Thesis

Thesis info for Cyber Security students

Important Deadlines for January 2025 Defence

• Submission of the problem statement and research design document: 12 August 2024
• Declaring your thesis topic in your study plan in ois: 9 September 2024
• Submission of the thesis to the reviewer: TBA
• OIS declaration: 16 December 2024
• Submission of the final version of the thesis: TBA
• Defences: TBA

Moodle: TBA

Important Deadlines for May/June 2024 Defence

• Submission of problem statement and research design document: 11 December 2023
• Declaring your thesis topic in your study plan in ois: 5 February 2024
• Submission of the thesis to the reviewer: 14 April 2024
• OIS declaration: 6 May 2024
• Submission of the final version of the thesis: 12 May 2024
• Defences: 27. - 30 May 2024

Moodle: https://moodle.taltech.ee/course/view.php?id=32866#section-0

Thesis Defence Overview

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

Registration and submission of problem statement and research design document

Each student is required to submit a problem statement and research design document having a length up to 10 pages. The document must include your name and also the names of thesis and supervisor (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods here.

Submission to Reviewer

Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:

• short description of the thesis
• strengths and weaknesses of the thesis
• recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
• at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

OIS declaration

Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

OIS declaration deadlines can be found in the Academic Calendar!

Submission of Final Copy

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a 15 min presentation for your defence. This should really not be left to the evening before the defence!

The defence procedure

On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:

• the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
• the student presents his or her thesis in 15 minutes.
• the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
• the student answers questions from the committee.
• the student answers questions from the audience.
• the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

• After the thesis defence, you may visit the Dean's Office for more information about final formalities if you'd like.
• Upload your thesis if you would like to have it public

Formal Requirements and recommendations

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given here). Please note that you will have to change the title page as of 01.01.2017:

• write "School of Information Technology" instead of "Faculty of Information Technology"
• write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis

• a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
• 50-80 pages + appendices if needed
• Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
• Headings are numbered and no more than 3 levels used
• Don't forget page numbers

Topic and supervisor

Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the leading institute of the curriculum to be an official co-supervisor. All (co-)supervisors must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

NB! Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager.

If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://cs.ut.ee/en/content/thesis-deadlines-and-guidelines In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Paula Luks (paula.luks@ut.ee).

Potential supervisors & proposed topics

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

From Marko Arik, Industry PhD student, Talgen Cybersecurity Ltd. maarik@ttu.ee

• Cyber Operations
• Informational Environment
• Individual competences in Cyber

From Sille Arikas, Industry PhD student, Clarified Security

• No topics available for 2023/2024

From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

• Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in cyber-physical systems, IoT network or robotic systems
• Cyber security of IoT, cyber-physical systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
• Digital Forensics: Forensics issues in cyber-physical systems, IoT networks or robotics systems, mobile forensics, blockchain forensics

Organizational Topics

• Security operation center (SOC) models
• Case studies for the improvement of SOC processes such as threat monitoring, incident handling, vulnerability management or situational awareness

From Aivo Kalu, Cybernetica AS

No topics available for 2023/2024 academic year.

From Shaymaa Khalil, PhD STudent, TalTech

Interested in (but not limited to) topics related to:

• Industrial Control Systems: threat modeling, security, testbeds for education, penetration testing and digital forensics
• Digital forensics related topics, especially topics related to IoT, Windows OS and Digital Forensics tools benchmarking

From Toomas Lepik, Tallinn University of Technology

toomas.lepik@taltech.ee

General areas:

• Network Forensic (related data analysis)
• Reverse engineering (including malware analysis)
• SCADA security
• Incident Handling.
• Log Analysis

Specific ideas:

• Implications of DOH on security and availability + next step from https://www.netmeister.org/blog/doh-dot-dnssec.html
• Domain name availability and how DNS registrant and registrar policy changes affect cybercrime
• Heuristics on ip leasing operations
• Defending organization that does not have internal network
• Do applications do what they promise
• Identifying specific applications based network fingerprints
• Evaluation log collecting methods for Microsoft networks considering log poisoning attacks
• Log collecting frameworks for organisations without internal networks
• Information attributes and their influence on the organisational security beyond CIA
• Frame works for cybersecurity devices / software evaluation
• Evaluation specific software /hardware using ATT&CK Framwork
• ATT&CK -Descriptions and false positives
• Anatomy of cyber fractions during the Russian-Ukrainian war
• Forensic Leaked materials of cyber criminal groups.
• ...

From Birgy Lorenz, Tallinn University of Technology

birgy.lorenz@ttu.ee

No topics as of 2023/2024

From Seyed Mohammad Hadi Mirsadeghi, PhD Student, Tallinn University of Technology

Students can approach Hadi with topics in the following: adversarial machine learning, deep learning, network security, intrusion detection/prevention, software-defined networking (SDN), programmable networking, distributed intelligence seyed.mirsadeghi@taltech.ee

From Sten Mäses, Tallinn University of Technology

• Creating educational hands-on virtual labs in rangeforce.com platform

From Andrew Roberts, PhD Student, Tallinn University of Technology

Topics: 1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles 2. Design and Development of a cyber range for Autonomous self-driving vehicles Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

From Aleksi Kajander, Tallinn University of Technology

• legal aspects of cyber security
• international law

From Rain Ottis, Tallinn University of Technology

• national cyber security
• serious games in cyber security/cyber security exercises

From Mauno Pihelgas NATO CCDCOE

• system and network monitoring
• observability and situation awareness
• IDS/IPS systems
• automating cyber defences

From Jaan Priisalu, Tallinn University of Technology

• TBD

From Muaan Ur Rehman, PhD Student, Tallinn University of Technology

Research focus is on machine learning in intrusion detection, security monitoring of maritime systems and android malware analysis. Students can come up with their own idea/research topic and contact Rehman through email muaan.ur@taltech.ee

From Nikita Snetkov, Industry PhD Student, Cybernetica / Tallinn University of Technology

• Comparative study of migration to post-quantum cryptography in Estonia
• Implementing post-quantum cryptography on ID-card
• Implementing post-quantum variant of Smart-ID
• Blind Smart-ID signatures

Topics are not limited by ones above. If a student has a topic in mind, Nikita's research interests are cryptography, e-voting, digital identity, cryptographic security proofs, post-quantum cryptography.

From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia

Matthew James Sorell <matthew.sorell@taltech.ee>

Topics in digital forensic science may be available. Students should come with an idea that can be turned into a proposal.

From Eneken Tikk, Tallinn University of Technology

• Technical and organizational implementation of the GDPR
• Monetization of personal data
• Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
• Cyber insurance
• Non-military strategies for national and international cybersecurity
• Legal aspects of cybersecurity

From Risto Vaarandi, Tallinn University of Technology

Here are potential areas for selecting a thesis topic:

• event log collection
• event log analysis
• event correlation
• network monitoring
• intrusion detection
• data mining methods for security monitoring
• machine learning methods for security monitoring
• any area that is connected to security monitoring
• other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

From Jelizaveta Vakarjuk, Industry PhD Student, Cybernetica / Tallinn University of Technology

Jelizaveta's general research interest includes different privacy-preserving technologies and multiparty computation with its usage for the digital identity management systems. Additionally, post-quantum cryptography (with main focus on digital signatures) and migration to post-quantum cryptography. She does not have any specific topics to offer for the 2023/2024 academic year, but if something from her research interest sound appealing, please feel free to contact her (jelizaveta.vakarjuk@cyber.ee).

From Adrian Venables, Tallinn University of Technology

• Cyber security aspects of Information Warfare
• Strategic Communications doctrine development
• Information Operations doctrine development
• Cognitive Warfare in the Digital Information Environment

Note: a background in International Relations, Political Science or Strategic Studies is required

From Gabor Visky, PhD Student, NATO CCDCOE / TalTech

Gabor Visky <gabor.visky@ccdcoe.org>

• Network traffic analysis in the maritime cyber-lab

From Kaido Kikkas, Tallinn University of Technology, IT College. kaido.kikkas@taltech.ee

• Cyber security risks in telepresence robotics and their mitigation (practical experimenting is possible at IT College; see [1]
• Cyber security lessons from the COVID-19 pandemic (incl. surveys in Estonia)
• Evolution of Cyberwar (Estonia 2007, Georgia 2007, Ukraine 2014/2022
• Total defence in cyberspace (might try to suggest a strategy for Estonia)
• Specific traits of cyber capabilities in totalitarian societies

Some more possible keywords to spark Thesis topic ideas: (e-)learning/training, FLOSS/Linux, smart devices, IoT, social engineering, usability/accessibility vs security/privacy

Also might study cyber counterparts to (legal) self-defence and citizen's arrest

From Ricardo Gregorio Lugo, Tallinn University of Technology, Estonian Maritime Academy

Any topic from Human Aspects and cyberpsychology are actual.

Topics can include:

• Human performance in cybersecurity
• Individual and Team Processes in Cybersecurity defense/exercises
• Human computer interaction in cybersecurity
• Human-AI trust and decision-making
• Communication and Decision-making in recognized cyber threat situations
• Human Perception and Information Visualizations in cybersecurity
• Cognitive factors in risk perception and decision-making
• Mental Health in Cybersecurity

From the TalTech IT office

• Security implications in Migrating Taltech Campus LAN to IPv6; Toomas Lepik
• Improving SOC and Information security processes; Toomas Lepik
• Auditing Taltech EITS compliance based on public information; Toomas Lepik
• Improving Log analysis pipelines; Toomas Lepik

From the University of Tartu

NB! Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager. If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://cs.ut.ee/en/content/thesis-deadlines-and-guidelines In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Paula Luks (paula.luks@ut.ee).

Cybersecurity-related research in the University of Tartu is conducted by the following persons:

- Arnis Paršovs, University of Tartu, <arnis.parsovs@ut.ee>

- Danielle Morgan, University of Tartu, <danielle.morgan@ut.ee>

- Alo Peets, University of Tartu, <alo.peets@ut.ee>

- Dominique Unruh, University of Tartu, <dominique.unruh@ut.ee>

- Vitaly Skachek, University of Tartu, <vitaly.skachek@ut.ee>

- Mubashar Iqbal, University of Tartu, <mubashar.iqbal@ut.ee>

- Abasi-Amefon Obot Affia, University of Tartu, <amefon.affia@ut.ee>

- Mari Seeba, University of Tartu, <mari.seeba@ut.ee>

- Sabah Suhail, University of Tartu,

- Raimundas Matulevicius, University of Tartu, <raimundas.matulevicius@ut.ee>

Some topics are provided at <https://infosec.cs.ut.ee/Main/ThesisTopics>. For other topics, students can contact directly the supervisors and course lecturers.

A full list of thesis topics offered by the Applied Cyber Security Group (UT) is available in the thesis topics database. Students can also get access to various hardware that can be used for research experiments.

From Estonian Police

TBD

Useful links

ITX8040 Thesis advice slides

Format requirements of a thesis and MS-Word Template (TalTech)

LATEX template for master thesis (TalTech) (accessible by UNI-ID)

Databases, books, research papers accessible from the TTU network

An Overview of Research Methods

Previously Defended Theses