Dans un monde qui est en numérisation constante, la dépendance aux outils technologiques est devenue inévitable. La pandémie de COVID-19 a encore accéléré la tendance vers le travail et l'éducation à distance, entraînant une augmentation de l'activité en ligne et de l'échange de données. Cependant, malgré cette augmentation de l'activité en ligne, le niveau de sensibilisation à la cybersécurité chez un nombre important d'utilisateurs reste insuffisant. De nombreux utilisateurs manquent d'une éducation appropriée en matière de cybersécurité et de confidentialité en ligne et démontrent une compréhension insuffisante de la sensibilité de leurs données. Nous avons mené une enquête auprès de plus de 300 utilisateurs qui a confirmé que le besoin de contenu de meilleure qualité était évident. Les jeux éducatifs ont démontré leur efficacité en tant qu'outils d'enseignement et d'apprentissage, en particulier pour vulgariser des sujets qui nécessitent généralement une connaissance approfondie pour être maîtrisés. Cependant, des défis sont associés quant à la qualité et à l'évaluation des jeux sérieux, car plusieurs aspects de l’amusement sont subjectifs et intangibles. Motivée par le besoin de jeux éducatifs "de haute qualité" améliorés, cette thèse construit une échelle pour affiner les critères mentionnés par l'évaluation des jeux sérieux de Caserman et l'applique à 45 jeux de cybersécurité. L'évaluation a révélé une insuffisance dans les critères de l’amusement, en particulier le manque d'adaptation dynamique. En conséquence, cette étude propose le cadre de jeu de cybersécurité EVNAG (Educational Visual Novel Adaptive Game), qui s'articule autour de l'adaptation dynamique de la difficulté comme solution à ce problème. Inspiré par cette architecture, le roman visuel de cybersécurité "Grown-Up Blues" a été implémenté. La thèse contribue au corpus croissant de recherches sur les jeux éducatifs en cybersécurité et fournit des idées pour concevoir des jeux éducatifs efficaces qui améliorent l'éducation en matière de cybersécurité. / In a world that continues to be increasingly digitalized, the dependency on technological tools has become unavoidable. The COVID-19 pandemic has further accelerated the trend towards remote work and education, leading to an increase in online activity and data exchange. However, despite this surge in online activity, the level of cybersecurity awareness among a significant number of users remains inadequate. Many users lack proper education on cybersecurity and online privacy and demonstrate a lack of understanding of the sensitivity of their data. A survey we conducted on more than 300 users confirmed that the need for more quality content was blatant. Educational games have demonstrated their effectiveness as teaching and learning tools, particularly in vulgarizing topics generally requiring in-depth knowledge to master. However, challenges are associated with the quality and assessment of serious games, as multiple aspects of game enjoyment are subjective and intangible. Motivated by the need for improved “high quality” educational games, this thesis builds a scale to refine the criteria mentioned by Caserman’s assessment of serious games and applies that to 45 cybersecurity games. The assessment indicated a deficiency in the enjoyment criteria, specifically the lack of dynamic adaptation. As a result, this study proposes the EVNAG (Educational Visual Novel Adaptive Game) cybersecurity game framework, which centers on Dynamic Difficulty Adaptation as a solution to this issue. Inspired by this architecture, the cybersecurity visual novel “Grown-Up Blues” was implemented. The thesis contributes to the growing body of research on educational games in cybersecurity and provides insights for designing effective educational games that enhance cybersecurity education.

This thesis investigates how Large Language Models can be used to repair Solidity Smart Contracts automatically through the main contribution of this thesis, the Transformative Repair Tool. The Transformative Repair Tool achieves similar results to current state-of-the-art tools on the Smartbugs Curated Dataset and is the first published tool that uses Large Language Models to repair Solidity Smart Contracts. Moreover, the thesis explores different prompt strategies to repair Smart Contracts and assess their performance. / Detta masterexamensarbete undersöker hur stora språkmodeller kan användas för att automatisk laga solidity smarta kontrakt genom verktyget Transformative Repair Tool, som är detta masterexamensarbete huvudsakliga bidrag. Transformative Repair Tool presterar liknande som dagens bästa verktyg inom automatisk lagning av smarta kontrakt på Smartbugs Curated datasettet och är det första publicerade verktyget som just använder stora språkmodeller för att reparera solidity smarta kontrakt. Dessutom så utforskar denna rapport olika textprompts och dess prestanda för att laga smarta kontrakt

In our highly digitalized society, the dependence on digital solutions and systems is integral to the function of society. While digitalization has brought numerous benefits, it has also exposed society to vulnerabilities, making it susceptible to cyberattacks. The structure of vital societal functions, involving private subcontractors and long and digital supply chains. Along with the cooperation between public and private entities having inherent weaknesses it has created a vulnerable system. As vital societal functions bear the responsibility for public services and the protection of the personal information in their possession, it is crucial that they remain open to critical examination. Due to the complexity of cybersecurity and closely related subjects, the media plays an important role in conveying a nuanced depiction of the hacker attacks and establishing important connections to closely related discourses. This is essential for fostering critical examination and public debate, especially considering the assumed limited prior knowledge of the public. This thesis examines in what way cyberattacks against vital societal functions are portrayed in the Swedish media discourses and what connections to closely related discourses are being made. The focus is specifically on New Public Management, Public-Private Partnership, and Digital Supply Chains. Through a discourses analysis using an analytical framework inspired by Carol Bacchi, this thesis concludes that cyberattacks against vital societal functions are represented in a simplified way. The vital connections to other discourses are few and weak, resulting in a content-poor discourse that possibly hinders both critical examination and a public discussion on the subject.

<p>Facing increasingly sophisticated attacks from external adversaries, interdependent systems owners have to judiciously allocate their (often limited) security budget in order to reduce their cyber risks. However, when modeling human decision-making, behavioral economics has shown that humans consistently deviate from classical models of decision-making. Most notably, prospect theory, for which Kahneman won the 2002 Nobel memorial prize in economics, argues that humans perceive gains, losses and probabilities in a skewed manner. While there is a rich literature on prospect theory in economics and psychology, most of the existing work studying the security of interdependent systems does not take into account the aforementioned biases.</p> <p><br></p> <p>In this thesis, we propose novel mathematical behavioral security game models for the study of human decision-making in interdependent systems modeled by directed attack graphs. We show that behavioral biases lead to suboptimal resource allocation patterns. We also analyze the outcomes of protecting multiple isolated assets with heterogeneous valuations via decision- and game-theoretic frameworks, including simultaneous and sequential games. We show that behavioral defenders over-invest in higher-valued assets compared to rational defenders. We then propose different learning-based techniques and adapt two different tax-based mechanisms for guiding behavioral decision-makers towards optimal security investment decisions. In particular, we show the outcomes of such learning and mechanisms on four realistic interdependent systems. In total, our research establishes rigorous frameworks to analyze the security of both large-scale interdependent systems and heterogeneous isolated assets managed by human decision makers, and provides new and important insights into security vulnerabilities that arise in such settings.  </p>

This thesis contains pioneer work in Sweden which contributes to the research on cybersecurity teaching within the Technology subject as formulated in the course and subject governing documents.The work goes in line with a bigger strategy of the Swedish Civil Contingencies Agency (MSB) and the European Union (EU). A discourse analysis was performed on the interviews with four Swedish expertsfrom MSB, Internetstiftelsen, and #290CyberSecurity respectively where the interview questions were formulated around three axes; the first axis was the cybersecurity content and knowledge aimed at young individuals, the second axis was the experts’ views on teaching cybersecurity starting from lower secondary schools, and the third axis was regarding platforms or tools that could be used in cybersecurity teaching and what the experts’ perceptions on them are. The analysis resulted in six different codes and formulated the views of the experts. Content analysis was also performed on information from the experts’ organizations which were 14 security documents and reports in total that resulted in a content frame of ten cybersecurity areas. All the ten areas were found to be related to the keywords that appear in the governing documents of the Technology subjects in the course syllabus for grades 7-9 and the subject syllabus for Technology 1. Current cyber attacks and risks threatening young students were further analyzed under each area to narrow down the content frame tailoring it to young students. A new online evaluation tool was then developed to assess the cybersecurity sensibility of the young students. The formulation of the questions was inspired by the SANS cybersecurity awareness survey as well as based on both, the ten cybersecurity areas that are categorized in this thesis and the different scenarios of risks and cybersecurity attacks threatening young students. Domain SamplingTheory (DST) and scenario-based questions were considered to make the tool more fitting for the young and minimize the errors. The tool tested a random group of 250 students from 12 municipalities where110 were in the sixth grade and 140 in the ninth. The tool showed that despite students spending most of their time online using different devices and applications, they are not secure enough which puts them at risk. Moreover, most of the students were interested in getting cybersecurity education and very few received it in schools even though the cybersecurity requirements are stated in the governing documents of the Technology subject. / Detta examensarbete innehåller banbrytande arbete i Sverige vilket bidrar till forskningen om cybersäkerhetsundervisning inom teknikämnet i svenska skolor. Arbetet går i linje med en större strategi från Myndigheten för samhällsskydd och beredskap (MSB) och Europeiska unionen (EU). En diskursanalys utfördes på intervjuerna med fyra svenska experter från MSB, Internetstiftelsen och #290CyberSecurity där intervjufrågorna formulerades runt tre axlar; den första axeln var cybersäkerhetsinnehållet som är riktad mot unga individer, den andra axeln var experternas syn på undervisning i cybersäkerhet som börjar från grundskolorna, och den tredje axeln gällde de plattformar eller verktyg som kunde användas i cybersäkerhetundervisning samt vad experternas uppfattning om dem är. Analysen av intervjuer resulterade i sex olika koder vilket speglar experters åsikter. Innehållsanalys utfördes också på information från experternas organisationer. Det var totalt 14 säkerhetsdokument och rapporter som resulterade i en innehållsram med tio cybersäkerhetsområden. Alla de tio områdena är relaterade till nyckelorden som finns i styrdokumenten för teknikämnena i kursplanen för årskurs 7-9 och ämnesplanen för Teknik 1. Aktuella cyberattacker och risker som hotar unga elever analyserades vidare under varje område för att begränsa innehållsramen och anpassa den för unga elever. Ett nytt online utvärderingsverktyg utvecklades sedan för att bedöma cybersäkerhetsrespons och attityd hos de unga eleverna. Formuleringen av frågorna inspirerades av SANS cybersäkerhetsmedvetenhetsundersökning och var baserad på de tio cybersäkerhetsområdena som kategoriseras i detta examensarbete samt de olika scenarierna för risker och cybersäkerhetsattacker som hotar unga elever. Domain Sampling Theory (DST) och scenariobaserade frågor ansågs göra verktyget mer passande för de unga och minimera felen. Verktyget testade en slumpmässig grupp på 250 elever från 12 kommuner där 110 gick i 6:an och 140 i 9:an. Verktyget visade att trots att elever tillbringar större delen av sin tid online med olika enheter och applikationer är de inte tillräckligt säkra, vilket utgör en risk för dem. Dessutom var majoriteten av eleverna intresserade av att få utbildning i cybersäkerhet och väldigt få fick det i skolorna trots att det står i styrdokumenten för teknikämnet.

Brandväggar är en kritisk komponent i nätverkssäkerhet som kontrollerar och filtrerar nätverkstrafik för att skydda mot obehörig åtkomst och cyberhot. Effektiv hantering av brandväggsregler är avgörande för att säkerställa att ett nätverk fungerar smidigt och säkert. I stora företagsnätverk som Scania kan hanteringen av dessa regler bli komplex och resurskrävande, vilket kan leda till duplicerade och överlappande regler som försämrar systemets prestanda.Detta examensarbete undersöker tillämpningen av generativ artificiell intelligens (GAI) och maskininlärning för att hantera och optimera brandväggsregler, med fokus på identifiering och hantering av duplicerade och överlappande regler. Problemställningen adresserar de växande utmaningarna med att underhålla effektiva brandväggsregler i stora företagsnätverk som Scania. Genom att implementera och utvärdera en prototyp baserad på XGBoost, utforskar arbetet potentialen hos AI-tekniker för att förbättra hanteringen och säkerheten av nätverkstrafik. Resultaten visar att AI kan spela en kritisk roll i automatiseringen av processer för upptäckt och korrigering av felaktiga regler, vilket bidrar till ökad nätverkssäkerhet och optimerad resursanvändning. Studien bekräftar att användningen av AI inom brandväggshantering erbjuder betydande fördelar, men lyfter också fram behovet av fortsatt forskning för att adressera säkerhetsutmaningar relaterade till AI-lösningar. / Firewalls are a critical component of network security, controlling and filtering network traffic to protect against unauthorized access and cyber threats. Effective management of firewall rules is essential to ensure that a network operates smoothly and securely. In large enterprise networks like Scania, managing these rules can become complex and resourceintensive, leading to duplicate and overlapping rules that degrade system performance and security.This thesis investigates the application of generative AI (GAI) and machine learning to manage and optimize firewall rules, focusing on the identification and handling of duplicate and overlapping rules. The problem addresses the growing challenges of maintaining effective firewall rules in large enterprise networks like Scania. By implementing and evaluating a prototype based on XGBoost, this work explores the potential of AI techniques to improve the management and security of network traffic. The results demonstrate that AI can play a critical role in automating the processes for detecting and correcting faulty rules, contributing to increased network security and optimized resource usage. The study confirms that the use of AI in firewall management offers significant benefits but also highlights the need for further research to address security challenges related to AI solutions.

I detta examensarbete analyseras Purduemodellen och dess tillämplighet inomnätverkssäkerhet för industriella styrsystem inom ramarna för Industri 4.0. Genomen litteraturstudie granskas modellens struktur och funktion i relation till de nyautmaningarna som uppkommit genom ökad digitalisering och integrering av IIoTteknologier. Studien identifierar både styrkor och svagheter i den traditionellaPurduemodellen. I resultatavsnittet introduceras en modifierad version avPurduemodellen, utformad för att förstärka nätverkssäkerheten och öka systemensförmåga att hantera cyberhot samt anpassa sig till teknologiska förändringar i denindustriella sektorn. Denna anpassning har genomförts genom införandet avytterligare säkerhetsstandarder och verktyg i syfte att förbättra modellenseffektivitet och relevans. / In this thesis, the Purdue model and its applicability within network security forindustrial control systems under the framework of Industry 4.0 are analyzed.Through a literature review, the model's structure and function are examined inrelation to the new challenges that have emerged due to increased digitization andintegration of IIoT technologies. The study identifies both strengths and weaknessesin the traditional Purdue model. In the results section, a modified version of thePurdue model is introduced, designed to enhance network security and increase thesystems' ability to handle cyber threats and adapt to technological changes in theindustrial sector. This adaptation has been achieved by incorporating additionalsecurity standards and tools aimed at improving the model's efficiency andrelevance.

<p dir="ltr">In recent years, a surge in data-driven computation has significantly impacted security analysis in cyber-physical systems (CPSs), especially in decentralized environments. This transformation can be attributed to the remarkable computational power offered by high-performance computers (HPCs), coupled with advancements in distributed computing techniques and sophisticated learning algorithms like deep learning and reinforcement learning. Within this context, wireless communication systems and decentralized computing systems emerge as highly suitable environments for leveraging data-driven computation in security analysis. Our research endeavors have focused on exploring the vast potential of various deep learning algorithms within the CPS domains. We have not only delved into the intricacies of existing algorithms but also designed novel approaches tailored to the specific requirements of CPSs. A pivotal aspect of our work was the development of a comprehensive decentralized computing platform prototype, which served as the foundation for simulating complex networking scenarios typical of CPS environments. Within this framework, we harnessed deep learning techniques such as restricted Boltzmann machine (RBM) and deep convolutional neural network (DCNN) to address critical security concerns such as the detection of Quality of Service (QoS) degradation and Denial of Service (DoS) attacks in smart grids. Our experimental results showcased the superior performance of deep learning-based approaches compared to traditional pattern-based methods. Additionally, we devised a decentralized computing system that encompassed a novel decentralized learning algorithm, blockchain-based learning automation, distributed storage for data and models, and cryptography mechanisms to bolster the security and privacy of both data and models. Notably, our prototype demonstrated excellent efficacy, achieving a fine balance between model inference performance and confidentiality. Furthermore, we delved into the integration of domain knowledge from CPSs into our deep learning models. This integration shed light on the vulnerability of these models to dedicated adversarial attacks. Through these multifaceted endeavors, we aim to fortify the security posture of CPSs while unlocking the full potential of data-driven computation in safeguarding critical infrastructures.</p>

<p dir="ltr">This Research focuses on developing artificial intelligence tools to detect and mitigate cyber-attacks targeting unmanned aerial vehicles. </p>

<p dir="ltr">Modern software relies heavily on third-party dependencies (often distributed via public package registries), making software supply chain attacks a growing threat. Prior work investigated attacks and defenses, but only taxonomized attacks or proposed defensive techniques, did not consistently define software supply chain attacks, and did not provide properties to assess the security of software supply chains. We do not have a unified definition of software supply chain attacks nor a set of properties that a secure software supply chain should follow.</p><p dir="ltr">Guaranteeing authorship in a software supply chain is also a challenge. Package maintainers can guarantee package authorship through software signing. However, it is unclear how common this practice is or if existing signatures are created properly. Prior work provided raw data on registry signing practices, but only measured single platforms, did not consider quality, did not consider time, and did not assess factors that may influence signing. We do not have up-to-date measurements of signing practices nor do we know the quality of existing signatures. Furthermore, we lack a comprehensive understanding of factors that influence signing adoption.</p><p dir="ltr">This thesis addresses these gaps. First, we systematize existing knowledge into: (1) a four-stage supply chain attack pattern; and (2) a set of properties for secure supply chains (transparency, validity, and separation). Next, we measure current signing quantity and quality across three kinds of package registries: traditional software (Maven Central, PyPI), container images (Docker Hub), and machine learning models (Hugging Face). Then, we examine longitudinal trends in signing practices. Finally, we use a quasi-experiment to estimate the effect that various factors had on software signing practices.</p><p dir="ltr">To summarize the findings of our quasi-experiment: (1) mandating signature adoption improves the quantity of signatures; (2) providing dedicated tooling improves the quality of signing; (3) getting started is the hard part — once a maintainer begins to sign, they tend to continue doing so; and (4) although many supply chain attacks are mitigable via signing, signing adoption is primarily affected by registry policy rather than by public knowledge of attacks, new engineering standards, etc. These findings highlight the importance of software package registry managers and signing infrastructure.</p>