Pedro Miguel Sánchez Sánchez, Alberto Huertas Celdran, Timo Schenk, Adrian Lars Benjamin Iten, Gérôme Bovet, Gregorio Martínez Pérez, Burkhard Stiller, Studying the Robustness of Anti-Adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors, IEEE Transactions on Dependable and Secure Computing, Vol. 21 (2), 2024. (Journal Article)
Device fingerprinting combined with Machine and Deep Learning (ML/DL) report promising performance when detecting spectrum sensing data falsification (SSDF) attacks. However, the amount of data needed to train models and the scenario privacy concerns limit the applicability of centralized ML/DL. Federated learning (FL) addresses these drawbacks but is vulnerable to adversarial participants and attacks. The literature has proposed countermeasures, but more effort is required to evaluate the performance of FL detecting SSDF attacks and their robustness against adversaries. Thus, the first contribution of this work is to create an FL-oriented dataset modeling the behavior of resource-constrained spectrum sensors affected by SSDF attacks. The second contribution is a pool of experiments analyzing the robustness of FL models according to i) three families of sensors, ii) eight SSDF attacks, iii) four FL scenarios dealing with anomaly detection and binary classification, iv) up to 33% of participants implementing data and model poisoning attacks, and v) four aggregation functions acting as anti-adversarial mechanisms. In conclusion, FL achieves promising performance when detecting SSDF attacks. Without anti-adversarial mechanisms, FL models are particularly vulnerable with > 16% of adversaries. Coordinate-wise-median is the best mitigation for anomaly detection, but binary classifiers are still affected with > 33% of adversaries. |
|
Pedro Miguel Sánchez Sánchez, Alberto Huertas Celdran, José R Buendía Rubio, Gérôme Bovet, Gregorio Martínez Pérez, Robust Federated Learning for execution time-based device model identification under label-flipping attack, Cluster Computing, Vol. 27 (1), 2024. (Journal Article)
The computing device deployment explosion experienced in recent years, motivated by the advances of technologies such as Internet-of-Things (IoT) and 5G, has led to a global scenario with increasing cybersecurity risks and threats. Among them, device spoofing and impersonation cyberattacks stand out due to their impact and, usually, low complexity required to be launched. To solve this issue, several solutions have emerged to identify device models and types based on the combination of behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques. However, these solutions are not appropriate for scenarios where data privacy and protection are a must, as they require data centralization for processing. In this context, newer approaches such as Federated Learning (FL) have not been fully explored yet, especially when malicious clients are present in the scenario setup. The present work analyzes and compares the device model identification performance of a centralized DL model with an FL one while using execution time-based events. For experimental purposes, a dataset containing execution-time features of 55 Raspberry Pis belonging to four different models has been collected and published. Using this dataset, the proposed solution achieved 0.9999 accuracy in both setups, centralized and federated, showing no performance decrease while preserving data privacy. Later, the impact of a label-flipping attack during the federated model training is evaluated using several aggregation mechanisms as countermeasures. Zeno and coordinate-wise median aggregation show the best performance, although their performance greatly degrades when the percentage of fully malicious clients (all training samples poisoned) grows over 50%. |
|
José M Jorquera Valero, Pedro M Sánchez Sánchez, Manuel Gil Pérez, Alberto Huertas Celdran, Gregorio Martínez Pérez, Cutting-Edge Assets for Trust in 5G and Beyond: Requirements, State-of-the-Art, Trends & Challenges, ACM Computing Surveys, Vol. 55 (11), 2023. (Journal Article)
In 5G and beyond, the figure of cross-operator/domain connections and relationships grows exponentially among stakeholders, resources, and services, being reputation-based trust models one of the capital technologies leveraged for trustworthy decision-making. This work studies novel 5G assets on which trust can be used to overcome unsuitable decision-making and address current requirements. First, it introduces a background and general architecture of reputation-based trust models. Afterward, it analyzes pivotal 5G assets on which trust can enhance their performance. Besides, this article performs a comprehensive review of the current reputation models applied to 5G assets and compares their properties, features, techniques, and results. Finally, it provides current trends and future challenges to conducting forthcoming research in the area. |
|
Viachaslau Berasneu, Design and Implementation of a System for Reproducible Machine and Deep Learning Models, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
In recent years, small and midsize enterprises (SMEs) have become increasingly reliant on technology, but lag in terms of investment into cybersecurity. This renders them vulnerable to malware attacks, which are increasingly targeting companies rather than individuals, with great economic impact. This project proposes and implements a prototype tool, which allows for machine learning models to be trained, stored, and tested within the SecBox sandbox environment. Both classification and anomaly detection models are implemented through Scikit-learn, in order to provide predictions about known malware types (binary and multiclass classification), as well as detecting the presence of unseen malware in real-time during the SecBox execution. The models are trained using the system call and resource usage file execution logs available from the SecBox, which are transformed into suitable formats using frequency-based and sequence-based data preprocessing. Model reproducibility is ensured by generating configuration files with references to the random seeds, the datasets used in training, as well as other model parameters, which can be used to re-train the same model. To evaluate and compare model performance, each model type is tested in a realistic scenario of the execution of Monti ransomware within the SecBox, creating a confusion matrix as well as calculating the accuracy, precision, recall and F1-score metrics based on the model predictions. The system call classifier models are shown to have the best performance when classifying Monti malware samples, and the project is concluded by specifying several relevant research areas to be investigated further. |
|
Florian Andreas Herzog, Fully Fledged SDN in a LoRa Mesh, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
This bachelor-thesis tries to incorporate Software Defined Networking (SDN) mechanisms into a Long Range (LoRa) Internet of Things (IoT) mesh. Typically, devices used in LoRa-based wireless sensor networks (WSN) are limited in range. Therefore, in a scenario where a significant amount of nodes would be out of range of the LoRa Wide Area Network (LoRaWAN), deploying a mesh topology is a simple yet effective way to connect far away nodes using multi-hop communication. SDN, on the other hand, aims to improve network performance by analyzing the network and applying smart optimization algorithms. The hardware used in this thesis, are nodes being a Raspberry Pi, a popular choice inIoT, and the E32-868T20D LoRa Shield, a budget-friendly option to adapt LoRa technology. The software is implemented in Java, a programming language that promotes human-readability in code and benefits from decades of experience in practical software development. While LoRa networks with mesh topologies have already been subject of previous research using various devices and programming languages, the goal of this thesis is to test the effectiveness of SDN-based mechanisms in improving a LoRa mesh network and finally providing a user-friendly API as a service to other applications as a transmitter of data. Disclaimer: Neither the product, nor the analysis of SDN-based mechanisms have reached a state of success. |
|
Gregory Frommelt, Linux on Tensilica Xtensa, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
The Internet-of-Things (IoT) is becoming increasingly integral to modern living, offering a wide range of applications across diverse devices employing a multitude of different operating systems (OS). While Linux is the most prevalent OS in the IoT landscape, its resource requirements often prevent its use on less powerful, cost-efficient devices like those in the ESP32 family of microcontrollers (MCUs). The goal of this thesis is therefore to explore the feasibility of porting Linux to ESP32 devices, motivated by both economic and IoT standardization incentives. A cost analysis reveals an approximately 80% reduction in expenses when using the ESP32-WROVER-IE module compared to the Raspberry Pi Zero W. A tool chain was constructed to compile a Linux kernel image, which was successfully ported to an ESP32-S3-DevKitC-1 board. Initial evaluations indicate that the ported system offers basic functionality suitable for IoT tasks, although certain limitations currently restrict its practical utility. |
|
Muyao Dong, Design and Implementation of a Business-driven Threat Quantification Framework, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
Nowadays, companies and organizations invest in cybersecurity more and more as they are operating with digital information systems. Cyber risk management presents a well-defined path toward the management of critical assets, threats, and countermeasures. Within cyber risk management, threat modeling is a structured process to identify potential threats, and in this process, it is significant to evaluate each threat and estimate its potential impacts.
Although threat modeling methodologies have been developed in depth, most of them focus on threat identification in di↵erent contexts, while how to quantify their impact for further inspection is less discussed. This thesis works on designing a framework to fill in this gap. The main outcome of this thesis is a framework that guides users to evaluate and quantify cyber threats in business contexts. The framework integrates applicable business impacts, calculates and visualizes the impacts of cyber threats, providing users with an intuitive picture of cyber threats analysis in the view of business. The prototype is well developed and properly evaluated, and the usability of the prototype is of satisfaction. |
|
Jordi Küffer, ARTIS - Art Tracking with IoT and Blockchain, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
This thesis delves into the convergence of the Internet of Things (IoT) and Blockchain technologies, focusing on the innovative application of these technologies within artwork transportation. The main goal is to introduce a system that capitalizes on IoT and blockchain to enhance the tracking and management of artwork during transportation processes.
In pursuit of this goal, the study adopts a dual-pronged methodology. A comprehensive literature review provides a foundational understanding of the underlying principles. Subsequently, an applied research approach is employed, culminating in designing, implementing, and evaluating a prototype tailored to the intricacies of artwork transportation.
The outcome of this thesis is ARTIS, a real-world prototype that effectively supports the targeted artwork tracking use case. However, it is acknowledged that further strides are needed to refine the prototype, particularly in safeguarding sensitive data and optimizing sensor accuracy.
The significance of this work lies in its innovative amalgamation of IoT and blockchain technologies, presenting a novel avenue for addressing challenges in the artwork transportation domain. By demonstrating the feasibility of such a system, this thesis lays the groundwork for future endeavors to advance this concept into a production-ready solution. |
|
Vichhay Ok, Design and Implementation of a Reproducible and Realistic Data Collection System for Dynamic Malware Analysis, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
This thesis addresses the need for improved tools in dynamic malware analysis by enhancing the existing SecBox platform; a lightweight, container-based malware analysis sandbox. The enhancements aim at ensuring accurate, consistent, and reproducible analysis of diverse malware types. The thesis delves into the principles of dynamic malware analysis and what constitutes reproducibility, enabling an in-depth understanding of the problem space. The enhanced SecBox platform includes a command recorder to meticulously record and replicate commands and a CSV generator to monitor system metrics like CPU and RAM usage. Through evaluations with four types of malware, one of which was a custom script, the revamped SecBox platform demonstrated high consistency across sandbox instances, underscoring its usefulness in reproducible dynamic malware analysis. |
|
Dario Gagulic, Computing the Trustworthiness Level of Black Box Machine and Deep Learning Models, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
The field of Artificial Intelligence (AI) is rapidly evolving and increasingly being integrated into our everyday life. Black Box Machine and Deep Learning systems support humans in making important decisions in safety-critical industries, that consequently influence the lives of real people. This has raised the need for the ability to assess the model’s trustworthiness. Trust is a subjective concept and depends on many factors. As Black Box models grow bigger and become more complex, it has become impossible, even for domain experts, to understand their reasoning and analyze how such models derive conclusions. Luckily, early work has developed automatic tools that allow the computation and evaluation of trust in a particular system, based on the pillars called fairness, explainability, robustness, and methodology. The algorithm computes various metrics and relies on the user to upload the model, the used dataset, and the FactSheet describing the applied training methodology. This forms a problem when computing the trustworthiness level of Black Box Machine and Deep Learning models with limited data access. Notably, the presented work identified two common definitions of the term Black Box established in the research community. The first focuses on complex systems with limited interpretability, and the underexplored second definition with respect to trustworthiness assessment describes systems with limited information available. Therefore, this master’s thesis introduces a Black Box Taxonomy, categorizing Machine Learning models based on interpretability into different subgroups and adding another dimension distinguishing their available information levels. Further, a novel approach is proposed introducing a synthetic dataset generator to compute the trust score of Black Box models. The generator offers two approaches (MUST and MAY) to balance privacy and accuracy concerns. This solution addresses incomputable metrics, leading to a more accurate trustworthiness assessment. In order to validate the approach, the implementation was evaluated on two real-world scenarios. |
|
Lynn Zumtaugwald, Designing and Implementing an Advanced Algorithm to Measure the Trustworthiness Level of Federated Learning Models, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
Artificial intelligence (AI) has immersed our daily lives and assists in the decision process of critical sectors such as medicine and law. Therefore it is now more important than ever before that AI systems developed are reliable, ethical, and do not cause harm to humans. The High-Level Expert Group on AI (AI-HLEG) of the European Commission has laid the foundation by defining seven key requirements for trustworthy AI systems.
To address concerns about privacy risks associated with centralized learning approaches federated learning (FL) has emerged as a promising and widely used alternative. FL allows multiple clients to collaboratively train machine learning models without the need for sharing private data. Because of the high adaption of FL systems, ensuring that they are trustworthy is crucial. Previous research efforts have proposed a trustworthy FL taxonomy with six pillars, each comprehensively defined with notions and metrics. This taxonomy covers six of the seven requirements defined by the AI-HLEG. However, one notable aspect that has been largely overlooked by research is the requirement for environmental well-being in trustworthy AI/FL. This leaves a significant gap between the expectations set by governing bodies and the guidelines applied and measured by researchers.
This master thesis addresses this gap by introducing the sustainability pillar to the trustworthy FL taxonomy and thus presenting the first taxonomy that comprehensively addresses all the requirements defined by the AI-HLEG. The sustainability pillar focuses on assessing the environmental impact of FL systems and incorporates three main aspects: hardware efficiency, federation complexity, and the carbon intensity of the energy grid, each with well-defined metrics. As a second contribution, this master thesis extends an existing prototype to evaluate the trustworthiness of FL systems with the sustainability pillar.
The prototype is then extensively evaluated in various scenarios, involving different federation configurations. The results shed light on the trustworthiness of different federation configurations in different settings with varying complexities, hardware, and energy grids used. Importantly, the sustainability pillar’s score corrects the overall trust score by considering the environmental impact of FL systems across seven key pillars. Thus, the proposed taxonomy and prototype are the first to comprehensively address all seven AI-HLEG requirements and lay the foundation for a more accurate trustworthiness assessment of FL systems. |
|
Tim Portmann, Data Discovery in a DDoS Data Mesh Network, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
Distributed Denial-of-Service (DDoS) attacks continue to pose a persistent threat in today’s digital landscape. Collaborative defense approaches continuously gain popularity by proposing a distributed defense approach for a distributed attack. Central to such collaborative defense approaches is the exchange of DDoS attack data amongst the parties of the defense architecture.
While existing research proposes concepts that enable the collaborative sharing of DDoS information, data-centric solutions remain scarce. Oftentimes, the proposed concepts share a common drawback: Their dependence on specific technologies or hardware that restricts their broad adoption.
This thesis aims to propose a data-centric solution that enables decentralized parties in a collaborative DDoS defense architecture to exchange DDoS attack information. The proposed solution utilizes a data mesh network to handle information exchange, complemented by a data discovery service to act upon the exchanged DDoS data.
First, extensive research into the subject and tools available to build a DDoS data mesh architecture is explored. Subsequently, a design proposal for the DDoS data mesh architecture, including data discovery capabilities, is described. Based on this design, a DDoS data mesh prototype is implemented and deployed, using the tools explored earlier. Finally, the data mesh is evaluated in regard to its performance and data discovery capabilities.
The solution proposed utilizes a technology stack consisting of MySQL instances as DDoS data repositories, Trino as a distributed query engine, and Apache Superset as the data discovery service. This combination enables the efficient exchange and exploration of DDoS data, making it effective for collaborative DDoS defense scenarios and a viable data-centric solution for the exchange of DDoS attack data. |
|
Jie Liao, Bluetooth Low Energy Device Classifier, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
In 2011, the introduction of Bluetooth Low Energy (BLE) marked a significant shift in wireless communication, paving the way for the Internet of Things (IoT) and the rise of location-based trackers. While devices like Apple's AirTag provide convenience, they pose security risks, notably the potential for malicious actors to track individuals unbeknownst to them. This work aims to address security concerns related to BLE trackers, especially considering the disparity between protections for iOS and Android users. The research focuses on creating an Android application, improving upon previous tools like HomeScout, which had limited classification capabilities. A feature based prototype was proposed and three classification models including SVM, Random Forest, and Multi-layer Perceptron were evaluated. The result was an effective classification method for BLE devices, with the Multi-Layer Perceptron model outperforming others with a 94.5\% accuracy on test data. The model was further tested on unseen device to evaluate its generalization capability, which achieved a 88\% of accuracy in with binary classification target, tracker and non-tracker. This model was integrated into the HomeScout app after resolving an identified bug in the original application. Eventually, Homescout is able to identify tracker and non-tracker device after integration. Future work entails refining the prototype, enhancing the dataset's diversity, and ensuring user privacy in public datasets. |
|
Bulin Shaqiri, A System for Cost-Efficient Cybersecurity Planning, Compliance, and Investment Prioritization, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
While the digital era provides many advantages, it also comes with significant risks related to cybersecurity. Organizations must be proactive in reducing the risks involved with conducting business in a connected and complex digital world. However, despite the abundance of available resources on cybersecurity guidelines, frameworks, and certifications, Small and Medium-sized Enterprises (SMEs) still struggle to understand their unique cybersecurity requirements and develop tailored cybersecurity strategies. Most notably, existing resources are often too abstract, geared towards larger and more mature organizations, or lack practical guidance. Moreover, they often focus on technical aspects and neglect essential dimensions of cybersecurity, such as the economic and societal dimensions. This is especially apparent in case of cybersecurity certifications. To address these gaps, this Master Thesis introduces three key contributions.
Firstly, the CyberTEA methodology is extended to provide SMEs with practical cybersecurity guidelines and allow them to verify compliance with a set of baseline cybersecurity requirements, all while getting formally acknowledged for that. This, in turn, ensures a more holistic approach that incorporates technical, economic, and societal aspects. This methodology is further validated by mapping it against the components of the NIST Cybersecurity Framework (CSF). Secondly, a novel lightweight cybersecurity certification scheme called CERTSec is proposed to offer SMEs an invaluable entry point into the complex world of cybersecurity. This three-tiered certification scheme takes into account key dimensions of cybersecurity and allows businesses to continuously enhance their cybersecurity posture. CERTSec also underscores the importance of annual reassessments within an ever-evolving threat landscape. The final contribution of this work lies in the development of a prototype that automates processes within the proposed certification scheme.
Three technical requirements have been selected and automated, making the prototype able to (i) determine whether Websites establish secure connections, (ii) perform network reachability analysis, and (iii) conduct comprehensive vulnerability analyses on the networks, technologies and software provided. Evaluations have been conducted to highlight the feasibility of key features used for the automation of the certification scheme processes. The results suggest that it is possible to conduct automation for risk analysis without significant impacts (in terms of resource consumption and overall time spent) on the entire process. Furthermore, a detailed case study is shown to demonstrate the feasibility and application of CERTSec for SMEs. |
|
Janosch Baltensperger, A Secure Aggregation Protocol for Decentralized Federated Learning, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
Poisoning attacks pose a substantial threat to the trustfulness of Federated Learning. For example, malicious participants can degrade the model performance of honest members or implement backdoors that can be exploited at inference time to take advantage of incorrect predictions. Researchers have been highly active to mitigate poisoning attacks. Existing approaches prominently aim for defenses against poisoning attacks in centralized settings. While decentralized Federated Learning has gained significant attention as a promising approach without a central entity, the security aspects related to poisoning attacks remain largely unaddressed.
This work introduces a defense approach called “Sentinel” for mitigating poisoning attacks in horizontal, decentralized Federated Learning. Sentinel leverages the advantage of local data availability and defines a three-step aggregation protocol composed of similarity filtering, bootstrap validation and normalization to protect against malicious model updates. The proposed defense mechanism is evaluated on various datasets under different types of poisoning attacks and threat levels. An extension of Sentinel, called SentinelGlobal, is presented, which incorporates a global trust protocol to reduce computational complexity and further improve the effectiveness against adversaries. Both Sentinel and SentinelGlobal demonstrate promising results against untargeted and targeted poisoning attacks. Hence, this work contributes to the advances in research against poisoning attacks in decentralized federated systems. Additionally, the results of this work highlight the need for more sophisticated defense strategies against backdoor attacks, independent of the Federated Learning architecture. |
|
Pascal Kiechl, Simulator of Distributed Datasets for Pulse-wave DDoS Attacks, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
The ever increasing scale and frequency of Distributed Denial-of-Service (DDoS) attacks, as well as the emergence of new forms of attacks, such as pulse-wave DDoS attacks, highlights the importance of ensuring that mitigation capabilities are able to keep up with the escalating threat posed by DDoS attacks. To that end, much work has been done with regard to the generation of DDoS datasets which form the basis for developing effective mitigation tools such as Intrusion Detection Systems (IDS). However, existing datasets typically represent a single, victim-centric viewpoint, which has limitations compared to a distributed dataset that provides multiple different perspectives onto an attack. Thus, this thesis implements a simulator for distributed datasets specifically focused on pulse-wave DDoS attacks, for which at current no datasets are publicly available. The simulator provides high flexibility and configurability in the types of use cases that can be modeled, allowing for the creation of different topologies and attack compositions. The evaluation demonstrates the tool’s capability to create of a wide range of diverse datasets that exhibit different characteristics with regard to metrics that are commonly used in a DDoS attack’s fingerprint. As such, this thesis represents a significant step towards enabling a better understanding of pulse-wave DDoS attacks and thereby the development of improved tools to help defend against them. |
|
Elliott Wallace, Enforcing Privacy in a Smart Home Environment via Pi-hole Integration, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
The Internet of Things (IoT) platform is one of the key drivers of the smart home market, having revolutionized the advancement of smart home technology. Besides the many benefits for convenience and efficiency, there are also concerns about security and privacy in such environments. The increasing complexity of smart homes and hardware limitations of individual devices necessitate the storage and processing of data in remote cloud environments. This raises privacy issues due to potential misuse or disclosure of sensitive information about residents. To the author's knowledge, no existing Privacy Enhancing Technology (PET) offers a lightweight approach to enforce privacy in smart home environments by combining existing tools into a unifying framework. The goal of this thesis is to take a first step towards an extensible open source software system that integrates into the smart home environment with the purpose of monitoring smart home device communications and controlling their communication behavior through user-defined policies. To this end, a prototype application is developed, which monitors smart home devices' Domain Name System (DNS) requests and enforces policies via a DNS sinkhole mechanism. The prototype system is deployed to a system-on-chip platform and evaluated in a live smart home environment to gain insight into the viability of the prototype. The aim is to examine the performance, effectiveness, and limitations of the prototype with the intention of validating the general approach. The results of these experiments indicate that the prototype successfully achieves the goals outlined in this thesis. The application prototype is capable of monitoring the network activity of smart home devices. The collected data are processed to gain insights and make this information transparent to the users. Furthermore, the prototype allows users to define simple allow/block policies which are subsequently enforced by the system. |
|
Charlotte Eder, Design and Evaluation of Ultra-Wideband (UWB) Architectures with a Focus on Privacy-Preserving Characteristics, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Master's Thesis)
Ultra-Wideband (UWB) technology has gained significant popularity in indoor localization applications. These applications often generate vast amounts of personal information, increasing the need to ensure compliance with privacy-preserving principles to safeguard user data. In this thesis, the privacy-preserving characteristics of several UWB localization architectures were analyzed. Firstly, UWB localization architectures were examined based on their privacy-preserving characteristics. Subsequently, two versions of a time difference of arrival (tdoa) localization system were implemented, including privacy best practices provided by the IEEE 802.15.4 standard during the implementation process. Additionally, the privacy-preserving characteristics of the implemented UWB localization systems were evaluated with the help of a privacy criteria catalog based on COPri V.2 ontology.
This thesis found that the localization system employing a passively listening tag fulfills seven out of eight privacy criteria. In contrast, the system where the tag actively sends out UWB signals only fulfilled three out of eight criteria in its minimal version. However, the privacy-preserving characteristics of the active system could be greatly improved by using tools such as dynamic addressing, encrypting packages containing personal information, using a message integrity code (MIC), and using a scrambled time sequence (STS). Finally, the limitations of the current systems' implementations are addressed which provides directions for future research. |
|
Michael Vuong, Design and Implementation of a Byzantine Robust Aggregation Mechanism for Decentralized Federated Learning, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
Federated learning has become increasingly more popular due to limitations of the traditional machine learning methods regarding the data privacy. In addition due to technological evolution, the data volume in general has increased by a lot. Mobile devices are capable of storing more and more data.
While traditional machine learning methods struggle to deal with these concerns, federated learning emerged from these problems.
Two main approaches have been mainly used namely Centralized and Decentralized Federated Learning.
The former one has gotten much more attention in comparison with its counterpart and thus possesses many aggregation rules which are resistant to attacks.
The goal of this thesis is to propose a new aggregation rule which is resistant to attacks against the machine learning model for the decentralized setting to fill a gap where the research has no reached yet.
This is done by extending an existing framework fedstellar, for federated learning.
The case studies as part of the evaluation evaluate the algorithm on performance and resource consumption related metrics.
They indicate that the performance of the algorithm depends on the situation. They also show the limitation of the algorithm and possibilities of expanding the algorithm to other applications. |
|
Jonathan Contreras Urzua, Location-based Open Source Intelligence to Infer Information in LoRa Networks, University of Zurich, Faculty of Business, Economics and Informatics, 2023. (Bachelor's Thesis)
This thesis introduces and evaluates a novel platform that uses Open-source intelligence (OSINT) to identify a primary subject and an associated event using publicly accessible data. As a starting point, the platform utilizes LoRa (Long Range) datasets. This novel tool will make use of web scraping techniques, the power of OpenAI's large language model GPT-3.5, and a custom matching score algorithm. The objective is to collect a comprehensive image of the primary subject and infer potential participants of the specific location and time covered by the LoRa dataset. Evaluating our approach demonstrates its effectiveness in identifying 14 out of 16 actual participants, showcasing its ability to create a relevant dataset of potential participants. Looking at the accuracy, the model manages to achieve a precision score of 0.75, while the recall score of 0.46 indicates some true positives were not captured. The results reflect the difficulty in identifying participants in a private event with a limited public presence. Despite the challenging scenario, this tool represents an innovative approach to merging OSINT techniques with LoRa data. Future work will focus on enhancing the tool's robustness, expanding its coverage to additional social media platforms, improving adaptability across diverse scenarios, and exploring advanced language models. |
|