Advances in mobile and pervasive computing, electronics technology, and the exponential growth in Internet of Things (IoT) applications and services has led to Building Automation System (BAS) that enhanced the buildings we live by delivering more energy-saving, intelligent, comfortable, and better utilization. Through the use of integrated protocols, a BAS can interconnects a wide range of building assets so that the control and management of asset operations and their services can be performed in one protocol. Moreover, through the use of distributed computing and IP based communication, a BAS can implement remote monitor and control in adaptive and real-time manner. However, the use of IoT and distributed computing techniques in BAS are leading to challenges to secure and protect information and services due to the significant increase in the attack surface and the inherent vulnerabilities of BAS integrated protocols. Since there is no intrusion detection and prevention available for BAS network, proposing a reliable security mechanism which can monitor the behavior of BAS assets becomes a major design issue. Anomaly Based Intrusion Detection is a security mechanism that uses baseline model to describe the normal behaviors of a system, so that malicious behaviors occurred in a system can be detected by comparing the observed behavior to the baseline model. With its ability of detecting novel and new attacks, Anomaly based Behavior Analysis (ABA) has been actively pursued by researchers for designing Intrusion Detection Systems. Since the information acquired from a BAS system can be from a variety of sources (e.g. sensors, network protocols, temporal and spatial information), the traditional ABA methodology which merely focuses on analyzing the behavior of communication protocols will not be effective in protecting BAS networks. In this dissertation we aim at developing a general methodology named Context Aware Anomaly based Behavior Analysis (CAABA) which combines Context Awareness technique with Anomaly based Behavior Analysis in order to detect any type of anomaly behaviors occurred in Building Automation Systems. Context Awareness is a technique which is widely used in pervasive computing and it aims at gathering information about a system's environment so it can accurately characterize the current operational context of the BAS network and its services. The CAABA methodology can be used to protect a variety of BAS networks in a sustainable and reliable way. To handle the heterogeneous BAS information, we developed a novel Context Aware Data Structure to represent the information acquired from the sensors and resources during execution of the BAS system which can explicitly describe the system's behavior. By performing Anomaly based Behavior Analysis over the set of context arrays using either data mining algorithm or statistical functions, the BAS baseline models are generated. To validate our methodology, we have applied it to two different building application scenarios: a smart building system which is usually implemented in industrial and commercial office buildings and a smart home system which is implemented in residential buildings, where we have achieved good detection results with low detection errors.

Digitalisering och dess möjligheter blir en viktigare del inom fastighetsbranschen. Antalet uppkopplade enheter skapar nya affärsmodeller och analyser för resurseffektivitet och hållbar utveckling men står inför stora utmaningar som säkerhet och interoperabilitet. Fastighetsägare kan nyttja sensorer, automatisering och taggar för att skapa ett bättre inomhusklimat och lägre kostnader. Studien undersöker möjligheter och utmaningar med IoT och IT-plattformar som kan bidra till ett mer hållbart samhälle. Genom att studera branschorganisationen Sveriges Allmännytta och hur de kan nå ut till ett stort antal medlemsföretag kan vi framhäva hur fastigheter kan utvecklas med hjälp av Internet of Things. Resultatet visar att teknologin har en positiv påverkan vid bra implementering gällande energianvändning och hållbarhet men även på människan som bor eller vistas i byggnaden. Arbete för gemensamma standard och interoperabilitet av system ökar innovationskraft och möjlighet för fler företag att ta sig in på marknaden. / The digitalization and its potential is taking a more important role within real estate. The amount of connected devices create new business models and analyzes for better resource efficiency and sustainability but face big challenges such as security and interoperability. Real estate owners can utilize sensors, automation and tags to create a better bioclimate och lower costs. The study researches the opportunities and challenges regarding IoT and IT-platforms that can contribute to a sustainable society. By studying the bransch organisation Sveriges Allmännytta och how they can reach a great amount of affiliated companies, we can emphasize buildings can be improved through Internet of Things. The result shows a positive impact when it’s implemented correctly regarding the energy use and sustainability but also on the residents in the building. The work for standards and interoperability of system increases innovation and the possibility for more companies to enter the market.

La plupart des travaux réalisés dans le domaine de l'assistance à l'autonomie à domicile (AAL) reposent sur l'utilisation de capteurs visuels et audio tels que des caméras. Or, ces capteurs sont souvent rejetés par le patient à cause de leur caractère invasif. Des approches alternatives requièrent l'utilisation de capteurs embarqués sur la personne (GPS, bracelets électroniques ou puces RFID dans les vêtements...), et leur pertinence est donc ramenée à l'hypothèse que les personnes les portent effectivement, sans jamais les rejeter ni les oublier. Pour ces raisons, dans cette thèse, nous trouvons plus pertinentes les approches uniquement basées sur l'utilisation de capteurs binaires intégrés dans l'habitat, tels que les détecteurs de mouvements, les tapis sensitifs ou les barrières optiques. Dans un tel contexte technologique, il devient intéressant d'utiliser les paradigmes, les modèles et les outils des systèmes à événement Discrets (SED), initialement plutôt développés pour la modélisation, l'analyse et la commande des systèmes industriels complexes. Dans ces travaux de thèse, l'objectif est de construire une approche pour la modélisation et le suivi des habitudes de vie, basée sur les modèles et les paradigmes des SED et répondant à une problématique qui s'énonce de la manière suivante : L'objectif est de développer un cadre global pour découvrir et reconnaître les activités de la vie quotidienne d'un habitant vivant seul dans une maison intelligente. Cette maison intelligente doit être équipée uniquement de capteurs binaires, l'étiquetage par des experts des activités observées ne doit pas être nécessaire et les activités peuvent être représentées par des modèles probabilistes. La première méthode présentée dans cette thèse permet, à partir d'une base de données d'apprentissage et d'une description experte des activités à modéliser listées par des médecins, de construire pour chaque activité un modèle sous la forme d'un automate à état-fini probabiliste (PFA). La seconde méthode développée lors de cette thèse permet d'estimer en temps réel, à partir des seules données observées par les capteurs ambiants, quelle activité la personne observée réalise effectivement. Les méthodes décrites dans cette thèse sont illustrées en utilisant les données générées localement via l'utilisation d'un appartement prêté par ENS Paris-Saclay équipé pour répondre aux besoins expérimentaux de cette thèse. / Most of the work done in the field of ambient assisted living (AAL) is based on the use of visual and audio sensors such as cameras. However, these sensors are often rejected by the patient because of their invasiveness. Alternative approaches require the use of sensors embedded on the person (GPS, electronic wristbands or RFID chips in clothing ...), and their relevance is therefore reduced to the assumption that people actually wear them, without rejecting nor forgetting them. For these reasons, in this thesis, we find more relevant the approaches based on the use of binary sensors integrated into the habitat only, such as motion detectors, sensory mats or optical barriers. In such a technological context, it becomes interesting to use paradigms, models and tools of Discrete Event Systems (DES), initially developed for modeling, analysis and control of complex industrial systems. In this thesis work, the goal is to build an activity of daily living modeling and monitoring approach, based on the models and the paradigm of the DES and answering a problem that is expressed as follows:The objective is to develop a global framework to discover and recognise activities of daily living of an inhabitant living alone in a smart home. This smart home have to be equipped with binary sensors only, expert labeling of activities should not be needed and activities can be represented by probabilistic models. The first method presented in this thesis allows to build a probabilistic finite-state automata (PFA) from a learning database and an expert description of the activities to be modeled given by the medical staff. The second method developed during this thesis estimates, according to the observations, the activity performed by the monitored inhabitant. The methods described in this thesis are applied on data generated using an apartment lent by ENS Paris-Saclay and equipped according the experimental needs of this thesis. / La maggior parte dei lavori nel settore dell’Ambient Assisted Living (AAL) si basasull’uso di sensori visivi e audio come le telecamere. Tuttavia, questi sensori sonospesso rifiutati dal paziente a causa della loro natura invasiva. Gli approcci alternativi richiedono l’uso di sensori integrati nella persona (GPS, bracciali elettronici o chipRFID...), e la loro rilevanza è quindi ridotta all’ipotesi che le persone li indossino effettivamente, senza mai rifiutarli o dimenticarli.Per questi motivi, in questa tesi, troviamo approcci più rilevanti basati esclusivamente sull’uso di sensori binari integrati nell’habitat, come rilevatori di movimento,tappeti sensoriali o barriere fotoelettriche.In tale contesto tecnologico, diventa interessante utilizzare i paradigmi, i modelli egli strumenti dei sistemi ad eventi discreti (SED), inizialmente sviluppati per la modellazione, l’analisi e il controllo di sistemi industriali complessi.In questo lavoro di tesi, l’obiettivo è quello di presentare un metodo per la modellazione e il monitoraggio delle abitudini di vita, basato sui modelli e paradigmi di SEDe rispondendo ad un problema che si esprime come segue : L’obiettivo è quello di sviluppare un quadro globale per rivelare e riconoscere le attività della vita quotidiana di una persona che abita da sola in una smart home chedovrebbe essere dotata solo di sensori binari. Inoltre si suppone che non sia necessarial’etichettatura delle attività osservate da parte di un esperto e tali attività sono rappresentate da modelli probabilistici.Il primo metodo presentato in questa tesi permette di costruire un modello probabilistico di automa a stati finiti (PFA) ottenuto da un database di apprendimento e unadescrizione delle attività da parte di medici. Il secondo metodo sviluppato in questa tesi stima, alla luce delle osservazioni, qualeattività svolge la persona osservata. I metodi descritti sono illustrati utilizzando dati generati localmente attraverso l’usodi un appartamento messo a disposizione da ENS Paris-Saclay e attrezzato per soddisfarele esigenze sperimentali di questa tesi.

In recent years, buildings have been starting to become more automated to match the demand forenergy efficient and sustainable housing. Subsystems, or so-called Building Management Systems(BMS), such as heating, electricity or access control, are gradually becoming more automated. Thenext step is to integrate all BMS in a building within one system, which is then called a smartbuilding. However, while buildings are becoming more and more automated, the concerns ofcybersecurity grow larger. While integrating a wide range of Internet of Things (IoT) devices withthe system, the attack surfaces is larger, and this, together with the automation of criticalsubsystems in the building leads to that attacks in worse case can harm the occupants of thebuilding.In this paper, the threats and risks are analyzed by using a security threat model. The goal isto identify and analyze potential threats and risks to smart buildings, with the purpose to giveinsight in how to develop secure systems for them. The process of the model includes five phases ofwhich this study focuses on phase one and three, identifying losses after a successful attack, anddetermine goals and intentions of the attackers for specific attacks, respectively.As a result of the security analysis potential threats were defined, in which the ones withhighest threat event frequency included data leaks and disabling the heating system. Somevulnerabilities and recommendations to improv the system is also discussed, which is of importanceso that occupants can continue to live and work in sustainable, reliable and secure facilities. / På senare år har fastigheter utvecklats till att bli mer automatiserade för att matcha efterfrågan påenergieffektiva och hållbara bostäder. Fastighetslösningarna (Building Management Systems,BMS), såsom värme- eller passersystem, blir gradvis mer automatiserade. Nästa steg är att integreraalla BMS i en byggnad till ett gemensamt system, som då kallas för en smart fastighet. Medanbyggnader blir alltmer automatiserade, växer oron kring cybersäkerhet eftersom man delsintegrerar ett stort antal Internet of Things (IoT)-enheter med systemet och samtidigt automatiserarmånga kritiska fastighetslösningar. I värsta fall skulle därför en utomstående attack kunna leda tillfysisk skada på fastigheter eller personer som befinner sig där.I denna studie utförs en säkerhetsanalys där dessa hot och risker analyseras med hjälp av enhotmodellering. Målet är att identifiera och analysera potentiella hot och risker för smartafastigheter, med syftet att ge insikt i hur man bör säkra dessa system. Modelleringen innehåller femfaser, av vilka denna studie fokuserar på fas ett och tre. I första fasen identifieras vilka förluster somfinns för företag och boende efter en framgångsrik attack och i fas tre identifieras angriparnas måloch avsikter för specifika attacker.Ett resultat av säkerhetsanalysen är att av de potentiella hot som definierats, är de medhögsta antalet försök till attack per år (Threat Event Frecquency, TEF) dataläckage och attinaktivera värmesystemet. Några sårbarheter med smarta fastigheter och rekommendationer för attförbättra systemet diskuteras också. Att utveckla säkra system till smarta fastigheter är av störstavikt för att personer kan fortsätta bo och arbeta i hållbara, pålitliga och säkra byggnader.

Digitaliseringens framfart har med eftertryck lämnat tydliga spår vilken bransch den än har dragit fram över. Den effektiviserar befintliga processer som har sett likadana ut sedan mannaminne, lika väl som den har öppnat upp möjligheterna för helt nya företag som med innovativa affärsmodeller lyckas konkurrera med branschdominerande aktörer över en natt. I fastighetsbranschen är e-handelns påverkan på handelsaktörer och coworkingföretagens fotfäste på kontorsmarknaden de mest märkbara effekterna.  På bostadssidan har det hitintills inte hänt lika mycket, och inte heller har det fått samma uppmärksamhet i akademiska- likväl som icke-akademiska skrifter. Uppsatsens syfte är följaktligen att belysa de möjligheter och utmaningar som de berörda aktörerna står inför. Vidare undersöks huruvida bostadsutvecklare och byggherrar har olika förutsättningar och målbilder när de arbetar med att utveckla morgondagens boende.  Arbetet bygger på en kvalitativ studie inbegripandes tio aktörer verksamma på bostadsmarknaden. Bland de intervjuade återfinns fyra kommunala byggherrar, fyra privata byggherrar och två bostadsutvecklare. Den erhållna empirin vittnar om tydliga skillnader när det kommer till hur de kommunala och de privata aktörerna förhåller sig till möjligheten att skapa nya affärer genom att erbjuda sina kunder en tjänstearsenal som komplement till bostaden. De kommunala bolagen väljer där att hålla sig till sin kärnverksamhet medan de privata har tydliga satsningar på att erbjuda totallösningar kopplade till boendet.  Vidare framgår det av intervjuerna att bostadsutvecklarna fokuserar mer på att utveckla produkt- och tjänstelösningar som är attraktiva för kunden medan byggherrarna, utöver liknande satsningar, även har en stark vilja att utveckla lösningar som kan effektivisera fastigheternas drift och förvaltningen.  Avslutningsvis kan det konstateras att den största utmaningen som samtliga aktörer står inför är att få samtliga komponenter i fastigheten att synkronisera med varandra på en gemensam och öppen plattform. Det framgår dessvärre tydligt att den konceptuella smarta fastigheten som så ofta beskrivs i diverse rapporter fortfarande är en hägrande utopi. / The rapid progress of digitalisation has left clear traces on whichever industry it has encountered. It can streamline already existing processes within a company, as well as it has the ability to open up opportunities for new companies with innovative business models to rapidly compete with well-established firms. In the real estate industry the impact of e-commerce on firms within the trade sector and coworking companies’ impressive foothold in the office market are among the most perceptible effects.    However, fewer changes have been noted so far in the residential sector, and nor has the sector received as much attention in academic- as well as non-academic literature. The purpose of this essay is thus to highlight the opportunities and the challenges that affected actors are facing. Furthermore, this paper will investigate whether developers and owners of residential real estate assets are facing different conditions and/or have altered targets when working on developing the housing of tomorrow.  The study is based on qualitative interviews involving ten actors active in the residential market. Among the interviewees are four municipal residential owners, four private residential owners and two developers. The result of this study clearly shows differences when it comes to how the municipal and the private actors consider the opportunity to create new businesses by offering their customers services as complements to the home. The municipal companies choose to stick to their core business while the private ones are clearly determined to offer service solutions that are linked to the home.   Furthermore, the interviews show that developers focus more on developing digitalised service solutions that are attractive to the customers, while the owners, in addition to these solutions, also have a strong desire to develop solutions that can streamline the operations and the management of the properties.   In conclusion, it can be seen that the biggest challenge that all actors within the industry will face is to be able to properly synchronize all components in the property with each other on a common and open platform. Unfortunately, it appears as quite clear that the conceptual smart real estate, which is described in idealistic terms in various reports, is still just a looming utopia.

Fastighetsbranschen anses vara en av de branscher som mer motvillig än andra när det kommer till digital utveckling. Varför? När det även på högsta politiska nivå har sagts att Sverige ska vara bäst i världen på att använda och utnyttja digitaliseringens möjligheter, är det lätt att förstå att digitaliseringen som sådan är här för att stanna. Vid uppförandet av en smart byggnad utgör effektivisering av förvaltningen en stor del. Hur effektiv denna förvaltning är, kan antas till viss del vara beroende av hur effektiva andra branscher är. Det vill säga hur långt systemleverantörer eller andra branscher som på något sätt har en koppling till fastighetsförvaltning har kommit i sin egen digitalisering - vilket är vad denna uppsats är ämnad att besvara. Den slutsats som kan dras från undersökningens resultat är att det finns en koppling mellan hur långt aktörer med koppling till fastighetsförvaltning har kommit i sin digitalisering, och om detta effektiviserar arbetet med förvaltning. Detta främst för de som jobbar med någon typ av förvaltning. Dessutom ges man som läsare en överblick över hur långt vissa branscher har kommit i sitt arbete med digitalisering, utifrån respondenternas svar på den enkät som skickats ut. / The real estate and construction industry is typically viewed as the more reluctant to change, at least when one is talking about digitalization. Why is this so? When discussions on the highest political level are made regarding Swedens’ digitalization strategy, saying we are aiming at being the best in the world at utilizing the benefits of digitization, it is easy to assume that digitalization as a phenomenon is here to stay. When a smart building is being planned, as well as built, making facility management more effective plays a big part. How effective it is, is very easily correlated to how far industry actors have come in their own digitalization. That is, how far have actors in industries linked or associated with facility management come regarding their own digitalization - which is what this essay intends to answer. The conclusion that can be drawn from the survey results is that there is a connection between how far actors, that in some way are working property management, have come in their digitalisation, and how this streamlines the work with management. In addition, readers are given an overview of how far certain industries have come in their work with digitalization based on the respondents' answers to the questionnaire that was sent out.

Accelerometers deployed within smart structures produce a wealth of vibration data that can be analyzed to infer information about the types of acceleration events that are occurring within the structure. In the case of monitored smart buildings, some of these acceleration events are linked to occupant behavior, such as walking, operating machinery, closing doors, etc. The identification and classification of such events has many potential applications within a smart structure or city. Understanding occupant patterns could be beneficial for operations, retail, or HVAC management, as it could be used to monitor occupancy flow with a relatively sparse sensor network. It may also have detrimental implications in terms of cybersecurity, where such information could be mined for malicious practices if unauthorized access to the data was obtained. This work presents methods for the detection and classification of vibration events in an experimental smart building, Goodwin Hall at Virginia Tech. Goodwin Hall's 200+ accelerometer network is used to gather acceleration data, from which vibration events are automatically detected and clustered. The presence of a vibration event is detected from a raw acceleration signal with an adaptive RMS threshold method. A feature vector is then created for each extracted event as areas under regions of the FFT of the event's acceleration signal. The feature vectors are then mapped into a low-dimensional space using principal component analysis, where they are clustered with various unsupervised algorithms. These processes have shown to be successful when gathering vibration events from a single-sensor setup, but pose challenges when expanded to a multi-sensor network. Because of this, expanded applications such as a semi-supervised classifier for events detected anywhere in the building are currently still under development. This semi-supervised process, combined with the known location of each sensor would allow inferences to be drawn about the frequency of different activity types in regions of the building not captured in the labeled data. Future work intends to address these multi-sensor challenges with adjustments to the algorithm process. / Master of Science / All objects experience vibrations when they are disturbed by some force. In the case of this work, the object is complex, a classroom building, but the principle still stands. When the building is disturbed by a force it will vibrate, even if the force is small, such as a person walking down a hallway or closing a door. The vibrations caused by these 'events' are unique to the type of event, that is, footstep vibrations will be different from door vibrations. These vibrations are observed with accelerometers, and the corresponding signal is used to determine what type of event caused the vibration. First, an event is automatically detected within the signal and separated from it. Second, characteristics unique to the signal are identified, a process known as 'feature extraction.' Finally, those features are used to distinguish the event from others and to identify what had caused it based on previous experimental data. The ability to detect these events and classify them introduces many interesting applications, including any that would stem from occupant detection, including improved security or operations, retail, or HVAC management. The methods here may also be applicable to other applications, such as monitoring bridges and machinery, or for developing cutting-edge smartphone applications with the accelerometer that is built in.

Les lignes de produits logiciels ont pour objectif la réutilisation des documents, codes sources, architectures, et plus généralement tout artefact créé durant le développement de logiciels d'un même domaine. Pour cette réutilisation, on utilise aujourd'hui des ``modèles de caractéristiques''. L'approche consiste à décrire dans ce modèle les caractéristiques des artefacts créés et les contraintes permettant de les assembler, puis à sélectionner les caractéristiques représentatives d'un nouveau produit en le générant en tout ou partie. Dans certaines situations, une caractéristique représente un artefact associé à un élément du contexte que le produit doit gérer. Une telle caractéristique, et les contraintes relatives à sa mise en œuvre, peuvent être clonées pour chaque occurrence de l'élément dans le contexte. Dans le cadre de cette thèse, nous cherchons à déterminer l'impact du contexte d'exécution d'un futur produit sur les caractéristiques d'une ligne de produits logiciels. Nous explorons tout d'abord les différentes manières de représenter un modèle de caractéristiques et le contexte d'un produit. Nous proposons ensuite une méthode générique pour adapter un modèle de caractéristiques aux éléments d'un contexte. Cette thèse a été réalisée dans le contexte du projet RIDER (Reasearch for ITDriven EneRgy efficiency). Ce projet a pour objectif la réduction des pertes énergétiques subies à cause d'une gestion inappropriée des sources et des besoins énergétiques des bâtiments. La variété des équipements et les spécificités de chaque bâtiment nécessitent une adaptation au cas par cas des logiciels d'optimisation énergétique. Nous proposons donc d'appliquer à ce projet une approche par lignes de produits logiciels, et plus particulièrement, notre méthode d'adaptation de modèles de caractéristiques au contexte, pour adapter les logiciels d'optimisation énergétique au contexte spécifique de chaque bâtiment. / Software product lines aim at reusing documents, source code, architectures, and, all artefact created during software development achieved in a given domain. Nowadays, we use ``feature models'' to facilitate the reuse of such elements. The approach consists in describing, in this feature model, artefacts and their usage constraints, and then to identify representative features for creating a new product. In some situations, a feature represents an artefact associated to a context element that must be handled by the product. Such a feature, and its related constraints, can be cloned for each occurrence of instances of this element in a given context. In this thesis, we are try to determine the impact of a product execution context on a future product features. We first explore different ways for representing feature models and a product context. Then, we propose a generic method to adapt a feature model to context elements. This thesis has been achieved in the context of the RIDER project (Research for IT Driven EneRgy efficiency). This project aims at reducing energy waste due to an inappropriate management of energy sources and needs. The heterogeneousness of building equipments and each building specificities require to adapt energy optimisation software. We propose to apply a software product line approach to this project. More precisely, we propose to apply to this project our feature model context adaptation methodology, in order to adapt energy optimisation software to each building specific context.

abstract: Lighting systems and air-conditioning systems are two of the largest energy consuming end-uses in buildings. Lighting control in smart buildings and homes can be automated by having computer controlled lights and window blinds along with illumination sensors that are distributed in the building, while temperature control can be automated by having computer controlled air-conditioning systems. However, programming actuators in a large-scale environment for buildings and homes can be time consuming and expensive. This dissertation presents an approach that algorithmically sets up the control system that can automate any building without requiring custom programming. This is achieved by imbibing the system self calibrating and self learning abilities. For lighting control, the dissertation describes how the problem is non-deterministic polynomial-time hard(NP-Hard) but can be resolved by heuristics. The resulting system controls blinds to ensure uniform lighting and also adds artificial illumination to ensure light coverage remains adequate at all times of the day, while adjusting for weather and seasons. In the absence of daylight, the system resorts to artificial lighting. For temperature control, the dissertation describes how the temperature control problem is modeled using convex quadratic programming. The impact of every air conditioner on each sensor at a particular time is learnt using a linear regression model. The resulting system controls air-conditioning equipments to ensure the maintenance of user comfort and low cost of energy consumptions. The system can be deployed in large scale environments. It can accept multiple target setpoints at a time, which improves the flexibility and efficiency of cooling systems requiring temperature control. The methods proposed work as generic control algorithms and are not preprogrammed for a particular place or building. The feasibility, adaptivity and scalability features of the system have been validated through various actual and simulated experiments. / Dissertation/Thesis / Doctoral Dissertation Computer Science 2015

The concept of Smart Buildings and automated processes is a growing trend. Due to a rapidly growing market of buildings that relies on the Internet, improper security measures allow hackers to gain control over the whole system easily and cause devastating attacks. Plenty of effort is being put into testing and securing the devices within a smart building in order to contribute to a more sustainable society. This thesis has evaluated the security of a control system for water, ventilation, and heating in smart buildings by using ethical hacking, where the testing is based on a systematic and agile pentesting process. The penetration testing was conducted using the method Black- box testing, and the testing was based on a threat model that was created to identify vulnerabilities. The results from the penetration tests did not find any exploitable vulnerabilities. However, flaws in the system, such as data being transferred in clear text and unlimited login attempts, that need to be addressed to avoid further problems, were found. The conclusion from evaluating the control system affirms that the strength of the password has a significant role, but that system can still be exposed to other hacking techniques, such as ”Pass the hash”. / Begreppet smarta byggnader och automatiserade processer är en växande trend. På grund av en snabbt växande marknad av byggnader som är beroende av Internet, har bristfälliga säkerhetsåtgärder resulterat i att hackare enkelt kan få kontroll över hela systemet och orsaka förödande attacker. Ansträngningar läggs på att testa och säkra enheterna i en smart byggnad för att bidra till ett mer hållbart samhälle. Denna avhandling har utvärderat säkerheten för ett styrsystem för vatten, ventilation och uppvärmning i smarta byggnader med hjälp av etisk hacking, där testningen baseras på en systematisk och agil pentestning process. Penetrationstestningen genomfördes genom att använda sig av metoden Blackbox testning, medan testningen baserades på en hotmodell som skapades för att identifiera sårbarheter. Resultaten från penetrationstesterna hittade inga sårbarheter att dra nytta utav. Dock hittades brister i systemet, bland annat att data överförs i klartext och att användaren har oändligt många inloggningsförsök, som måste åtgärdas för att undvika framtida problem. Slutsatsen från utvärderingen av styrsystemet bekräftar att styrkan på lösenordet har en signifikant roll, men att systemet ändå kan vara utsatt av andra hackningstekniker så som ”Pass the hash”.