, we discover the limitation of the BLEU metric in assessing comment quality for non-English languages, showing substantial differences with human evaluation. Our research identifies the most frequent errors in code comment completion in Polish, which are the generation of code snippets, copying context, late termination, hallucinations and repetitions. Only 25.2% of the generated comments were classified to be correct. This study is a part of the broader research about multiple models across various non-English languages. We aim to contribute to raise the awareness of large language models for code accessibility in non-English environments, therefore improving their inclusivity.

This paper evaluates the performance of Large Language Models, specifically StarCoder 2, in non-English code summarization, with a focus on the Greek language. We establish a hierarchical error taxonomy through an open coding approach to enhance the understanding and improvement of Large Language Models in multilingual settings as well as identify the challenges associated with tokenization and influence by mathematical datasets. Our study includes a comprehensive analysis of error types, tokenization efficiency, and quantitative metrics such as BLEU, ROUGE, and Semantic Similarity. The findings highlight the importance of semantic similarity as a reliable performance metric and suggest the need for more inclusive tokenizers and training datasets to address the limitations and errors in non-English contexts.

Interest in Large Language Models is growing, especially in software development tasks such as code completion and comment generation. However, most Large Language Models are primarily trained on English language data, raising concerns about their effectiveness when applied to other languages. This research investigates the performance of CodeGemma-7B, a transformer-based model, in generating code comments in Dutch, addressing the multilingual model training and evaluation gap. Using a dataset of Java source code containing Dutch comments, we aim to assess the model's ability for non-English use cases by evaluating the comments it generates.

Our process involved several stages, starting with collecting a dataset of Java files from GitHub that included common Dutch words. We filtered and masked the dataset and inferred new comments. Additionally, we trained a custom tokenizer to investigate the potential inefficiencies of the Gemma tokenizer when applied to Dutch code. For the qualitative analysis, we employed an open coding approach to identify common errors and patterns in the generated comments. Quantitative analysis was performed using BLEU-4 and ROUGE-L scores to compare the generated comments against the original ones, considering comment and context lengths.

Qualitative analysis revealed common errors, such as syntactically correct but factually faulty statements, unintended code snippets, and linguistic errors. These findings highlight areas for improvement in factual accuracy and model biases. Quantitative results showed high similarity scores, with 26% of the comments getting a BLEU-4 score above 0.95, and 28% getting a ROUGE-L score above 0.95. Additionally, the custom tokenizer we trained showed better efficiency than the Gemma tokenizer, with our tokenizer having a 5.35% better compression factor.

After the emergence of BERT, Large Language Models (LLMs) have demonstrated remarkable multilingual capabilities and have seen widespread adoption globally, particularly in the field of programming. However, current evaluations and benchmarks of LLMs on code primarily focus on English use cases. In this study, we assess the performance of LLMs in generating Chinese Java code comments through open coding. Our experiments highlight the prevalence of model-specific and semantic errors in generating Chinese code comments using LLMs, while also revealing a relative absence of grammatical issues due to the unique characteristics of the Chinese language. Additionally, we validated the potential for quantitatively analyzing semantic errors, especially Hallucinations, by examining the cosine similarity of word embeddings. Our findings propose an Error Taxonomy for evaluating LLMs on code in non-English scenarios and demonstrate the possibilities of using cosine similarity of word embeddings to judge the quality of code comment generation.

How well do large language models (LLMs) infer text in a non-English context when performing code summarization? The goal of this paper was to understand the mistakes made by LLMs when performing code summarization in Dutch. We categorized the mistakes made by CodeQwen1.5-7b when inferring Java code comments in the Dutch language through an open coding methodology to create a taxonomy of errors by which to categorize these mistakes.

Dutch code comments scraped from Github were analyzed, resulting in a taxonomy that revealed four broad categories under which inference errors could be classified: Semantic, Syntactic, Linguistic, and LLM Specific. Additional analysis revealed a prevalence of semantic and LLM specific errors in the dataset compared to the other categories. The resulting taxonomy has significant overlap with other taxonomies in similar fields like machine translation and English code summarization while introducing several categories that are not prevalent in those fields. Furthermore, it was found that BLEU-1 And ROUGEL metrics were unreliable as accuracy measures in this use case due to their nature as similarity metrics.

Masked Autoencoders (MAEs) represent a significant shift in self-supervised learning (SSL) due to their independence from augmentation techniques for generating positive (and/or negative) pairs as in contrastive frameworks. Their masking and reconstruction strategy also aligns well with SSL approaches in natural language processing. Most MAEs are built upon Transformer-based architectures where visual features are not regularized as opposed to their convolutional neural network (CNN) based counterparts, which can potentially limit their effectiveness. To address this, we introduce a novel batch-wide layer-wise regularization loss applied to representations of different Transformer layers. We demonstrate that by plugging in the proposed regularization loss, one can significantly improve the performance of MAE-based baselines.

Motivation: Imbalances in the human gut microbiome have been linked to various conditions, including inflammatory bowel disease (IBD), diabetes, and mental health disorders. While metagenomics and amplicon sequencing are the most commonly used technologies to characterize microbial communities, they do not capture all layers of functional activity of the microbiome. Unfortunately, data from other meta-omics modalities is generally difficult to obtain, due to high costs and error-prone technologies, among other issues. The growing availability of paired meta-omics data offers an opportunity to develop machine learning models that can infer connections between metagenomics data and other forms of meta-omics data. The aim is to enable the prediction of these other forms of meta-omics data from metagenomics data. To that end, we evaluated several machine learning model architectures on the task of predicting meta-omics features from various meta-omics inputs, and analyzed the robustness of these models, as well as potential use cases of artificially generated microbiome data.

Results: Machine learning models, in particular simpler architectures such as elastic net regression models and random forests, generated reliable predictions of transcript and metabolite abundances, with correlations of up to 0.77 and 0.74, respectively, but predicting protein profiles proved more difficult, with correlations of at most 0.42. We also identified a core set of well-predicted features for each meta-omics output type, and showed that multi-output regression neural networks performed similarly when trained using fewer output features. Lastly, our experiments demonstrated that predicted features can be used for the downstream task of IBD prediction. For instance, accuracy obtained using predicted metabolite abundances was 77%, compared to the 80% accuracy achieved using real metabolomics data.

Accurate forecasts are essential for integrating wind energy into the power grid. With wind energy's growing role in the renewable mix, precise short-term generation forecasts are increasingly vital. Turbine-level forecasts are critical for optimal wind farm operation, control, and planning. However, the wind's unpredictability and the complex interactions between turbines make forecasting challenging. Existing methods either depend on resource-intensive physical models or overlook turbine interactions, resulting in isolated, overly simplistic models.

This master's thesis explores the use of Graph Neural Networks (GNNs) in conjunction with Recurrent Neural Networks (RNNs) for wind power generation forecasting in wind farms. The result is an integrated approach that can learn the interactions between turbines through GNNs to handle the temporal dynamics of the data through RNNs.

The research begins with an in-depth overview of wind turbines and their arrangement in wind farms, highlighting the importance and challenges of Wind Power Forecasting (WPF). It establishes that the spatial configuration of turbines complicates power generation estimation, especially over different time horizons. Graphs are introduced as an effective way to represent the interconnections between turbines. Various methods for constructing these graphs are reviewed, focusing on predefined heuristics and their limitations in adapting to changing wind farm characteristics.

The core of this thesis is the AG-LSTM Network, a model that integrates RNNs and GNNs for short-term WPF for turbines within a wind farm. It utilizes historical power generation data, a variety of future and past covariates, and static turbine-specific features. The model is based on an encoder-decoder architecture with an Adaptive Graph Long-Short Term Memory Cell (AG-LSTM), which generates a dynamic adjacency matrix representing the farm's state at each moment. This matrix combines the input features and hidden states across turbines, resulting in an embedding that is transformed into the power forecast.

Through comprehensive experiments and analyses, the AG-LSTM Network proves to be more accurate than state-of-the-art methods on two real-life datasets when future covariates are unavailable. Further experiments demonstrate the quality of the forecast and break down the contribution of the different choices regarding its architecture. The results underscore the potential of hybrid neural network architectures in enhancing WPF, providing a valuable tool for the renewable energy sector.

In conclusion, this research contributes to the renewable energy field by proposing a novel hybrid neural network model that effectively addresses the complexities of short-term WPF. Future work could explore further exploitation of future covariates and the robustness of the model against incomplete input data.

The inception of onion routing in the mid-1990s, evolving into Tor (The Onion Routing) and other anonymous networks, marked a pivotal moment in the quest for internet privacy. However, the emergence of the dark web, facilitated by these networks, has also increased cybercrime activities, necessitating a critical examination of its implications and challenges. Besides, the intricate security architecture of this hidden realm creates a persistent challenge in identifying and mitigating cyber threats, fostering a landscape that demands innovative methodologies for robust cybersecurity. This thesis addresses the research gap in the existing literature, predominantly focused on TOR v2, by investigating protocols and services operating within TOR v3 onion services. Moreover, it fills the void in the literature by proposing an optimized port-scanning methodology for comprehensive analysis. Unlike previous studies, which have only considered a small dataset of onions and a limited number of ports in their TOR v2 onion services analysis, this work proposes an optimized strategy for scanning all ports, thus providing a more thorough understanding of the network's dynamics. Our research uncovers several critical insights into the landscape of onion services. We identified many onion services operating on non-standard ports, escaping typical web crawlers and the Tor browser, which only display HTTPS/HTTP pages. Through a comprehensive port scan of 300,000 onion services, we discovered 196 unique ports, highlighting a broad spectrum of service configurations. We categorized these services into six main types: web, Bitcoin, remote access, chat, email, file transfer, and miscellaneous, with web services being the most prevalent. Additionally, we observed that a significant number of onion services discovered in 2019 remain active, suggesting durability within the dark web. Interestingly, some services exhibited extensive port usage, with up to 35 open ports reflecting diverse functionalities or potential security vulnerabilities. These findings provide a deeper understanding of the dark web's structure and the persistence of its services. The key findings of this research sheds light on the intricacies of the dark web's inner workings. By addressing key research questions and providing clear definitions and mechanisms, this study empowers stakeholders, such as security researchers, law enforcement, and cybersecurity professionals, to navigate the digital landscape with vigilance and develop robust defence mechanisms against emerging threats.

The online website Skill Circuits is a tool developed by teachers at the Delft University of Technology. Skill Circuits is an online learning tool that presents students with a node-link (i.e. a tree) structure where each node represents a skill, containing tasks that aim to teach the skill. The website aims to benefit teachers, by letting them think how all the 'skills' in their course relate and whether or not they have sufficient material to teach these skills. At the same time, the website aims to benefit students by giving them a learning path to follow, where each step is a small task, and each skill is visually connected to previous skills, showing how the learning material is connected.
This thesis aimed to help new teachers understand the concept of these node-link structures --- called skill circuits --- and also expand the website with features to help them evaluate their skill circuits, both before and during the course.
A documentation help page was developed, which explained the concept and intended usage of the website and was accompanied by a proof-of-concept skill circuit explaining the same topics. Tools to help evaluate a skill circuit were also developed, which included tools that could be used before the course was held, and tools that used analytics generated by students. One noteworthy tool took inspiration from the Constructive Alignment principle, where a teacher can label parts of their skill circuit with learning objectives to see if there is alignment with their course material.
All of these features were evaluated with a small focus group consisting of teachers, which showed enthusiasm toward the proposed features.

Smartwatches are equipped with sensors that allow continuous monitoring of physiological and physical activities, making them ideal sources of data for data analysis. However, accurately identifying individuals based on smartwatch data can be challenging due to the presence of outliers. Hence, outlier detection techniques play a crucial part in this context by identifying and handling these data points. Auto-encoders are one of the prominent ways to address outlier detection. Auto-encoders minimize a loss function to identify outlier samples. To explore the most optimal loss function for smartwatch data, this paper conducts a comparative analysis between three unsupervised loss functions, fused directional loss, mean square error, and regularized loss extracted from the current literature. The performance of three functions in personal identification is employed as the performance criteria due to the lack of outlier labels. The results indicate that the auto-encoder's performance in personal identification is slightly better than random guessing. The model struggled to effectively capture individual characteristics of the training data. This led to the outlier samples and non-outlier samples not being separable in the evaluation set. Consequently, the variation in the performance across and within a loss function was primarily influenced by the characteristics of the data rather than the model itself. Thus, the auto-encoder has limitations in personal identification, which led to an inconclusive comparison of the loss functions.

Since the recent rise and advancement of video conferencing platforms such as Zoom, it has become important to interpret the logistics of remote online meetings. Analysing verbal and non-verbal cues (such as body language) between members of these virtual forums can provide additional information regarding the level of conversational involvement of each party. This research focuses on age, gender, demographics and virtual background differences in the context of group conversational discussions. It argues that groups formed of younger adults have a higher level of involvement compared to the older groups. Similarly, this study found that groups with a higher ratio of male participants score better in virtual conversational engagement compared to women preponderant groups. To better understand the influence of these inter- and intra-personal characteristics, a corpus formed of 45 online meetings on the topic of Covid-19 was used. This set of data consists of questionnaires with measurements (demographics and other personal values), as well as detailed annotations of conversational signals, which provide valuable insights into the research topic of conversational involvement.

This study includes an experiment to investigate the involvement of individual backgrounds in the prediction of group conversational engagement. Four predictive models were used, namely the Decision Tree, Random Forest, Linear Regression and Generalized Linear Mixed Effects Models. While the Generalized Linear Mixed Effects Model provides more meaningful observations on the statistical effect of these factors, the Random Forest ultimately proved to give the best performance accuracy. The purpose of this research is to improve the connection between humans and technology by studying how inter- and intra- characteristics of individuals impact the involvement of a group in virtual interaction.

The importance of understanding how to maximize involvement in virtual meetings has been greatly increased due to the rapid rise of video conferencing tools during the COVID-19 pandemic. This research builds upon the data collected by the MEMO Corpus, specifically interview footage and annotated data, and will aim to explore the various factors that influence group involvement in virtual meetings. The research will be conducted in three steps; data annotation, data exploration, and data analysis. The goal of this paper is to investigate the influence of factors such as likeability, listening, and audience engagement in how conversational ability is perceived, given that the scales provided by the MEMOCorpus are valid and the three measures are independent, and how conversational ability influences group involvement, by exploring the existence of correlations. The results of the analysis will provide insight into the dynamics of conversational involvement in virtual meetings and improve virtual communication practices.