VictorJuiz/thesis huggingface dataset:
Network traffic behaviour profiling

Nowadays, computer networks have become incredibly complex due to the evolution of online services and the rapid growth of the number of smart devices such as smartphones, tablets and laptops. Most of users’ information, even the most sensitive ones, are transmitted over the Internet. Unfortunately, due to this phenomenon we also see an increasing interest of malware developers who are able to find and exploit novel vulnerabilities in network devices to carry out their malicious intents. To tackle these threats, network analysts should be aided with advanced techniques to identify malicious traffic in order to guarantee the security of networks.
In this thesis, we aim to reduce the asymmetric advantage of attackers by examining malware detection and classification using flow-level network traffic. Our methods explore the ability to extract network behaviours generated by malware. We further evaluate the challenge of working with limited amount of data offered by flows to detect and classify network traffic of malware. Malicious flows are intertwined with benign ones originating from a production network to simulate the real-world settings. We gather one of the largest network flow datasets of malware in order to evaluate our proposals and show that we can detect unseen malware variants.
Moreover, we explore the behaviour profiling of network hosts in order to identify them on large networks. We extract unique behaviours and show that we can work only with the amount of information exchanged by hosts in order to successfully extract their unique behaviours and hence distinguish them from others. We show that while such an approach could be used for maintenance of networks, it may also be employed as an attack against network-based moving target defence (NMTD) systems, which is followed by countermeasures and guidelines to avoid such scenarios.
Finally, we propose a novel method of storing network flow data in a domain specific binary file format, which is motivated by the lack of sufficient methods to process large-scale network data on the order of billions of flows. The binary format makes the analyses of methods in this thesis possible, especially when working with the University of Oxford dataset, which contains more than 181 billion flows. We show that our binary format improves the state of the art in terms of storage, while offering faster data processing techniques.

Keywords: malware detection
network traffic analysis
network flow
network security
Advisor: Martinovic, I
Optimizing a primitive based approach to generic taint analysis

Dynamic taint analysis is a fundamental technique in software security that tracks the flow of interesting or suspicious data during the execution of a target application. However, it is also known to suffer from excessively high runtime overhead which limits its overall practicality. The overhead is especially problematic when the taint analysis performed is generic. While this type of analysis is more powerful than standard taint status tracking, due to its support of user-defined custom taint policies, its versatility naturally implies that it cannot be optimized for a single task. Along these lines, this dissertation addresses the challenging problem of enhancing the performance of generic taint analysis.
Our research focuses on taint engines implemented using dynamic binary instrumentation. Essentially, the performance bottleneck of these systems stems from complex taint propagation code that is dynamically instrumented, at the level of machine instructions, into the target application. In order to facilitate the implementation of generic taint analysis, instrumentation is typically achieved by inserting transparent calls, which conveniently invoke propagation routines without disrupting the execution behaviour of the analysed application. However, these calls perform expensive context-switching, and therefore degrade overall runtime performance significantly.
We hypothesize that the overhead of generic taint analysis can be reduced in comparison to the slowdowns incurred by the analysis implemented with the use of transparent calls. This hypothesis is tested by investigating three optimizations. Firstly, call-free generic taint propagation is evaluated as a means to mitigate expensive context switching. Secondly, the idea of vectorized generic taint analysis is explored to determine the effectiveness of using SIMD features to propagate multiple taint labels simultaneously. Thirdly, dynamic fast path generation is proposed so that the execution of ineffective taint propagation can be adaptively elided. Our optimizations are presented with respect to a generic taint analysis driven by user-defined primitives, which act as building blocks for custom taint propagation. Crucially, this primitive based approach enables the user to focus on optimizing core pieces of functionality regarding the desired policy, without the need to delve into the complex internals of the system.
The optimizations are integrated into a generic taint tracker called the Taint Rabbit, and their effectiveness is evaluated on various real-world software and CPU-bound benchmarks. With average speed-ups of around 42% on SPEC CPU benchmarks, and as high as 99% on data compression tools, our results demonstrate the advancement of optimized and generic taint analysis.

Keywords: Dynamic Taint Analysis
Advisor: Kroening, D
A priori regularity results for discrete solutions to elliptic problems

This thesis is concerned with the development and analysis of a discrete counterpart of the well-known De-Giorgi-type regularity theory for solutions of elliptic partial differential equations in the setting of finite element approximations. We consider a finite element space consisting of piecewise affine functions on shape-regular triangulations of polyhedral Lipschitz domains Ω ⊂ R n . We identify conditions for the mesh and the data to prove a global a priori Hölder-norm bound for finite element approximations of solutions to linear elliptic equations of the form −div(A∇u) = f − divF, where A ∈ L ∞ (Ω;R n×n ) is a uniformly elliptic matrix-valued function and F ∈ L p (Ω;R n ) and f ∈ L q (Ω) are given functions for p > n and q > n/2 . After proving a Caccioppoli-type inequality for discrete subsolutions, we use iteration techniques to establish a priori L ∞ - and Hölder-norm bounds. In particular, all estimates are proved for adaptively refined, highly graded meshes.
Next, we establish a local L ∞ -norm bound for finite element approximations of solutions to p-Laplacian systems on non-obtuse meshes. Again, we do not require our mesh to be quasi-uniform but we do allow highly graded meshes. As there is no natural notion of a positive part for vector functions, we use different techniques than in the scalar, linear uniformly elliptic case.
We then apply the results to the finite element approximation of solutions to a system that describes the steady flow of a chemically reacting incompressible fluid. The convergence of a series of approximations was already established in the literature in two space dimensions, but the lack of a De-Giorgi-type regularity theory in the finite element setting prevented a direct generalisation to the physically relevant case of three space dimensions. We show that the theory that was developed in this thesis is under certain restrictions strong enough to overcome this limitation, thus enabling us to extend the convergence theory for finite element approximations of the problem to three space dimensions.

Advisor: Süli, E
The relationship between English and German in Germany: a sociolinguistic study of the use of English and anglicisms, and attitudes towards them

This thesis contributes to the study of language and globalisation by exploring the impact of English on German, a ‘supercentral’ language in De Swaan’s terms (2013: 77), at a time when public expressions of concern about English influence on German have become more salient and when some commentators have linked these concerns about language to broader political trends such as the growth of far-right parties in certain parts of the country. Conducted in two phases - the first focusing on the domains considered most at risk of ‘domain loss’, the academic and corporate domains, and the second looking at wider society - this study examines the linguistic impact of English on German (e.g. through the borrowing of vocabulary and the use of English alongside German in Germany) and the social impact this has on Germany by considering how linguistic practices and attitudes vary according to demographic variables, in particular age, level of education, urban/rural and east/west place of residence. It is argued that the alarmist warnings expressed in the media and voiced by politicians and language protectionist groups about English and anglicisms damaging the German language and leading to domain loss are overstated, and that the situation should instead be regarded as one of linguistic gain. Although it was found that young, university-educated German speakers tend to use more English and anglicisms, and be more proficient in English than older, non-university-educated people, and particularly older former East Germans, the majority of informants rejected the idea of German society being divided into English-speaking ‘haves’ and non-English-speaking ‘have-nots’ (Phillipson 2001a). Nonetheless informants acknowledged that people with lower levels of proficiency in English could be marginalised by the increasingly widespread use of English and anglicisms. Given that English is taught as the first foreign language to almost all children across Germany, it is expected that the effect of age and east/west location on linguistic practices and attitudes will subside; the association between educational background and proficiency, usage and attitudes, however, shows no signs of waning, and the issue of exclusion relating to education level and social class is an ongoing concern for the future.

Advisor: Cameron, D
Rethinking regions and status in international relations: The case of India

Do regions enable or constrain states’ claims to status? Looking for answers in the regional power literature, current scholarship in International Relations remains divided. On one hand, regions enable the consolidation of power in a specific geographic space, making states regional hegemons, therefore strengthening their claims to status. On the other hand, regions involve troublesome neighbourhoods, or the spill-over effects of unresolved conflicts which can constrain claims to status. Based on this debate, states would be expected to either work hard at being regional powers, or, to disentangle themselves from the responsibility. It seems however, that states do neither and yet both. Drawing on the Indian case, this thesis establishes that states find regions to be potentially status-enabling, but not just as spaces in which they can achieve hegemony. As geographic collectives, they offer the important function of social recognition that allows them to be differentiated from others to global audiences. Anchored in a constructivist approach, this thesis argues that states find value in ‘building’ or ‘framing’ regions in specific ways to their claims to status at the global level. By mapping boundaries through the region-building process, states forge a sense of commonality and group membership allowing them to be recognised in a specific way by targeted audiences. Through its qualitative and historically informed study of Indian region-building across time, this thesis notes that since independence, Indian framings of its ‘region’ have shifted to include ‘Asia’, ‘South Asia’, ‘Asia-Pacific’ and most recently the ‘Indo-Pacific’. It demonstrates how the changing notions of its region have informed its claims to status at the global level over time. It studies three cases Indian region-building: ‘Asia’ in the early Cold War years and ‘Asia-Pacific’ in the Post-Cold War years and the ‘Indo-Pacific’ in recent years. Within these the first two cases, it investigates India’s understudied role in Indonesian decolonisation struggle (1945-1949) and India’s Look-East policy in 1991. Given the contemporary and evolving nature of its Indo-Pacific case, this thesis engages with it as whole to demonstrate how it informs Indian claims to higher status at the global level.

Keywords: Status-seeking
Global order
Indian foreign policy
Region-building
International Relations
Advisor: Hurrell, A
Persisting or dropping out: a grounded theory of school-to-work transitions of young migrants in China

This doctoral thesis inductively develops a grounded theory of school-to-work transitions of young rural-to-urban internal migrants in China. It seeks to explain why some young people persist, whereas others drop off their pathways beyond compulsory education. It draws on intensive interviews with young migrants (n = 35) and their parents (n = 15) conducted during 11 months of fieldwork in an outskirt district of Shanghai. The scope of this thesis covers school-to-work transitions of young people, particularly those in restrictive institutional and social contexts.
It finds that an empirically grounded, multidimensional concept, ‘interest-environment fit’, and its link to motivation explain persistence and dropping out on all three major pathways beyond middle school: the academic, the vocational school and the work track. The underlying mechanism suggests that finding a good interest-environment fit around middle school graduation leads young people to subjectively link their interests to their pathway, achieve a higher level of motivation and persist, while the reverse holds for those who do not achieve a good fit. The concept of interest-environment fit explicitly incorporates social class and institutional restrictions, underscoring the sociological perspective taken in this thesis. Moreover, the analysis highlights that the decision-making phase in middle school is crucial for understanding young people’s trajectories beyond middle school graduation.
The thesis adds to the theoretical literature on dropping out and persisting in the sociology of education and work by (1) conceptually integrating the decision-making process about pathways in middle school, (2) analysing all three main pathways beyond middle school within one comprehensive theoretical framework that highlights important parallels, and (3) grounding the theory in a Chinese context. Moreover, through its application of grounded theory methodology, this study emphasises the benefits and potential of employing an approach that prioritises data over pre-existing theoretical knowledge.

Keywords: Interest-environment fit
School-to-work transition
Grounded Theory
Vocational school
China
Drop out
Decision-making
Work-bound youth
Shanghai
Persistence
Migrant youth
Advisor: Murphy, R
Kirk, D
Femtosecond electron dynamics in hot solid-density plasmas

X-ray Free Electron Lasers (XFELs) have shown to be an extremely versatile tool for the experimental study of warm and hot dense matter. Their femtosecond pulse length, high peak brightness and tunable wavelength open up an immense window of opportunity to study solid-density plasmas that are created in a well-controlled manner. At these high densities, the light-matter interaction can be modelled with a collisional-radiative code that describes the ion charge state populations, electron distribution function (EDF) and radiative properties.
In this thesis I will outline a numerical scheme based on the inhomogeneous, isotropic Fokker-Planck equation that describes the non-equilibrium evolution of the EDF in a warm dense system. The scheme encompasses a variety of collisional and radiative interactions between electrons, ions and photons in the system and implicitly conserves density and energy. The Fokker-Planck scheme has been integrated into a non-Local Thermodynamic Equilibrium (LTE) collisional-radiative code that computes the ion charge state populations of a warm dense system under irradiation of an XFEL. The two schemes together constitute a self-consistent method to compute the population dynamics, energy- and density balance of the combined electron and ion system.
The experimental section of this thesis describes a measurement of the collisional ionisation frequencies in a solid-density magnesium plasma. These rates are of great interest as they relate to the optical and electrical properties of high energy-density materials. The experiment relies on the use of an XFEL both to produce and probe the sample, and obtain a spectroscopic measurement of the rate and plasma conditions. This is the first direct measurement of the ionisation rate in the strongly-coupled regime where the rates are significantly enhanced by density effects such as ionisation potential depression.

Keywords: atomic kinetics
x-ray free electron lasers
collisional ionisation
x-ray spectroscopy
Fokker-Planck equation
high energy density
Advisor: Vinko, S
Wark, JS
Monitoring internet censorship; linguistic connectivity within the webgraph

This work offers a significant contribution to the ongoing endeavours in monitoring the effects of internet censorship. It can be freely accessed online by anyone who lives in a censorship free society where limitations on academic texts are not in effect. However, there are numerous places across the globe where this would be highly impractical—due to censorship mechanisms—and potentially illegal. A universal catalogue containing censored pieces of online content, online services and websites does not exist. This thesis discusses new approaches for monitoring internet censorship and the insights gained from experimental analysis with the results.
Key contributions of this work are: firstly, a method for determining if a website is censored in particular country from a remote vantage point; secondly, new approaches for constructing lists of censored domains via a recursive discovery strategy; thirdly, a first look into the relationships between newly discovered censored websites from the perspective of network topology and linguistics.
A number of experiments were conducted to evaluate newly designed frameworks for monitoring censored websites. Using a set of known censored websites from existing lists resulted in the discovery of an order of magnitude more censored material than was previously published. Furthermore, the discovery process yielded useful data and insight into how these censored websites exhibit a multitude of hard and soft connections between them. These results improve the perspicacity of analysis into how online material is censored and give new ways of identifying the motivations and intent of censorship regimes.
These new methods for monitoring internet censorship are significantly more effective than those previously in use, whilst maintaining a strong stance in regard to ethical issues with taking measurements for censorship research.

Keywords: internet censorship
censorship detection
network analysis
censorship
linguistic analysis
webgraph
Advisor: Wright, J
Martin, A
Advances and current methodological problems in understanding depression: a sociogenomic approach

Depression is a global burden. It is one of the most common mental health disorders and top ten causes of sickness worldwide. The importance of obtaining a deeper understanding of depression and its development has been raised by various scholars, policy makers, and the media. All of these factors contribute to a burgeoning body of research into different aspects of depression. The lack of a multifaceted understanding of depression is one of the core obstacles for its treatment. Depression has both biological and non-biological risk factors driven by interconnected causes. The recognition of social and biological drivers and recent advances in molecular genetics permits an unprecedented and unique opportunity to use sociogenomic tools to deepen our knowledge of the multidimensional nature of the biological and social risks of developing depression.
This thesis bridges a gap in our knowledge on the historical, social, and biological predictors of depression by adopting a sociogenomic approach, focusing on the highly relevant context of the UK. The scope of the thesis is unique as I aim to not only expand on empirical evidence of the complex interplay between individual- and macro-level risk factors of depression, but also raise methodological concerns that arise due to such interplay. In four empirical chapters, I contribute to the existing literature on depression and social science genomics, in four different ways: (1) a methodological assessment of selection in genetic data and its role in the polygenic prediction of depression; (2) scrutiny of moderating patterns of birth cohorts and economic recessions associated with changing polygenic penetrance of depression; (3) exploration of the link between genetic predispositions to depression and instances of worklessness that position people into higher risks to experience depression; and, (4) investigation of the ways in which endogenous selection bias leads to spurious associations and biased variance statistics in the models with polygenic scores.

Advisor: Mills, M
Brazel, D
The historical and political significance of the reconstruction of the Cathedral of Christ the Saviour in Moscow

A cathedral appeared in the centre of Moscow almost overnight. Where did it come from?
Today’s cathedral of Christ the Saviour is perceived as a chudo, a ‘miracle’, because it is the re-appearance of a building last seen in 1931. In the intervening years it was one of the "blank spots” in official Soviet history. The way silence was broken and information about the cathedral became widespread, is part of the case I wish to make, but, for the purpose of this introduction, a very brief summary of the cathedral’s biography is useful.
Tsar Alexander I, in a Manifesto issued on 25 December 1812, vowed to found a cathedral named Christ the Saviour, to thank God for having saved Russia from ruin in the hands of Napoleon's numerous and fierce troops; the church was also meant to uphold eternally for future generations the memory of "the unprecedented zeal, loyalty and love towards Faith and Fatherland" displayed by the Russian people in the course of battle. The young artist Alexander Vitberg was the architect of a first project, a classical-looking church composed of three parts expressing the trinity of suffering, death, and eternal life. To accommodate its colossal size (matching Russia's grandeur), it was located on Vorob’evy Gory (Sparrow Hills), across the river from the Kremlin. But the project foundered amid financial scandals and allegations of technical incompetence.
Continued in thesis ...

Keywords: Russia
cathedral
Cathedral of Christ the Saviour
Moscow
Christ the Saviour
cathedrals
Advisor: Brown, A