There is an everlasting struggle for organisations to remediate vulnerabilities in IT systems before being the victim of an exploitation. Organisations try to reduce this struggle by turning to specialized cyber organisations, which use their expertise to recommend resolving a subset of vulnerabilities. Unfortunately, the process of recommending a selection of vulnerabilities is primarily done manually. Manual labour is time consuming and requires skilled personnel. Automating cyber advisories reduces both these problems.

We introduce ACSA, a process designed for the Automation of Cyber Security Advisories. ACSA creates a dataset that can be used by advisory publishers to automate their publications with minimal effort. The dataset contains around 90,000 advisories which are filtered by a machine learning model to the set published by the organisation. We applied the ACSA process and dataset to both the Dutch and Canadian NCSC and found that on average we can already automate the majority of advisories. This constitutes a significant workload reduction in comparison to the situation prior to the automation. Even better results are observed when looking at the performance of ACSA on specific vendors. For some vendors we are able to automate more than 90% of the advisories while creating minimal false positives.

Research has shown that the Border Gateway Protocol (BGP) is vulnerable to a new attack that exploits the community attribute. These community attacks can influence BGP routing in unintended ways. Currently, there are no effective mitigations against these attacks which do not limit the normal usage of BGP communities or offer cryptographic authorization of community values. In this thesis, we are the first to design and evaluate a new Resource Public Key Infrastructure (RPKI) object that provides these properties, called a Route Community Authorization (RCA). Autonomous Systems (ASes) can sign and upload an RCA that includes which communities are authorized to be used and under which conditions to reduce the attack surface. The approach does not alter BGP itself and ASes that deploy the security solution can verify if route announcements with community values are allowed to use those communities. With the RPKI construction of our solution, cryptographic operations are offloaded from the router to a separate server. This is because most BGP routers deployed on the internet are not capable yet of performing cryptographic operations on every announcement.

We simulate attack scenarios and evaluate the developed solution to see if it is a viable option to be deployed on the internet. The results show that the developed solution can block the community attacks, on the condition that ASes have properly configured the RCA and at least the target, or an AS between the attacker and the target, deploys the solution. If ASes configure the RCAs too broad, then there is still room for an attacker to abuse the community values. We show that the performance of the solution using properly configured RCAs can keep up with the rate of announcements seen on the internet. Since experiments were performed in simulations, additional experiments are needed in the future on hardware routers and by ASes on the internet to see if the results are the same. The biggest issue for the developed solution is the initial adoption by ASes since security benefits are low in the beginning, but increase once more ASes participate.

Once deployed BGP routers can handle cryptographic operations on every announcement, we suggest using BGPsec and extending it to include the community attribute. Using a BGPsec approach will improve security and provide integrity of the community attribute, which RCA does not provide.

The uprise of the Internet of Things (IoT) has been a hot topic for several years. While many see these devices and think they bring ease to their lives, it is far from reality. Researchers found many privacy and security problems within these devices in the last years. The popularity of these devices causes many users to bring a device into their home that could potentially infringe on privacy if not configured correctly. The first step to helping these home users secure their network starts by being able to autonomously detect the type of IoT devices connected to their network. With this information, firewall rules could enforce specific device behavior or provide the user with extra information on the type of the device and the risks it brings. It could inspire a new generation of home security devices focussing on securing IoT devices from a network perspective.

This thesis will introduce a new machine learning model to detect the type of unseen IoT device. Our work aims to classify devices into five categories, one more than the current state-of-the-art. Furthermore, we verify the model extensively on a large set of devices, with 74 measurements using Leave-One-Group-Out (LOGO) cross-validation. LOGO increases our testing set significantly in comparison with other works. Finally, LOGO will ensure that the training and test set was not handcrafted to obtain the highest possible accuracy, introducing fairness into our model design. The accuracy reached by our model is 73%, showing that Device Type Classification on unseen devices is feasible.

Interpreted applications are often vulnerable to remote code execution attacks. To protect interpreted applications, we should reduce the tools available to the attackers. In this thesis, we investigate the possibilities for the automation of policy generation for interpreted applications in terms of system call arguments. These policies are used for system call argument interposition. We compare two approaches working on the interpreter to find if any of these two can provide meaningful policies. The first is dynamic analysis, and the second is static analysis, which uses symbolic execution.

The symbolic execution was least effective as it provides policies only for a small portion of the system call arguments, less than ten per cent, and hinders normal execution of applications with these policies. The dynamic analysis solution fares better, providing a restriction for about forty per cent of the system call arguments. We conclude that automatic policy generation of system call arguments for interpreted applications is a meaningful endeavour.

Applications on Android phones which block spam calls could be argued a necessity for people unfortunate enough to have their number on spam lists. Third-party applications provide exten- sive, up-to-date blocklists to screen incoming calls. This paper analyses and describes how these types of applications store and access their data. First we analyse which applications keep their data offline on disk, then we take a look at applications which use the internet to query an in- coming phone call. We found four applications use a combination of both, two applications using exclusively online resources and four applications using offline resources only.

The aim of this research is to provide a structured approach for dynamically analysing Android applications, focusing on applications that block or flag suspected spam caller IDs. This paper discusses ways to determine how an application stores the data regarding the phone numbers, and what APIs it utilizes. In order to develop a methodology of what to search for while performing dynamic analysis, the research in this paper focuses on analysing one such Android application, using it as a template. Additionally, it provides insights and limitations on this analysed application, and potential improvements both on the techniques and tools used.

Spam calls are a widespread problem as people receive about 14 spam calls per month on average. In response, tens of applications are available in Google’s Play Store that aim to block these calls. While these apps have hundreds of millions of installations, there’s a lack of research into these applications. Research has been done on the user experience of these apps, but the inner workings of the apps have not been explored. Analyzing the inner workings can provide useful insights to combat spam calls more effectively. In this paper, we analyze the elements of the AndroidManifest.xml file of a set of 10 spam call blocking applications to identify aspects that are related to the blocking of spam calls and to find commonalities among the apps. Occurrences of specific elements and their attributes are summarized in this paper. Permissions related to managing phone calls and accessing the internet were found to be common, and services were identified that screen and manage phone calls. 2 apps were found to allow other apps to use their phone number information database, but this analysis did not identify usages by other apps. A complete analysis of all available spam call blocking apps could show the general usage of these and other components.

Spam calls are becoming an increasing problem, with people receiving multiple spam calls per month on average. Multiple Android applications exist that are able to detect spam calls and display a warning or block such calls. Little is known however on how these applications work and what numbers they block.
In this research, the following question is investigated: Can we do a brute force dynamic analysis on Android spam call blocking apps, to extract caller ID information from apps that cannot be or is not extracted through static analysis? A tool is created that is capable of doing such a dynamic analysis, by installing such an app on an emulator, sending emulated phone calls to the emulator, and using screenshot comparison techniques to determine whether the call is classified as allowed or blocked by the respective app. The tool developed in this research can, fully automated, test caller IDs on 8 different Android apps. Apart from a number of initial setup steps to install and configure the apps in the emulator, the tool takes about 1.5 seconds on average to analyze 1 caller IDs on one app.

In order to combat increasing spam calls, many applications are developed and downloaded to block those calls. Some studies about performance of the applications were previously conducted, however, the actual processes the applications go through to intercept and block the spam calls are not well studied. This research presents a method to systematically explore Android APIs that are responsible for intercepting and blocking the spam calls.

From 2019 into 2021, phishing incidents tripled, while phishing was found to be the largest used cyberattack vector. One commonly used type of phishing is a credential phishing attack over email. This is an act where an attacker tries to steal credential information from a target via a phishing website. This phishing website is delivered to the target over email. Even though much research has been done on the detection of such attacks, this rise in incidents was not prevented. In this thesis, it was found that a credential phishing attack over email consists of four phases, with an important phase being the attack conduction phase. This attack conduction phase comprises four stages. Most phishing detection systems focus on two of these stages, the ’email received’ stage and the ’website visited’ stage. Though, all research focused on either of the two stages, not a combination of both. Every research handled phishing emails and phishing websites as isolated entities. Also for any other stage, no research on detection was found comprising more than one stage in any of the phases in the credential phishing attack chain. To perform this research, a dataset containing both benign and phishing emails has been selected. The dataset originates from a combination of an openly available dataset and private datasets. Each email used originates from the period from 2015 up to 2022. To increase phishing detection capabilities, a more holistic approach to the phishing attack chain was introduced in this thesis. Emails and any (phishing) websites in that email were handled as one entity. This opened up new phishing detection capabilities. Features have been identified that made, amongst other aspects, use of brand recognition in both email and website. To extract these features, a brand recognition system has been created. This system is able to detect the logos of brands in emails and websites and name the brand associated with that logo. The system consists of a combination of neural networks and Google reverse image search. An XGBoost algorithm has been built on top of these brand recognition features. This resulted in a phishing detection system which was able to predict phishing emails from the dataset with a precision of .834 and a recall of .836. The extraction of the brand recognition features took on average 70.18 seconds per email. Though, this execution time grows linearly with the number of URLs present in an email. By building a phishing detection system of features using information from a combination of email domains, website domains, website URL redirects, certificates, email content such as brand names in text, domain registration dates, DMARC and SPF, an XGBoost model could be created with a precision of .957 and a recall of .943. The extraction of those features took 25.57 seconds on average. By combing all feature types (both brand recognition and non-brand recognition types), a precision of .967 and a recall of .947 could be obtained with an XGBoost model. This was called the ’Fusion module’. This Fusion module thus shows very decent phishing detection capabilities on the dataset. Using the same holistic approach as before, another phishing detection system was proposed. For this holistic approach, systems performing phishing detection at several stages in the credential phishing attack chain were combined into a single classification system. A Structure module has been designed and created, performing phishing detection solely on emails. This ’Structure module’ used 68 features focusing on the structural aspects of an email. The best classification performance of this model was obtained with an XGBoost algorithm, which had a precision of .977 and a recall of .957. A ’Website module’ performed phishing detection on whether a website was likely to be a phishing website. It used a simpler version of the brand recognition system used in the Fusion module. This module obtained a precision score of .661 and a recall of .775. The prediction of these two models for an email, along with the prediction of the Fusion module, was used as input for another machine learning model. A Support Vector Machine model was selected, and this model was then able to perform phishing detection on the dataset with a precision of .985 and a recall of .974. This holistic system thus showed improved performance over the individual prediction systems. The holistic system was able to increase overall phishing detection by combining phishing detection systems from different stages in a credential phishing attack over email.

The natural world is long-tailed: rare classes are observed orders of magnitudes less frequently than common ones, leading to highly-imbalanced data where rare classes can have only handfuls of examples. Learning from few examples is a known challenge for deep learning based classification algorithms, and is the focus of the field of low-shot learning. One potential approach to increase the training data for these rare classes is to augment the limited real data with synthetic samples. This has been shown to help, but the domain shift between real and synthetic hinders the approaches' efficacy when tested on real data. We explore the use of image-to-image translation methods to close the domain gap between synthetic and real imagery for animal species classification in data collected from camera traps: motion-activated static cameras used to monitor wildlife. We use low-level feature alignment between source and target domains to make synthetic data for a rare species generated using a graphics engine more "realistic". Compared against a system augmented with unaligned synthetic data, our experiments show a considerable decrease in classification error rates on a rare species.

In this paper, a method is proposed to artificially expand the dynamic range of screens with a limited dynamic range. This research is linked to a new film-making technology where, instead of using a green screen, the background of a scene is displayed on a screen in real time using a computer generated background. This provides real time lighting in the studio; however, due to the limited dynamic range of the screen, it can not fully replicate the brightness of light sources. Overcoming this problem involves capturing and synchronize frames that each display a small section of the wider dynamic range, defined as illumination maps. The method uses a pipeline in which the illumination maps are displayed on a monitor in a grouped order, which are then captured with a camera. The recording is processed by labeling the frames and selecting key frames. The key frames are then additively combined with compatible illumination maps, which result in a video of the full dynamic range.
A program was developed as a proof of concept, providing expected results. For various recording inputs, It was also found that the implemented program discarded a lot of the frames of the recordings. A variation of the proposed method also yielded a slight speed-up, for practically the same results.
The proposed method provides a good starting point tackling the problem of artificially extending the dynamic range. The program used is a step in the right direction, but has flaws that limit its usefulness.

With a large move to virtual production in films, where a large screen displaying a rendered scene is used as an alternative to replacing a green screen, there is a need for simple and effective camera tracking. Infrared tracking is widely used in the industry however it creates a barrier to entry for small productions without limited budgets. As an alternative, visual tracking markers (tags) can be used however they come with limitations as they are highly visible and distract the viewer from the film. This paper aims to answer "Can camera tracking fiducial markers (tags) be blended into the background to reduce their visibility whilst still being tracked?". We describe a method to find locations where tags can be placed to reduce their obtrusiveness. Additionally, we explore various blending methods to blend tags whilst retaining their tracking capability. Our findings indicate that blending methods are effective in reducing the visibility of tags yet still be detected but improvements are needed in determining the optimal blending method for different scenarios.

Network covert timing channels are techniques to covertly transmit information over computer networks, by utilizing the time between subsequent network packets. Previous work on the detection of the various techniques has introduced numerous new methods, with high reported success. From these previous works we have noticed that there is little confirmation on these results in subsequent works, as well as there being a lack of an overview for the efficiency of each method. Next to this, we have found that many works use data in their experiments that may not be representative of real network scenarios. In this thesis we attempt to remedy this lack of information, by performing a broad performance evaluation on the currently existing singular detection metrics. This performance evaluation was done on a total of 18 different detection methods, applied to the 8 most prevalent covert timing channels. For the underlying network data, we gathered SSH and HTTPS traffic from the TU Delft, and applied varying amounts of simulated network jitter to them. From the resulting evaluations we find that there are cases where the detection methods do perform similarly to what has been shown in previous work, but we also find those that have a large difference in performance. Further, we discuss possible strengths and weaknesses of each of the detection methods, based on their performance, and in some cases how this performance might be improved. Using the (simulated) network scenarios we show the effects that jitter and different traffic types can have on each of the detection methods, and also find those that are resilient to network effects. Finally, we combine the full experimental performance evaluations into a comprehensive overview, for each combination of detection method and covert channel technique. We find that the current detection methods are likely not sufficient to be reliably applied in a realistic network setting, and more work needs to be done in this field to reach that point. The overview and discussions we have provided can then serve as a basis for future research, to give an indication of where performance needs to be improved.