Kursused - Kasutaja kaastöö [et]

Thesis

2022-04-19T08:44:55Z

Hayretdin: /* Important Deadlines for May/June 2022 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2022 Defence ==
* Submission of problem statement and research design document: 15th August 2021
* Submission of the thesis to the reviewer: 14 December 2021
* OIS declaration: 13 December 2021
* Submission of the final version of the thesis: 3 January 2022
* Defences: 10 January 2022

== Important Deadlines for May/June 2022 Defence ==

* Submission of problem statement and research design document: 14 December 2021
* Submission of the thesis to the reviewer: 25 April 2022 [https://moodle.taltech.ee/course/view.php?id=31426 submission link]
* OIS declaration: 9 May 2022
* Submission of the final version of the thesis: 16 May 2022
* Defences: 30-31 May, 2-3 June 2022

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.taltech.ee/en/thesis-and-graduation-it#p43359 here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisors must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

NB!
Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager.

If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

== Potential supervisors & proposed topics ==

'''The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.'''

==== From Marko Arik, Industry PhD student, Talgen Cybersecurity Ltd. marko.arik@taltech.ee ====

* Cyber Operations
* Informational Environment
* Individual competences in Cyber
* GNSS jamming and spoofing of the unmanned vehicles

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in cyber-physical systems, IoT network or robotic systems
* Cyber security of IoT, cyber-physical systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: Forensics issues in cyber-physical systems, IoT networks or robotics systems, mobile forensics, blockchain forensics

Organizational Topics

* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, vulnerability management or situational awareness

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Shaymaa Khalil, TalTech ====

Interested in (but not limited to) topics related to:

Industrial control systems: threat modeling, security, threat detection, testbeds, and education programs

Digital Forensics topics, especially topics related to Industrial control systems, Windows OS and Digital Forensics tools benchmarking

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.
* Log Analysis

Specific ideas:

* Implications of DOH on security and availability + next step from https://www.netmeister.org/blog/doh-dot-dnssec.html
* Domain name availability and how DNS registrant and registrar policy changes affect cybercrime
* Heuristics on ip leasing operations
* Defending organization that does not have internal network
* Do applications do what they promise
* Identifying specific applications based network fingerprints
* Evaluation log collecting methods for Microsoft networks considering log poisoning attacks
* Log collecting frameworks for organisations without internal networks
* Information attributes and their influence on the organisational security beyond CIA
* Frame works for cybersecurity devices / software evaluation
* Evaluation specific software /hardware using ATT&CK Framwork
* ATT&CK -Descriptions and false positives
* Anatomy of cyber fractions during the Russian-Ukrainian war
* Forensic Leaked materials of cyber criminal groups.
* ...

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

* Network security & network measurements (active & passive)
* WAN-routing & security (IPv6, BGP/BGPsec,...)

==== From Sten Mäses, Tallinn University of Technology ====

* Creating educational hands-on virtual labs in rangeforce.com platform

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Anna-Maria Osula, Tallinn University of Technology ====

* legal aspects of cyber security
* international law

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Mauno Pihelgas NATO CCDCOE ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

- cybersecurity awareness

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Adrian Venables, Tallinn University of Technology ====

* Cyber security aspects of Information Warfare
* Information Advantage doctrine development
* Influence Operations

Note: a background in International Relations, Political Science or Strategic Studies is required

==== From Gabor Visky, NATO CCDCOE / TalTech ====

Gabor Visky <gabor.visky@ccdcoe.org>

* Network traffic analysis in the maritime cyber-lab

==== From the TalTech IT office ====

* Security implications in Migrating Taltech Campus LAN to IPv6; Toomas Lepik
* Improving SOC and Information security processes; Toomas Lepik
* Auditing Taltech EITS compliance based on public information; Toomas Lepik
* Improving Log analysis pipelines; Toomas Lepik

==== From the Tartu University thesis topic registry ====
NB! Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager. If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations
In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

- Arnis Paršovs, University of Tartu, arnis@ut.ee
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

- Dominique Unruh, University of Tartu, <dominique.unruh@ut.ee>

- Vitaly Skachek, University of Tartu, <vitaly.skachek@ut.ee>

- Meelis Roos, University of Tartu, <meelis.roos@ut.ee>

- Mubashar Iqbal, University of Tartu, <mubashar.iqbal@ut.ee>

- Abasi-Amefon Obot Affia, University of Tartu, <amefon.affia@ut.ee>

- Mari Seeba, University of Tartu, <mari.seeba@ut.ee>

- Sabah Suhail, University of Tartu,

- Raimundas Matulevicius, University of Tartu, <raimundas.matulevicius@ut.ee>

Some topics are provided at <https://infosec.cs.ut.ee/Main/ThesisTopics>

For other topics, students can contact directly the supervisors and course lecturers.

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.taltech.ee/en/thesis-and-graduation-it#p43359 Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2022-04-19T08:44:05Z

Hayretdin: /* Important Deadlines for May/June 2022 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2022 Defence ==
* Submission of problem statement and research design document: 15th August 2021
* Submission of the thesis to the reviewer: 14 December 2021
* OIS declaration: 13 December 2021
* Submission of the final version of the thesis: 3 January 2022
* Defences: 10 January 2022

== Important Deadlines for May/June 2022 Defence ==

* Submission of problem statement and research design document: 14 December 2021 [https://moodle.taltech.ee/course/view.php?id=31426 submission]
* Submission of the thesis to the reviewer: 25 April 2022
* OIS declaration: 9 May 2022
* Submission of the final version of the thesis: 16 May 2022
* Defences: 30-31 May, 2-3 June 2022

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.taltech.ee/en/thesis-and-graduation-it#p43359 here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisors must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

NB!
Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager.

If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

== Potential supervisors & proposed topics ==

'''The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.'''

==== From Marko Arik, Industry PhD student, Talgen Cybersecurity Ltd. marko.arik@taltech.ee ====

* Cyber Operations
* Informational Environment
* Individual competences in Cyber
* GNSS jamming and spoofing of the unmanned vehicles

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in cyber-physical systems, IoT network or robotic systems
* Cyber security of IoT, cyber-physical systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: Forensics issues in cyber-physical systems, IoT networks or robotics systems, mobile forensics, blockchain forensics

Organizational Topics

* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, vulnerability management or situational awareness

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Shaymaa Khalil, TalTech ====

Interested in (but not limited to) topics related to:

Industrial control systems: threat modeling, security, threat detection, testbeds, and education programs

Digital Forensics topics, especially topics related to Industrial control systems, Windows OS and Digital Forensics tools benchmarking

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.
* Log Analysis

Specific ideas:

* Implications of DOH on security and availability + next step from https://www.netmeister.org/blog/doh-dot-dnssec.html
* Domain name availability and how DNS registrant and registrar policy changes affect cybercrime
* Heuristics on ip leasing operations
* Defending organization that does not have internal network
* Do applications do what they promise
* Identifying specific applications based network fingerprints
* Evaluation log collecting methods for Microsoft networks considering log poisoning attacks
* Log collecting frameworks for organisations without internal networks
* Information attributes and their influence on the organisational security beyond CIA
* Frame works for cybersecurity devices / software evaluation
* Evaluation specific software /hardware using ATT&CK Framwork
* ATT&CK -Descriptions and false positives
* Anatomy of cyber fractions during the Russian-Ukrainian war
* Forensic Leaked materials of cyber criminal groups.
* ...

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

* Network security & network measurements (active & passive)
* WAN-routing & security (IPv6, BGP/BGPsec,...)

==== From Sten Mäses, Tallinn University of Technology ====

* Creating educational hands-on virtual labs in rangeforce.com platform

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Anna-Maria Osula, Tallinn University of Technology ====

* legal aspects of cyber security
* international law

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Mauno Pihelgas NATO CCDCOE ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

- cybersecurity awareness

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Adrian Venables, Tallinn University of Technology ====

* Cyber security aspects of Information Warfare
* Information Advantage doctrine development
* Influence Operations

Note: a background in International Relations, Political Science or Strategic Studies is required

==== From Gabor Visky, NATO CCDCOE / TalTech ====

Gabor Visky <gabor.visky@ccdcoe.org>

* Network traffic analysis in the maritime cyber-lab

==== From the TalTech IT office ====

* Security implications in Migrating Taltech Campus LAN to IPv6; Toomas Lepik
* Improving SOC and Information security processes; Toomas Lepik
* Auditing Taltech EITS compliance based on public information; Toomas Lepik
* Improving Log analysis pipelines; Toomas Lepik

==== From the Tartu University thesis topic registry ====
NB! Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager. If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations
In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

- Arnis Paršovs, University of Tartu, arnis@ut.ee
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

- Dominique Unruh, University of Tartu, <dominique.unruh@ut.ee>

- Vitaly Skachek, University of Tartu, <vitaly.skachek@ut.ee>

- Meelis Roos, University of Tartu, <meelis.roos@ut.ee>

- Mubashar Iqbal, University of Tartu, <mubashar.iqbal@ut.ee>

- Abasi-Amefon Obot Affia, University of Tartu, <amefon.affia@ut.ee>

- Mari Seeba, University of Tartu, <mari.seeba@ut.ee>

- Sabah Suhail, University of Tartu,

- Raimundas Matulevicius, University of Tartu, <raimundas.matulevicius@ut.ee>

Some topics are provided at <https://infosec.cs.ut.ee/Main/ThesisTopics>

For other topics, students can contact directly the supervisors and course lecturers.

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.taltech.ee/en/thesis-and-graduation-it#p43359 Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2021-09-13T05:46:45Z

Hayretdin: /* From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2022 Defence ==
* Submission of problem statement and research design document: 15th August 2021 https://moodle.taltech.ee/course/view.php?id=31686, Student key: qv374MdM

* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Important Deadlines for May/June 2022 Defence ==

* Submission of problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.taltech.ee/en/thesis-and-graduation-it#p43359 here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

NB!
Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager.

If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in cyber-physical systems, IoT network or robotic systems
* Cyber security of IoT, cyber-physical systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: Forensics issues in cyber-physical systems, IoT networks or robotics systems, mobile forensics, blockchain forensics

Organizational Topics

* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, vulnerability management or situational awareness

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

* Aviation Cybersecurity lab
* Maritime technology.
* WAN networks

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Shaymaa Khalil, TalTech ====

Interested in (but not limited to) topics related to:

Industrial control systems: threat modeling, security, threat detection, testbeds, and education programs

Digital Forensics topics, especially topics related to Industrial control systems, Windows OS and Digital Forensics tools benchmarking

==== From Gabor Visky, NATO CCDCOE / TalTech ====

Gabor Visky <gabor.visky@ccdcoe.org>

* Network traffic analysis in the maritime cyber-lab

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TalTech IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====
NB! Theses supervised by supervisors from the University of Tartu (UT) have to be defended in UT. Exceptions are possible, but need do be approved by the program manager. If you will defend your thesis in UT, then you should do your thesis declaration according to the procedures and deadlines of UT. Thesis related guidelines and regulations are available at: https://www.cs.ut.ee/en/studying/guidelines-regulations
In case of any questions contact UT Institute of Computer Science Academic Affairs Specialist Maarja Kungla (maarja.kungla@ut.ee).

- Dominique Unruh, University of Tartu, <dominique.unruh@ut.ee>

- Vitaly Skachek, University of Tartu, <vitaly.skachek@ut.ee>

- Meelis Roos, University of Tartu, <meelis.roos@ut.ee>

- Mubashar Iqbal, University of Tartu, <mubashar.iqbal@ut.ee>

- Abasi-Amefon Obot Affia, University of Tartu, <amefon.affia@ut.ee>

- Mari Seeba, University of Tartu, <mari.seeba@ut.ee>

- Sabah Suhail, University of Tartu,

- Raimundas Matulevicius, University of Tartu, <raimundas.matulevicius@ut.ee>

Some topics are provided at <https://infosec.cs.ut.ee/Main/ThesisTopics>

For other topics, students can contact directly the supervisors and course lecturers.

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.taltech.ee/en/thesis-and-graduation-it#p43359 Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2021-04-19T10:05:09Z

Hayretdin: /* Important Deadlines for May 2021 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: DEC 7th 2020 in Moodle [https://moodle.taltech.ee/course/view.php?id=31016] KEY: eAsUMTS
* OIS declaration: DEC 14th 2020 - deadline for submitting the application for defense of graduation thesis
* Submission of the final version of the thesis: DEC 21st 2020
* Defences: JAN 11th 2021

== Important Deadlines for May 2021 Defence ==
* Submission of the problem statement and research design document: 14 December 2020 in Moodle [https://moodle.taltech.ee/mod/assign/view.php?id=338668]: no key is needed
* Submission of the thesis to the reviewer: 23 April 2021 in Moodle [https://moodle.taltech.ee/mod/assign/view.php?id=375802]: no key is needed
* OIS declaration: 10 May 2021
* Submission of the final version of the thesis: 14 May 2021
* Defences: 27-28 May & 30 May-1 June 2021

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

* Aviation Cybersecurity lab
* Maritime technology.
* WAN networks

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Gabor Visky, NATO CCDCOE / TalTech ====

Gabor Visky <gabor.visky@ccdcoe.org>

* Network traffic analysis in the maritime cyber-lab

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2021-04-19T10:04:50Z

Hayretdin: /* Important Deadlines for May 2021 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: DEC 7th 2020 in Moodle [https://moodle.taltech.ee/course/view.php?id=31016] KEY: eAsUMTS
* OIS declaration: DEC 14th 2020 - deadline for submitting the application for defense of graduation thesis
* Submission of the final version of the thesis: DEC 21st 2020
* Defences: JAN 11th 2021

== Important Deadlines for May 2021 Defence ==
* Submission of the problem statement and research design document: 14 December 2020 in Moodle [https://moodle.taltech.ee/mod/assign/view.php?id=338668]: no key is needed
* Submission of the thesis to the reviewer: 23 April 2021 [https://moodle.taltech.ee/mod/assign/view.php?id=375802]: no key is needed
* OIS declaration: 10 May 2021
* Submission of the final version of the thesis: 14 May 2021
* Defences: 27-28 May & 30 May-1 June 2021

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

* Aviation Cybersecurity lab
* Maritime technology.
* WAN networks

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Gabor Visky, NATO CCDCOE / TalTech ====

Gabor Visky <gabor.visky@ccdcoe.org>

* Network traffic analysis in the maritime cyber-lab

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-12-08T12:40:58Z

Hayretdin: /* Thesis info for Cyber Security students */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: DEC 7th 2020 in Moodle [https://moodle.taltech.ee/course/view.php?id=31016] KEY: eAsUMTS
* OIS declaration: DEC 14th 2020 - deadline for submitting the application for defense of graduation thesis
* Submission of the final version of the thesis: DEC 21st 2020
* Defences: JAN 11th 2021

== Important Deadlines for May 2021 Defence ==
* Submission of the problem statement and research design document: 14 December 2020 in Moodle [https://moodle.taltech.ee/mod/assign/view.php?id=338668]: no key is needed
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-09-26T07:43:45Z

Hayretdin: /* From Arnis Paršovs, University of Tartu, arnis@ut.ee */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: DEC 7th 2020
* OIS declaration: TBD
* Submission of the final version of the thesis: DEC 21st 2020
* Defences: JAN 11th 2021

== Important Deadlines for May 2021 Defence ==
* Submission of the problem statement and research design document: 14 December 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

General areas:

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Andrew Roberts, Tallinn University of Technology ====
Topics:
1. Evaluation of Methods for Threat and Risk Assessment of Autonomous Self-Driving Vehicles
2. Design and Development of a cyber range for Autonomous self-driving vehicles
Contribution:

Topic 1: The outcome of this work will form part of TUT contribution to standards and methods research within the International Alliance for Mobility Testing and Standardisation (IAMTS).

Topic 2: The developed cyber range will be integrated into the EU ECHO-Federated Cyber Range.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

A full list of thesis topics offered by the [https://acs.cs.ut.ee/ Applied Cyber Security Group (UT)] is available in the [https://comserv.cs.ut.ee/ati_thesis_offers/index.php?year=all&keywords=acs thesis topics database].

Students can also get access to various [https://acs.cs.ut.ee/hardware/ hardware] that can be used for research experiments.

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== From Tiia Sõmer, Tallinn University of Technology ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-08-28T12:15:03Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 4 August 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-08-28T12:12:51Z

Hayretdin: /* From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 4 August 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 3rd August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical and organizational. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, code security review, intrusion detection in SCADA or IoT systems or cyber threat intelligence
* Cyber security of IoT systems: Development of a security testbed, threat modelling, honeypots, intrusion detection systems
* Digital Forensics: IoT forensics, mobile forensics, blockchain forensics

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-07-16T08:03:51Z

Hayretdin: /* Important Deadlines for August 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 4 August 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 10 August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-07-16T08:00:54Z

Hayretdin: /* Important Deadlines for August 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 4 August 2020
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 10 August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Currently only accepting students who have previously passed CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-06-08T09:03:29Z

Hayretdin: /* Thesis info for Cyber Security students */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 3 August 2020
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 10 August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only accepting students who have taken the CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-06-08T09:02:38Z

Hayretdin: /* Thesis info for Cyber Security students */

=Thesis info for Cyber Security students=

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 3 August 2020
* Defences: 17-18 August 2020

== Important Deadlines for January 2021 Defence ==
* Submission of problem statement and research design document: 10 August 2020
* Submission of the thesis to the reviewer: TBD
* OIS declaration: TBD
* Submission of the final version of the thesis: TBD
* Defences: TBD

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only accepting students who have taken the CNS.073.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-05-21T07:11:01Z

Hayretdin: /* Important Deadlines for August 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 3 August 2020
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have only one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-05-21T06:36:08Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Important Deadlines for August 2020 Defence ==
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 3 August 2020
* Defences: 17-18 August 2020

Coronavirus crisis has impacted some of the thesis studies due to the in-place restrictions or other reasons. Therefore, we have an additional defence in August 2020 as the main deadlines are given above. This defence will have one final submission date. OIS declaration that has been done on 11 May 2020 will be also valid for this defence.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-04-14T09:42:10Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====

1. Comparison of identity/authentication/signing APIs from security and architecture viewpoint

This might be suitable for student, who is more interested about software developing/architecture aspects, but still related to security as well. In short, there are many competing API-s in the Baltic/Nordic region, which are used in practice, to request the authentication or signatures. For example:

* https://github.com/SK-EID/smart-id-documentation/blob/master/README.md
* https://github.com/SK-EID/MID
* https://developers.dokobit.com
* https://developer.signicat.com/apis/sign-api/sign-api-v1/
* https://github.com/open-eid/SiGa/wiki/Hashcode-API-description

and also, there are the “canonical” or “standard" ones like OIDC and SAML and DSS (http://docs.oasis-open.org/dss/v1.0/oasis-dss-core-spec-v1.0-os.html). Which one is good? Which one has the best properties from software point of view or security point of view? Which one to use for future integrations? How do we even compare them?

2. Apply Smart-ID authentication and digital signatures (or underlying SplitKey technology) in novel bitcoin/blockchain/SSI/DID use cases.

For example, last year, there was the master thesis https://www.semanticscholar.org/paper/Aleksandr-Ts%C3%B5ganov-Integrating-User-Identity-with-Ts%C3%B5ganov-Pintado/30c653214f5a30ed46343058039d4b53a8d326f9?utm_source=email.

If there’s some additional ideas, about where to apply the Smart-ID authentication services or perhaps to do more deeper integration with the SplitKey technology, we could discuss and see, if some interesting project might come out of this.

3. Compare the attack model of the FIDO with the attack model of Smart-ID.

The current Smart-ID authentication API (https://github.com/SK-EID/smart-id-documentation/blob/master/README.md) specifies how the anonymous session with the web-site becomes the authenticated session. Compare the security properties of this authentication flow with https://www.w3.org/TR/webauthn-2/ and https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-security-ref-v2.0-id-20180227.html

4. Compare the properties of Smart-ID with framework by Bonneau et al.

Take the https://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf and the properties described there and analyse, which ones are satisfied by Smart-ID, which ones are not satisfied, which ones are already pointless in the year 2020. Compare with http://fc16.ifca.ai/preproceedings/25_Lang.pdf, which does the same kind exercise for FIDO in the section 6.1.

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-02-17T08:23:25Z

Hayretdin: /* Useful links */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis and MS-Word Template (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-02-17T08:22:01Z

Hayretdin: /* Useful links */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* event log collection
* event log analysis
* event correlation
* network monitoring
* intrusion detection
* any area that is connected to security monitoring
* various other system security engineering topics (for example, system hardening or firewalling)

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience in the research area (for example, writing a thesis on network intrusion detection requires previous experience with network IDS systems). Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TalTech)]

[https://gitlab.cs.ttu.ee/templates/phd-thesis LATEX template for master thesis (TalTech) (accessible by UNI-ID)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2020-01-02T06:50:15Z

Hayretdin: /* Important Deadlines for January 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020 [https://ained.ttu.ee/mod/quiz/view.php?id=9079 via ained]
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-11-28T07:50:44Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019 [https://ained.ttu.ee/course/view.php?id=297 via ained]
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-11-27T06:56:19Z

Hayretdin: /* Important Deadlines for January 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019 [https://ained.ttu.ee/mod/assign/view.php?id=9078 via ained]
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-11-27T06:54:30Z

Hayretdin: /* Registration and submission of problem statement and research design document */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name and also the names of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.

• Research Problem/Hypothesis/Question: It is imperative to write a proper research problem/hypothesis/question statement(s).

• Scope and Goal: This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.

• Literature Review: This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.

• Novelty: This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.

• Research Methods: The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.

• References: The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-11-27T06:52:32Z

Hayretdin: /* Registration and submission of problem statement and research design document */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis

• The name of the author

• The name of the supervisor

• Motivation: An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.
• Research Problem/Hypothesis/Question
It is imperative to write a proper research problem/hypothesis/question statement(s).
• Scope and Goal
This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.
• Literature Review
This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.
• Novelty
This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.
• Research Methods
The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.
• References
The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-11-27T06:51:58Z

Hayretdin: /* Registration and submission of problem statement and research design document */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include the following sections and content:

• The topic of the thesis
• The name of the author
• The name of the supervisor
• Motivation
An overview of the addressed problem is given here. It should be explained why the problem is important and deserves a research study.
• Research Problem/Hypothesis/Question
It is imperative to write a proper research problem/hypothesis/question statement(s).
• Scope and Goal
This section defines the goal of the study and describes the main outcomes. It is required to specify the scope, limitations and key assumptions of the study.
• Literature Review
This section includes the analysis of similar studies in the literature and gives a discussion of the research gap. It is important to link this research gap explanation with the research problem.
• Novelty
This section justifies the novelty of your study, explains what the main contribution is and what the differences are when compared to similar studies.
• Research Methods
The research methods that you will apply in your study are given here. The data collection and analysis methods are also covered in this section. It is needed to explain how your research outcome will be validated.
• References
The resources referenced in the document are listed here.

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

toomas.lepik@taltech.ee

=====General areas:=====

* Network Forensic (related data analysis)
* Reverse engineering (including malware analysis)
* SCADA security
* Incident Handling.

[https://courses.cs.ttu.ee/pages/Thesis/tl/ A bit more specific research ideas ]

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

- cybersecurity risk assessment and management

- IT and cybersecurity audits

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

Here are potential areas for selecting a thesis topic:

* log collection and analysis
* event correlation
* network monitoring
* security monitoring

When applying for supervision, preference is given to students who have either passed the Cyber Defense Monitoring Solutions course with grade 4 or 5, or have previous engineering experience with security monitoring technologies. Before applying, make sure you have selected at least one initial thesis topic suggestion with a background research about its validity.

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-26T09:34:42Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: 23 April 2020
* OIS declaration: 11 May 2020
* Submission of the final version of the thesis: 19 May 2020
* Defences: 28-29 May 2020, 1-2 June 2020

The procedure for thesis defence is set by TalTech regulations. The students who have a supervisor from TalTech but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-26T09:32:43Z

Hayretdin: /* Important Deadlines for January 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: 9 December 2019
* OIS declaration: 16 December 2019
* Submission of the final version of the thesis: 3 January 2020
* Defences: 9-10 January 2020

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

Only very limited slots for 2020, accepting students working towards January '''2021''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From Matthew Sorell, Tallinn University of Technology / Adelaide University Australia ====

Matthew James Sorell <matthew.sorell@taltech.ee>

1. A risk-based decision approach for handling digital devices at a crime scene.

It is common for electronic devices such as mobile phones to be discovered at a crime scene, but the means for securing the device is becoming increasingly complex. In spite of this, evidence handling procedures are often static and increasingly out of date, leading to the loss of critical evidence in serious crime.

The phone may be remotely wiped; picking it up may activate motion sensors; and in some cases (such as missing persons) the urgency of the evidence needs to be weighed against securing forensic evidence for investigation and prosecution.

In this research, we consider the development of a risk-based approach to advising crime scene investigators to handle digital devices in the least-worst way.

2. Feasible route mapping

When examining timestamped geolocation data, it is often useful to determine feasible routes which could be taken from one location to another.

Google Maps, for example, provides directions and sometimes provides a small number of alternatives. For criminal investigation, a heatmap of feasible routes would support investigators with a means to rapidly evaluate the context of movement in and around a crime.

In this project, we propose to use the Google Maps Platform (https://developers.google.com/maps/gmp-get-started) to build, through statistical sampling, a heatmap of feasible routes subject to time and modes-of-transportation constraints.

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

CyberResearch

2019-09-18T10:54:09Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Master Thesis Process and Supervising - Hayretdin Bahsi [[File:Thesis_Process_and_Supervising.pdf]]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

CyberResearch

2019-09-18T10:53:51Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Master Thesis Process and Supervising - Hayretdin Bahsi [[Thesis_Process_and_Supervising.pdf]]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

CyberResearch

2019-09-18T10:53:32Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Master Thesis Process and Supervising - Hayretdin Bahsi [[:Media:Thesis_Process_and_Supervising.pdf]]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

CyberResearch

2019-09-18T10:52:46Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Master Thesis Process and Supervising - Hayretdin Bahsi [[:File:Thesis_Process_and_Supervising.pdf]]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

CyberResearch

2019-09-18T10:52:05Z

Hayretdin: /* 17 Sept */

CyberResearch

2019-09-18T10:51:25Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Theses Supervising - Hayretdin [[File:Thesis_Process_and_Supervising.pdf]]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

CyberResearch

2019-09-18T10:50:10Z

Hayretdin: /* 17 Sept */

Planning for the research group meeting on '''Tuesday's at 1400 in ICT-411.'''

Presentations from previous weeks are located here https://gitlab.cs.ttu.ee/cybersec/weekly/wikis/home and are accessible for CyberResearch group only

== 03 Sept ==

Meeting Eesti Energia representatives

*overview of our group, capabilities
*overview of Eesti Energia structure, processes etc.
*collaboration possibilities

== 10 Sept ==

Kieren Lovell - Cambridge Summerschool Spearphishing attack

And guest lecturers from Brno university Lukáš Hellebrandt and Ondřej Hujňák - overview of their research, potential collaboration

== 17 Sept ==

Internal Comms: after Curr.Dev.Days and onwards - Martha & Kristi

Theses Supervising - Hayretdin [File:Thesis_Process_and_Supervising.pdf]

== 24 Sept ==

Kelly O’Brien from Embry-Riddle University (USA) - topic TBD

== 1 Oct ==

Risto Vaarandi - Improving Learning Efficiency and Evaluation Fairness for Cyber Security Courses: a Case Study

== 5 Nov ==

Anna-Maria Osula

Fail:Thesis Process and Supervising.pdf

2019-09-18T10:46:58Z

Hayretdin:

Thesis

2019-09-06T07:08:49Z

Hayretdin: /* From Bernhards Blumbergs */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T07:05:27Z

Hayretdin: /* Submission to Reviewer */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review one week before the final submission deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T07:03:34Z

Hayretdin: /* Thesis Defence Overview */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The reviewer will review your thesis and give you feedback. Expect that you should receive the review about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the review feedback into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enrol yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via the email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T07:00:36Z

Hayretdin: /* Registration and submission of problem statement and research design document */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The opponent will review your thesis and give you feedback. Expect that you should receive the review from your opponent about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the feedback items into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via email account that you defined in TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T06:46:55Z

Hayretdin: /* Thesis Defence Overview */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following a 4-semester study plan and aim to defend in the May period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally, the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, it is highly recommended to have an idea about your topic and have discussed this with your supervisor.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as a registration to the defence that will take place in next term.

The next step in the process would be conducting the research. As the thesis submission deadline is around the third week of April (for students aiming to defend in January, this deadline is early December), please, plan to finish your work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor, you should then make a decision if your work is ready to be submitted for May defence (or if you need more time and prefer to submit for a January defence). The opponent will review your thesis and give you feedback. Expect that you should receive the review from your opponent about a week before the final deadline. You can continue to update your work until the final submission date. You can and should, however, incorporate the feedback items into the final copy of your thesis and defence presentation. This will allow you to make modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15-minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15-minute presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document having a length up to 10 pages. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for May defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T06:32:55Z

Hayretdin: /* Important Deadlines for May 2020 Defence */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: 11 December 2019
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4-semester study plan and aim to defend in the June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T06:24:02Z

Hayretdin: /* From the Tartu University thesis topic registry */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4-semester study plan and aim to defend in the June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

You can check the possible cyber security-related topics from the following link:
https://comserv.cs.ut.ee/ati_thesis_offers/

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T06:23:20Z

Hayretdin: /* From the Tartu University thesis topic registry */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4-semester study plan and aim to defend in the June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

Tou can check the possible cyber security-related topics from the following link:
[https://comserv.cs.ut.ee/ati_thesis_offers/]

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-06T06:21:39Z

Hayretdin: /* From the TUT IT office */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4-semester study plan and aim to defend in the June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From the Tartu University thesis topic registry ====

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-09-04T06:39:02Z

Hayretdin: /* Thesis info for Cyber Security students */

=Thesis info for Cyber Security students=

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

== Important Deadlines for May 2020 Defence ==
* Submission of the problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have a supervisor from TTU but want to defend their theses in Tartu University in order to fulfil the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to the reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending an MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview of the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4-semester study plan and aim to defend in the June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-06-12T07:53:47Z

Hayretdin: /* From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@taltech.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-06-12T07:52:21Z

Hayretdin: /* From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-06-12T07:07:26Z

Hayretdin: /* From Kaie Maennel, Tallinn University of Technology */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

Strategic Topics

* High-level information flows and reporting mechanisms among the major entities of national cyber security governance structures
* Maturity models for the analysis of national cyber security capability

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Stefan Sütterlin, Tallinn University of Technology & Østfold University College ====
(stefan.sutterlin@hiof.no)

- cognitive science and performance in cyber defence

- human factors in cyber security

- cyberpsychology

- decision-making

- cognitive biases

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-06-05T08:36:23Z

Hayretdin: /* Thesis info for Cyber Security students */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: 17 June 2019 [https://ained.ttu.ee/course/view.php?id=258 via ained]
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

Strategic Topics

* High-level information flows and reporting mechanisms among the major entities of national cyber security governance structures
* Maturity models for the analysis of national cyber security capability

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-05-09T06:04:00Z

Hayretdin: /* Important Deadlines for May 2019 Defence */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

== Important Deadlines for January 2020 Defence ==
* Submission of problem statement and research design document: TBD
* Submission of the thesis to the reviewer: TBD
* Submission of the final version of the thesis: TBD
* OIS declaration: TBD
* Defences: TBD

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

Strategic Topics

* High-level information flows and reporting mechanisms among the major entities of national cyber security governance structures
* Maturity models for the analysis of national cyber security capability

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]

Thesis

2019-05-02T07:41:11Z

Hayretdin: /* Important Deadlines for May 2019 Defence */

=Thesis info for Cyber Security students=
== Important Deadlines for May 2019 Defence ==
* Submission of the final version of the thesis: 13 May 2019 [https://ained.ttu.ee/course/view.php?id=228 via ained]
* OIS declaration: 13 May 2019
* Bring one paper copy of the thesis (with a cover hard or soft) on May 20th to Siiri Taveter in ICT-429 at between 10-12 and 13-16
* Defences: 27-30 May 2019

The procedure for thesis defence is set by TTU regulations. The students who have supervisor from TTU but want to defend their theses in Tartu University in order to fulfill the minimum credit requirements will follow the first two steps (registration and submission of problem statement and submission to reviewer) as given above. However, OIS declaration, submission of final version and defence should be done according to the deadlines and procedures of Tartu University.

== Thesis Defence Overview ==

Writing and defending a MSc thesis is an important part of the Cyber Security curriculum, as it shows that you can go deep into a specific cyber security research area. This page gives a rough overview over the process, but details should be discussed with your supervisor. This overview part is given according to the assumption that you are following 4 semester study plan and aim to defend in June period. If you want to defend in January, then you can adjust the planning phases accordingly.

Generally the process should start during the first year, by finding a topic-area of interest and by identifying a suitable supervisor. At the end of the second semester, you should have an idea about your topic and you should have discussed this with your supervisor.

It is recommended that you take the literature review seminar ([https://courses.cs.ttu.ee/pages/ITX8040 '''ITX8040''' and '''ITX8230''']) in the 3rd semester. The purpose of this seminar is two-fold: (a) you need to do a literature review for your thesis anyway (e.g., see [https://web.stanford.edu/class/cee320/CEE320A/POD.pdf here]), and (b) learning from others about research-papers they have read for their thesis broadens your overall horizon and should help you in discussing challenges you are facing in your own literature review.

The purpose of the literature review is that you obtain a good understanding of the state-of-the-art research in your selected area of research. Typically during this reading phase, the problem statement (the question you aim to address/solve in your thesis) will be refined/changed. You should aim to have a solid problem statement fixed and agreed with your supervisor during the 3rd semester, ideally well before December.

In early December, you should submit a problem statement and research design document (please, find the details, below). Sending this document is considered as registration to the defence that will take place in next term.

The next step in the process would be conducting the research. Please reserve sufficient time for this, as this is going to be the main contribution of your thesis. Plan to finish this work early April, so that your supervisor can review your thesis, give you feedback and you have time to address the feedback before your thesis is being sent to the reviewer/opponent. Jointly with your supervisor you should then make a decision if your work is ready to be submitted for June defence (or if you need more time and prefer to submit for a January defence). For students planning to defend in June, expected deadline to submit your thesis for review, to be around late April. For students aiming to defend in January, expect early December. The opponent will review your thesis and give you feedback. Clearly, you will be allowed to continue working on your thesis, but keep in mind any results or insights that you produce during that time won't be visible to your opponent. You can and should, however, include them in the final copy of your thesis and defence presentation. Expect that you should receive the review from your opponent about a week or two before the final deadline. This will allow you to make minor modifications, e.g., fix some typos or clarify some sections, which the reviewer pointed out.

At the final submission deadline, you will have to submit your thesis. On the day of defence, you are expected to give a 15 minute presentation of your work, followed by Q&A from the opponent, committee, supervisor & audience. Make sure you prepare your 15 min presentation well, this should not be left for the evening before the defence.

Below some more detailed information.

Good luck!

=== Registration and submission of problem statement and research design document ===
Each student is required to submit a problem statement and research design document. '''The document must include your name, student number, and also the name of thesis and supervisor''' (and co-supervisor, if exists).

About half a year before the defence, the students are required to indicate their intent to defend by this document. See deadlines above set for each semester. Typically this will be around Early December for June defences, and Mid June for January defences. You will need to submit this via the TTU Moodle link given in "important deadlines" section of relevant defence period. You'll have to self-enroll yourself in that link. Instructions on how to access the TTU Moodle can be found [https://courses.cs.ttu.ee/pages/Instructions_for_accessing_ained.ttu.ee here]. Feedback on the problem statement and research design document should be received within 3-4 weeks via TTU Moodle.

The document should include very brief answers to below questions in two or three pages.

• What is the research problem/hypothesis/question?

• What are the goals of the study?

• Why is this study important?

• What are the possible outcomes of the study?

• What are the limitations and key assumptions of the study?

• What is missing in the literature?

• Which methodologies will be used for solving the problem and validation of the study?

This document is evaluated according to the following criteria:

Whether the author

• has a well-defined problem statement,

• successfully presents the significance of the problem,

• knows the literature and the limits of existing solutions,

• have thought about possible methods,

• have thought about how to validate the proposed solution,

• brings a novelty to the literature.

You can find detailed information about research methods [https://courses.cs.ttu.ee/pages/Research_Method here.]

=== Submission to Reviewer ===
Each thesis will be assigned a reviewer or sometimes called opponent. The reviewer must have at least a Master's degree and relevant knowledge or experience in the field of the thesis topic, and they must not have a conflict of interest (such as being members in the same research group). Students and supervisor may recommend reviewer candidates, but the final assignment will be done by the thesis defence committee.

A reviewer will provide written feedback (typically about two pages) on the thesis. The review should cover the following points:
* short description of the thesis
* strengths and weaknesses of the thesis
* recommended grade (0-5, where 0 is a failing thesis and 5 is an excellent thesis) based on the clarity of the problem and the solution, complexity of the problem, suitability of the chosen solution, proper execution of the solution, and the proper formatting and language use in the thesis.
* at least three questions that can be asked during the defence.

Based on the student's performance at the defence the reviewer may change the recommended grade.

The reviewer will receive a copy of the thesis about two-three weeks before the final/hard university deadline for submitting the thesis. The reason for this is that typically reviewers point out the typos and small factual mistakes that can be fixed in short time (about a week). The student will receive the review 1-2 weeks before the final university deadline and therefore is able to address some of the comments before submitting the final version. The student can also still decide not to submit the thesis this round, but rather work on improving the quality and then submit an improved version in the next defence period.

=== OIS declaration===
Before a student can proceed to the thesis defence, they have to declare the thesis topic in OIS and get approval from their supervisor. Please pay careful attention to the OIS declaration deadline, as without this you will not be permitted to attend the defence. If you will defend your thesis in Tartu University, then you should do your OIS declaration to their systems according to their deadlines.

=== Submission of Final Copy===

Each student will submit the pdf version of the thesis, the relevant thesis metadata and licence information via moodle course page link given in "important deadlines" section of relevant defence period. Please complete the steps 1, 2 and 3 of the thesis submission on this page.

In addition to submission of above materials via Moodle, one paper copy of your thesis will be collected before defence, which you will get back after defence. The details will be announced one or two weeks before the deadline.

If you will defend your thesis in Tartu University, then you should submit final copy according to the procedures and deadlines of Tartu University.

NB! Do not forget that you need to prepare a '''15 min presentation for your defence'''. This should really not be left to the evening before the defence!

=== The defence procedure ===
On the day of defence, students will present their theses according to the announced schedule. Generally, the results will be announced at the end of the day.

The defence procedure for each student consists of the following steps:
* the committee Chairman announces the name of the student, the topic of the thesis, and the names of the supervisor(s) and reviewer.
* the student presents his or her thesis in 15 minutes.
* the student answers the reviewer's questions and the reviewer recommends a grade. This recommendation may differ from the preliminary recommendation, based on how successful the defence was.
* the student answers questions from the committee.
* the student answers questions from the audience.
* the supervisor gives his or her opinion of the thesis and recommends a grade.

NB! The recommended grades by the reviewer and the supervisor are not binding to the committee, who makes the final decision.

* After the thesis defence, please visit the Dean's Office for more information about final formalities.
* [http://lab.cs.ttu.ee/theses Upload your thesis if you would like to have it public]

== Formal Requirements and recommendations ==

Until further notice, please use the formatting guide from the School of Information Technologies (link to the guide is given [https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ here]). Please note that you will have to change the title page as of 01.01.2017:
* write "School of Information Technology" instead of "Faculty of Information Technology"
* write "Department of Software Science" instead of "Department of Computer Engineering".

The thesis code for IVCM is ITC70LT.

The following advices can be considered for a master thesis
* a title page, an author declaration, an annotation in English and Estonian, a list of contents, and references are required in the thesis
* 50-80 pages + appendices if needed
* Times New Roman (or similar), font size 12, 1.5 spacing used for the ordinary text
* Headings are numbered and no more than 3 levels used
* Don't forget page numbers

== Topic and supervisor ==
Every student must have a supervisor when writing the thesis. The supervisor's role is to provide guidance on topic selection and research methods, as well as to give feedback on your work. It is not the supervisor's duty to correct spelling mistakes or formatting errors - they may point such things out, but the responsibility remains with you. Before a thesis will be accepted for defence, the supervisor has to agree that it is of sufficient quality.

Almost any professor and lecturer you have met in your curriculum can act as an supervisor of your thesis. Some of them have some open problems suitable for doing research and writing a thesis, but many may not have a topic to offer right away. It is usually more helpful to have an initial idea of a topic of your thesis and ask someone with interests in the related field to advise you. You can have a supervisor not related to the university, but he can act only as a co-supervisor and you need to agree to somebody related to the curricula or the [http://www.ttu.ee/faculty-of-information-technology/faculty-of-information-technology-1/about-faculty-2/departments/department-of-computer-science-2/ leading institute] of the curriculum to be an official co-supervisor. All (co-)supervisor must have at least a Master's degree.

When refining a topic idea, make sure it has a clear connection with cyber security.

== Potential supervisors & proposed topics ==

The topics below are offered by potential (co-)supervisors (in alphabetical order). The list is updated as new offers emerge.

==== From Hayretdin Bahsi, Tallinn University of Technology, hayretdin.bahsi@ttu.ee ====

I am interested in various topics which can be categorized as technical, organizational and strategic. If you already have specific topics in your mind, we can discuss them and decide to work together.

Technical Topics

* Application of machine learning and data mining methods to the following cyber security problems: Malware detection, botnet identification, intrusion detection in SCADA or IoT systems and extraction of cyber threat intelligence

* Cyber security of Industrial Control or IoT systems: Development of a security testbed, honeypots, intrusion detection systems, digital forensics issues

* Situational Awareness and Cyber Threat Intelligence: Impact of cyber threats on business processes, sophistication analysis of cyber attacks, cyber threat information sharing protocols, privacy preserved sharing of cyber threat intelligence

Organizational Topics

* Cyber insurance
* Security operation center (SOC) models
* Case studies for the improvement of SOC processes such as threat monitoring, incident handling, or vulnerability management

Strategic Topics

* High-level information flows and reporting mechanisms among the major entities of national cyber security governance structures
* Maturity models for the analysis of national cyber security capability

==== From Bernhards Blumbergs ====
* network security
* exploit development,
* advanced threats
* security evasion,
* IPv6

==== From Aivo Kalu, Cybernetica AS ====
* Pilveteenuste ohuanalüüs ja võrdlus ISKE-ga

==== From Jüri Kivimaa, Tallinn University of Technology ====
* IT security economics
* security cost optimization

==== From Aleksandr Lenin, Cybernetica AS. ====

TBA

==== From Toomas Lepik, Tallinn University of Technology ====

* forensics
* malware
* anti-malware

==== From Birgy Lorenz, Tallinn University of Technology ====
birgy.lorenz@ttu.ee

* human factors in cybersecurity
* cyber awareness and training (kindergarten, schools, laypersons)
* cybersecurity young talents skills and its development and testing
* women in cybersecurity

==== From Mika Kerttunen, Tallinn University of Technology ====
* Mathematical modeling of critical infrastructure protection: priorities and decision-making
* From table-top to lap-top: The objectives, methods, and conduct of operational level cyber security exercises
* International attribution council
* Public-private partnerships
* Military cyber defence

==== From [https://maennel.net Olaf Maennel], Tallinn University of Technology, olaf.maennel@ttu.ee ====

No slots available anymore. Accepting next students only who are working towards January '''2020''' (or later) defences.

==== From Rain Ottis, Tallinn University of Technology ====

* national cyber security
* serious games in cyber security/cyber security exercises

==== From Arnis Paršovs, University of Tartu, arnis@ut.ee ====
* eID
* PKI
* TLS
* Smart cards

==== From Mauno Pihelgas ====
* system monitoring
* network monitoring
* IDS/IPS systems
* insider threat detection

==== From Jaan Priisalu, Tallinn University of Technology ====

* TBD

==== Tiia Sõmer ====

Currently no topics on offer.

==== From Kaie Maennel, Tallinn University of Technology ====
(kaie.maennel@ttu.ee)

- cyber awareness and hygiene

- cyber security learning and teaching (e.g., serious games, cyber defense exercises, etc.)

- learning analytics in cyber security training context

- human factors in cyber security

==== From Eneken Tikk, Tallinn University of Technology ====
* Technical and organizational implementation of the GDPR
* Monetization of personal data
* Economics of cybersecurity (the cost of implementation relative to the anticipated and evidenced gains)
* Cyber insurance
* Non-military strategies for national and international cybersecurity
* Legal aspects of cybersecurity

==== From Risto Vaarandi, Tallinn University of Technology ====

* log collection and analysis
* event correlation
* network monitoring
* security monitoring
'''Application for supervision requires passing the Cyber Defense Monitoring Solutions course with grade 4 or 5.'''

==== From the TUT IT office ====
Infrastructure
* Migrating TUT Campus LAN to IPv6; Edgars Zigurs
* Implementing a freeware SIEM solution in TUT; Edgars Zigurs
* Campus WiFi quality and signal strength modeling (3D); Edgars Zigurs

Development
* electronic door signs, room calendars, etc.; Thomas Lepik
* VoIP solutions - softphone, integration with existing information systems; Thomas Lepik
* integrating last generation BMS (Building Management System); Thomas Lepik
* the student view of OIS (usability, security, re-design); Enn Rebane

==== From Estonian Police ====
* Vaatlustarkvarade EnCase ja Autopsy võrdlus (selgituseks, et Autopsy on EnCase analoog, kuid tasuta. Vajalik oleks täpne analüüs, et mida Autopsy võimaldab ja mida mitte võrreldes EnCase ja/või FTKga).

* Erinevate suhtlustarkvarade (WhatsApp, Viber, FB Messenger, Skype jt) jäljed mobiiltelefonides ja nende analüüsimine (selgituseks, et üldjuhul loovad suhtlustarkvarad mingi andmebaasi vestlustega ka telefoni, kas see on krüpteeritud või mitte? Osad vestlused XRY tuvastab, aga millistel juhtudel? Millised võimalused oleks neid faile nö käsitsi uurida?).

* Tõendiahela kirjeldamine elektrooniliste tõendite fikseerimisel (chain of custody)/Elektroonilise sisu erikohtlemine asitõendi vaatlusel/Digitaaltõendite vaatluse kord – erinevate riikid analüüs ja võrdlus.

* P2P võrkudes lastest ebasündsate piltide levitajate tuvastamine/P2P võrkudes illegaalse internetisisu levitajate tuvastamine.

* Koolituskava väljatöötamine uurijale/menetlejale, kes puutub kokku digitaalsete tõenditega- erinevate riikide praktika võrdlus.

* Ask Rain Ottis for a POC on these topics.

== Useful links ==
[https://drive.google.com/file/d/0B7yq33Gize8ydEh5X0NxeWtZc3c/edit ITX8040 Thesis advice slides]

[https://www.ttu.ee/faculties/school-of-information-technologies/it-studies/thesis-and-graduation-9/thesis-formatting-5/ Format requirements of a thesis (TTU)]

[http://www.lib.ttu.ee/dbs/abaasid.asp Databases, books, research papers accessible from the TTU network]

[https://courses.cs.ttu.ee/pages/Research_Method An Overview of Research Methods]

[https://courses.cs.ttu.ee/pages/Defended_thesis_cyber Previously Defended Theses]