Contributions published at Department of Informatics (Burkhard Stiller)

null

Within the growing debate about sustainability issues, a variety of research communities emerged to connect the fields of sustainable development and ICT. Each of them addresses the link between sustainable development and digital technologies from a slightly different angle. However, the overlaps and blurred boundaries in the scope of research exist. Taking “Doughnut economics” as a foundation and inspired by the LES model, we propose a new conceptual framework to structure the ICT for Sustainability (ICT4S) research landscape. The new model encompasses both environmental and social effects in line with socio-ecological systems thinking. We go one step further and propose to incorporate a decision-making dimension to represent the research of the governance, strategies and policies with respect to ICT effects. We proceed by exploring how this framework could be used to position research fields and communities according to their scope of interest and, by doing so, find synergies between research communities and within the ICT4S landscape. Our aim is to contribute in creating tools to foster dialogue and bridge fragmented research fields and communities interested in ICT impacts on sustainable development.

Deep learning models, particularly Convolutional Neural Networks (CNNs), have achieved remarkable success in image classification tasks. However, their lack of interpretability raises concerns about their trustworthiness, especially in high-risk domains like healthcare. To improve transparency, Explainable Artificial Intelligence (XAI) techniques have been developed. This thesis has a primary focus on expanding the Layerwise Origin Target Synthesis (LOTS) method, which is originally designed as a technique for generating adversarial images, to incorporate visualization capabilities. The aim is to address the limitations observed in current CAM-based visualization techniques that only offer broad area visualizations. The research explores methods for evaluating and comparing visualization techniques in the absence of a standard evaluation metric framework. Additionally, it investigates the applicability of the extended LOTS visualization technique to classes not present in the training dataset. Based on our findings, the LOTS visualization algorithm we propose, generates more focused visualizations that do not require explicit class specification, thereby also serving as a valuable tool for evaluating image quality within a training set. Furthermore, by adjusting the size of the Gaussian blur filter, it is possible to highlight fine locations in an image. Moreover, we demonstrate the potential for extending the LOTS algorithm to classes not included in the training dataset, although further research is required for validation. Lastly, we emphasize the importance of a standardized evaluation metrics framework.

This project applied a hierarchy-aware and cross-lingual approach to classify job tasks (e.g.: {Verpackungsarbeiten allgemein und in Medizinaltechnik}) from German job advertisements using the ONET English ontology which is a complex ontology with three hierarchical level and fine-grained classes. Two methods, machine translation and multilingual models, are tested to bridge the language gap. The project consisted of two sets of experiments: local classifier experiments using transformer-based models at each hierarchical level, and global hierarchical models on the O*NET data. This work yields several key findings: Firstly, domain adaptation proved effective, with job domain-specific language models outperforming general domain models. Translation quality also influenced classification performance, with DeepL outperforming the SJMM engine. Secondly, state-of-the-art models (TextRNN, TextRCNN, HMCN, HiAGM) were used as global hierarchical models for task classification. These models effectively incorporated hierarchical information, addressing inconsistencies and overfitting through recursive regularization. Furthermore, the best model configurations from both series of experiments are selected to predict job advertisement data, resulting in reliable classification using the O*NET hierarchical ontology. Human post-evaluation, conducted by a German-speaking domain expert, validates the accuracy of the models' predictions. Overall, while this project extensively tested the feasibility of hierarchy-aware classification models, the transformer-based flat model Job-GBERT proves to be a more suitable option for the hierarchical classification of Job Ads data, given its specificity.

Collaborative research is becoming increasingly more important and is associated with higher productivity and producing high-quality research output. It serves as a key mechanism for knowledge diffusion within a research community. In this thesis collaborations in computer science denoted by co-authorships in research publications are analyzed and visualized to uncover the social interactions and relationships between authors, institutions and countries. Bibliographic data from DBLP and detailed author information from CSRankings are collected to create a large-scale collaboration network that includes 76’546 publications from 127 conferences, 148’379 collaborations, and 14’555 authors from 597 institutions located across 55 countries. An exploratory data analysis is conducted, and the network is visualized using the advancements in deep learning on graphs with Graph Convolutional Networks. The publicly available CSCollab tool is introduced, which allows filtering the network based on the geographical scope, the research areas and the year of publication. It provides a visualization of the network on an interactive geographical map, an interactive graph visualization, various visualizations of analytics and statistics of the networks, and features to explore the underlying data of the collaborations.

The Internet of Things (IoT) has grown exponentially in recent years and it is predicted that the number of devices will double again to 30 billion by 2030 [24]. At the same time, the number of unpatched, vulnerable and infected devices connected to the Internet is increasing exponentially as well. Famous malware incidents from the past like Mirai have painfully illustrated how vulnerable IoT devices are on a broad scale. This work examines how Moving Target Defense (MTD) can be used in a collaborative framework for defense in depth and to thwart cyberattacks. For this purpose, a system prototype has been implemented that is capable of autonomously learning to defend a set of IoT devices (more specifically Radio Frequency Spectrum Sensors belonging to ElectroSense) from a specific set of malware by selecting and deploying Moving Target Defenses (MTDs). In scientific literature, usually individual MTDs optimized against specific attacks are presented, but no collaborative framework that combines and orchestrates a set of MTDs. In the prototypical implementation, an individual local agent is deployed on a set of simulated device, monitoring the behavior of its host, according to 100 system parameters. In case an attack is detected, the local agent is invoked in order to select from a set of MTD to ward off the attack. If the post-MTD device behavior can be considered normal again, the local agent receives a reward, which is used to update the local policy. Thanks to the use of FL, all local agents contribute to learning one global defense policy together. The project shows that a good attack mitigation probability can be achieved in non-federated as well as federated learning setting. Furthermore, the system also proves to be somewhat robust against locally and globally skewed sample distribution. Under certain assumptions it can also be assumed that collaborative learning of an MTD selection policy is faster and more robust than centralized learning. The findings on how FRL can be used in IT security to collaboratively learn an MTD selection policy contribute to the state of the art on MTD.

ICT hold significant potential to increase resource and energy efficiencies and contribute to a circular economy. Yet unresolved is whether the aggregated net effect of ICT overall mitigates or aggravates environmental burdens. While the savings potentials have been explored, drivers that prevent these and possible counter measures have not been researched thoroughly. The concept digital sufficiency constitutes a basis to understand how ICT can become part of the essential environmental transformation. Digital sufficiency consists of four dimensions, each suggesting a set of strategies and policy proposals: (a) hardware sufficiency, which aims for fewer devices needing to be produced and their absolute energy demand being kept to the lowest level possible to perform the desired tasks; (b) software sufficiency, which covers ensuring that data traffic and hardware utilization during application are kept as low as possible; (c) user sufficiency, which strives for users applying digital devices frugally and using ICT in a way that promotes sustainable lifestyles; and (d) economic sufficiency, which aspires to digitalization supporting a transition to an economy characterized not by economic growth as the primary goal but by sufficient production and consumption within planetary boundaries. The policies for hardware and software sufficiency are relatively easily conceivable and executable. Policies for user and economic sufficiency are politically more difficult to implement and relate strongly to policies for environmental transformation in general. This article argues for comprehensive policies for digital sufficiency, which are indispensible if ICT are to play a beneficial role in overall environmental transformation.

With the rapid escalation in prevalence and severity of Distributed Denial of Service (DDoS) attacks, the need for robust and effective countermeasures has become paramount. This thesis presents a unique approach to tackling this issue through the development of an emulator tool that generates distributed DDoS datasets. Addressing the limitations of existing, predominantly centralized DDoS datasets, this tool provides a distributed perspective, offering critical insights into the dynamics of these attacks. Built upon the open-source flexibility of Network Simulator 3 (NS3), the emulator is capable of modeling SYN flood traffic, ICMP flood traffic, and legitimate traffic, each one based on pre-existing datasets, thereby increasing the richness and realism of simulated DDoS scenarios. The tool's architectural design allows for comprehensive configuration of network structures that can realistically span multiple countries, significantly enhancing the range of attack scenarios that can be explored. Providing outputs in the widely used PCAP format and featuring a straightforward command-line interface, the tool is designed to be highly accessible for both research and deployed applications. In essence, this tool constitutes a significant step forward in DDoS research, laying a solid foundation for future enhancements. It stands as a testament to the potential for improving our understanding and mitigation strategies in the face of increasingly complex and destructive DDoS attacks. The insights it offers into attack dynamics mark a valuable addition to the ongoing efforts in network security.

In recent years, the frequency and scale of Distributed Denial-of-Service (DDoS) attacks have increased significantly, yet they remain an unsolved problem. Many intrusion detection systems employ shared attack fingerprints and signatures as a standard practice to detect cyber attacks. For DDoS attacks, a single attack fingerprint typically is not enough to detect other attacks of the same kind. However, attack fingerprints can still be useful, especially when the same attack is observed from multiple locations. Thus, this work proposes Reassembler, a tool that enables global analysis of DDoS attacks based on attack fingerprints recorded at different locations. For this, multiple attack scenarios are specified using a custom-built simulated network. Based on the attack scenarios, the Reassembler solution is implemented, analyzing and aggregating attack fingerprints into a global view. Reassembler is evaluated based on four simulated and one real use case (based on real DDoS network traces), demonstrating that the Reassembler can derive interesting properties such as the number of intermediate nodes or the estimated percentage of spoofed IPs. Based on different experiments, it is shown under which circumstances the Reassembler performs best and where improvements are needed.

The number of Cyber-Physical Systems (CPS) available in industrial environments is growing mainly due to the evolution of the Internet-of-Things (IoT) paradigm. In such a context, radio frequency spectrum sensing in industrial scenarios is one of the most interesting applications of CPS due to the scarcity of the spectrum. Despite the benefits of operational platforms, IoT spectrum sensors are vulnerable to heterogeneous malware. The usage of behavioral fingerprinting and machine learning has shown merit in detecting cyberattacks. Still, there exist challenges in terms of (i) designing, deploying, and evaluating ML-based fingerprinting solutions able to detect malware attacks affecting real IoT spectrum sensors, (ii) analyzing the suitability of kernel events to create stable and precise fingerprints of spectrum sensors, and (iii) detecting recent malware samples affecting real IoT spectrum sensors of crowdsensing platforms. Thus, this work presents a detection framework that applies device behavioral fingerprinting and machine learning to detect anomalies and classify different botnets, rootkits, backdoors, ransomware and cryptojackers affecting real IoT spectrum sensors. Kernel events from CPU, memory, network,file system, scheduler, drivers, and random number generation have been analyzed, selected, and monitored to create device behavioral fingerprints. During testing, an IoT spectrum sensor of the ElectroSense platform has been infected with ten recent malware samples (two botnets, three rootkits, three backdoors, one ransomware, and one cryptojacker) to measure the detection performance of the framework in two different network configurations. Both supervised and semi-supervised approaches provided promising results when detecting and classifying malicious behaviors from the eight previous malware and seven normal behaviors. In particular, the framework obtained 0.88–0.90 true positive rate when detecting the previous malicious behaviors as unseen or zero-day attacks and 0.94–0.96 F1-score when classifying them

Control design for robotic systems is complex and often requires solving an optimization to follow a trajectory accurately. Online optimization approaches like Model Predictive Control (MPC) have been shown to achieve great tracking performance, but require high computing power. Conversely, learning-based offline optimization approaches, such as Reinforcement Learning (RL), allow fast and efficient execution on the robot but hardly match the accuracy of MPC in trajectory tracking tasks. In systems with limited compute, such as aerial vehicles, an accurate controller that is efficient at execution time is imperative. We propose an Analytic Policy Gradient (APG) method to tackle this problem. APG exploits the availability of differentiable simulators by training a controller offline with gradient descent on the tracking error. We address training instabilities that frequently occur with APG through curriculum learning and experiment on a widely used controls benchmark, the CartPole, and two common aerial robots, a quadrotor and a fixed-wing drone. Our proposed method outperforms both model-based and model-free RL methods in terms of tracking error. Concurrently, it achieves similar performance to MPC while requiring more than an order of magnitude less computation time. Our work provides insights into the potential of APG as a promising control method for robotics. To facilitate the exploration of APG, we open-source our code and make it available atgithub.com/lis-epfl/apg_trajectory_tracking.

Recently, neural control policies have outperformed existing model-based planning-and-control methods for autonomously navigating quadrotors through cluttered environments in minimum time. However, they are not perception aware, a crucial requirement in vision-based navigation due to the camera's limited field of view and the underactuated nature of a quadrotor. We propose a learning-based system that achieves perception-aware, agile flight in cluttered environments. Our method combines imitation learning with reinforcement learning (RL) by leveraging a privileged learning-by-cheating framework. Using RL, we first train a perception-aware teacher policy with full-state information to fly in minimum time through cluttered environments. Then, we use imitation learning to distill its knowledge into a vision-based student policy that only perceives the environment via a camera. Our approach tightly couples perception and control, showing a significant advantage in computation speed (10×faster) and success rate. We demonstrate the closed-loop control performance using hardware-in-the-loop simulation.

Recently, Model Predictive Contouring Control (MPCC) has arisen as the state-of-the-art approach for model-based agile flight. MPCC benefits from great flexibility in trading-off between progress maximization and path following at runtime without relying on globally optimized trajectories. However, finding the optimal set of tuning parameters for MPCC is challenging because (i) the full quadrotor dynamics are non-linear, (ii) the cost function is highly non-convex, and (iii) of the high dimensionality of the hyperparameter space. This paper leverages a probabilistic Policy Search method—Weighted Maximum Likelihood (WML)—to automatically learn the optimal objective for MPCC. WML is sample-efficient due to its closed-form solution for updating the learning parameters. Additionally, the data efficiency provided by the use of a model-based approach allows us to directly train in a high-fidelity simulator, which in turn makes our approach able to transfer zero-shot to the real world. We validate our approach in the real world, where we show that our method outperforms both the previous manually tuned controller and the state-of-the-art auto-tuning baseline reaching speeds of 75 km/h.

Quadrupedal robots are conquering various applications in indoor and outdoor environments due to their capability to navigate challenging uneven terrains. Exteroceptive information greatly enhances this capability since perceiving their surroundings allows them to adapt their controller and thus achieve higher levels of robustness. However, sensors such as LiDARs and RGB cameras do not provide sufficient information to quickly and precisely react in a highly dynamic environment since they suffer from a bandwidth-latency trade-off. They require significant bandwidth at high frame rates while featuring significant perceptual latency at lower frame rates, thereby limiting their versatility on resource constrained platforms. In this work, we tackle this problem by equipping our quadruped with an event camera, which does not suffer from this tradeoff due to its asynchronous and sparse operation. In leveraging the low latency of the events, we push the limits of quadruped agility and demonstrate high-speed ball catching for the first time. We show that our quadruped equipped with an event-camera can catch objects with speeds up to 15 m/s from 4 meters, with a success rate of 83%. Using a VGA event camera, our method runs at 100 Hz on an NVIDIA Jetson Orin.

Recently, learning-based controllers have been shown to push mobile robotic systems to their limits and provide the robustness needed for many real-world applications. However, only classical optimization-based control frameworks offer the inherent flexibility to be dynamically adjusted during execution by, for example, setting target speeds or actuator limits. We present a framework to overcome this shortcoming of neural controllers by conditioning them on an auxiliary input. This advance is enabled by including a feature-wise linear modulation layer (FiLM). We use model-free reinforcement-learning to train quadrotor control policies for the task of navigating through a sequence of waypoints in minimum time. By conditioning the policy on the maximum available thrust or the viewing direction relative to the next waypoint, a user can regulate the aggressiveness of the quadrotor's flight during deployment. We demonstrate in simulation and in real-world experiments that a single control policy can achieve close to time-optimal flight performance across the entire performance envelope of the robot, reaching up to 60 km/h and 4.5 g in acceleration. The ability to guide a learned controller during task execution has implications beyond agile quadrotor flight, as conditioning the control policy on human intent helps safely bringing learning based systems out of the well-defined laboratory environment into the wild.

Malware affecting Internet of Things (IoT) devices is rapidly growing due to the relevance of this paradigm in real-world scenarios. Specialized literature has also detected a trend towards multi-purpose malware able to execute different malicious actions such as remote control, data leakage, encryption, or code hiding, among others. Protecting IoT devices against this kind of malware is challenging due to their well-known vulnerabilities and limitation in terms of CPU, memory, and storage. To improve it, the moving target defense (MTD) paradigm was proposed a decade ago and has shown promising results, but there is a lack of IoT MTD solutions dealing with multi-purpose malware. Thus, this work proposes four MTD mechanisms changing IoT devices' network, data, and runtime environment to mitigate multi-purpose malware. Furthermore, it presents a lightweight and IoT-oriented MTD framework to decide what, when, and how the MTD mechanisms are deployed. Finally, the efficiency and effectiveness of the framework and MTD mechanisms are evaluated in a real-world scenario with one IoT spectrum sensor affected by multi-purpose malware.

Crowdsensing platforms collect, process, transmit, and analyze spectrum data worldwide to optimize radio frequency spectrum usage. However, Internet-of-Things (IoT) spectrum sensors, performing some of the previous tasks, are exposed to software manipulation aiming to execute spectrum sensing data falsification (SSDF) attacks to compromise data integrity and spectrum optimization. Novel intrusion detection systems (IDSs) combining device fingerprinting with Machine and Deep Learning (ML/DL) improve the limitation of traditional solutions and remove the necessity of redundant sensors and reputation mechanisms. However, they fail when detecting SSDF attacks accurately while protecting sensors privacy. This work proposes a novel host-based and federated learning-oriented IDS for IoT spectrum sensors that considers unsupervised ML/DL and fingerprints based on system calls. The framework detection performance and consumption of resources are analyzed in local and federated scenarios with six spectrum sensors deployed on Raspberry Pis. The obtained results significantly improve related work when detecting SSDF attacks while protecting sensors privacy, and consuming CPU, memory, and storage of sensors in a reduced manner.

Software developers spend about a quarter of their workday using the web to fulfill various information needs. Searching for relevant information online can be time-consuming, yet acquired information is rarely systematically persisted for later reference. In this work, we introduce SALI, an approach for semi-automated linking web pages to source code locations inline with the source code. SALI helps developers naturally capture high-quality, explicit links between web pages and specific source code locations by suggesting links for curation within the IDE. Through two laboratory studies, we examined the developer’s ability to both curate and consume links between web pages and specific source code locations while performing software development tasks. The studies were performed with 20 subjects working on realistic software change tasks from widely-used open-source projects. Results showed that developers continuously and concisely curate web pages at meaningful locations in the code with little effort. Additionally, we showed that other developers could use these curations while performing new and different change tasks to speed up relevant information gathering within unfamiliar codebases by a factor of 2.4.

Traditionally, IoT crowdsensing devices have been outside the cryptomining domain due to their limitations in terms of computational power. In 2014, Monero (XNR) changed this situation forever. Monero is an open-source digital payment token that can be mined in resource-constrained devices like IoT and single-board computers. Despite the Monero advantages, it opened the door for cryptojackers illicitly mining cryptocurrencies by exploiting well-known vulnerabilities of IoT devices. Existing detection solutions provide good performance while detecting the mining phase of cryptojackers, but early detection is desired to avoid malware spreading and resource misuse. Thus, this work proposes a framework that combines device behavioral fingerprinting and machine learning to detect and classify preparatory phases of cryptojackers. The framework has been deployed in a crowdsensing IoT spectrum sensor, Raspberry Pi, infected by a recent cryptojacker called Linux.MulDrop.14. Promising detection results demonstrate the framework’s suitability while detecting early phases of cryptojackers.