In the wake of the Russian invasion of Ukraine, a compelling question arises, could this event have brought Europeans closer? Armed conflicts often strengthen in-group identity as individuals seek safety from external threats. This study speculates that the perceived threat of the invasion might have intensified emotional attachments to Europe across the continent. Additionally, it explores how the response differed between Western Europe and Central and Eastern European countries. This study bases its conceptualization, hypotheses, and interpretations on social identity theory, alongside a comprehensive review of the literature on armed conflict and identity. Utilizing a quasi-experimental method to investigate the probable causal link and using 12 countries from the 10th round of the European Social Survey to generalize the findings across a diverse European population. The findings reveal that Europeans did not develop a stronger sense of European identity in response to the invasion, suggesting that Europeans do not perceive Europe as a meaningful identity to unite under or seek safety in when military conflicts intensify on the continent. This study contributes to the understanding that the European project, along with its socio-political efforts, has been relatively unsuccessful in establishing itself as a significant unifying point when conflicts intensify.

There are serious security risks with the growing use of IoT devices. Historically, manufacturers prioritized profit over security due to high demand, a perspective that has evolved but remains a challenge. With this, the security of IoT devices has been overlooked, especially regarding smart bulbs, as they tend to be bundled with other IoT devices by the research community, and consequently not receive the attentionthey require. This thesis aims to identify and analyze potential threats regarding smart bulbs, and it does so by exploring proactive strategies in order to mitigate vulnerabilities. To understand the challenges smart bulbs face, some of the current applicable legislation, cyber attacks, defense mechanisms, and vulnerabilities were analyzed. Then, a network topology and a data flow diagram of a home network with smart bulbs was developed. Consequently, layers were assigned to the smart bulb, and threat modeling was performed on a each layer using STRIDE. This procedure was then formalized with a framework that encapsulates the stages of analysing the smart bulb’s landscape through threat modeling. This work contributes to the research community’s body of knowledge by providing valuable insights detailing the smart bulb’s landscape, not only through the framework but also through the conducted threat modeling, the data flow diagrams, and the information gathered regarding the threats to smart bulb security.

I denna uppsats undersöks krishantering vid svenska musikfestivaler. Studien fokuserar på hur dessa evenemang förbereder sig för och hanterar potentiella kriser. Denna uppsats har använt sig av sex kvalitativa semistrukturerade intervjuer med projekledare, säkerhetsansvariga, sakkuninga och andra personer med relevant kunskap och erfarenheter samt en dokumentstudie. Studien använder sig av ramverket Krishanteringens livscykel kompletterat med MSB:s fyra principer mot antagonistiska hot för att göra det mer tillämpat på musikfestivalbranschen. I resultatet framgår det att musikfestivalorganistationer lägger vikt vid utbildad personal, välutformade och tydliga krishanteringsplaner samt effektiv kommunikation för att säkerställa en säker musikfestivalmiljö. Som slutsats ser vi att svenska musikfestivalorganisationer ständigt måste vara förberedda för att kunna möta och planera inför nya kriser och hot. Genom tydliga och heltäckande krishanteringsplaner kan organisationerna ta an förebyggande åtgärder mot bland annat antagonistiska hot, trängselolyckor och sexualbrott. Vi har sett att säkerhetsarbetet är en kontinuerlig process som hela tiden måste utvärderas och förändras för att möta nya yttre faktorer som kan påverka musikfestivalorganisationer och dess deltagares trygghet. Denna studien är skriven på svenska. / This thesis explores crisis management at Swedish music festivals, focusing on how these events prepare for and manage potential crises. The study employs six qualitative semi-structured interviews with project leaders, security managers, experts, and other individuals possessing relevant knowledge and experience, as well as a document study. It utilizes the Crisis Management Lifecycle framework, enhanced with the MSB's four principles against antagonistic threats, to apply it specifically to the music festival industry. The results indicate that music festival organizations emphasize trained personnel, well-designed and clear crisis management plans, and effective communication to ensure a safe festival environment. In conclusion, we can see that Swedish music festival organizations must constantly be prepared to meet and plan for new crises and threats. Through clear and comprehensive crisis management plans, organizations can take preventive measures against, among other things, antagonistic threats, crowd accidents, and sexual assaults. We have seen that security work is a continuous process that must constantly be evaluated and adjusted to meet new external factors that may affect the safety of music festival organizations and their participants. This study is written in Swedish.

As the IoMT rapidly expands, severe security risks shadow its profound benefits inpatient monitoring and data management. These devices, integral to critical care like pace-maker shocks and insulin dosing, often sacrifice robust security for functionality due totheir limited capabilities. This critical vulnerability exposes them to exploits that couldhave fatal consequences. This thesis addresses these urgent security gaps by exploring in-novative protection strategies through systematic reviews and simulated penetration testingon a mimicked IoMT environment. Our findings expose pronounced deficiencies withinexisting security frameworks, focusing on Bluetooth LE and Wi-Fi threats, especially theinadequate mechanisms to secure Bluetooth LE connections, commonly used in IoMTdevices and DOS attacks targeted directly to the IoMT devices. In response, two novelsecurity algorithms were designed to enhance the resilience of IoMT systems against cy-ber threats. This algorithm integrates dynamic whitelisting and blacklisting, MAC addressverification, UDID verification, and NFC-based device authentication to curtail unautho-rized access and uphold data integrity. The adopted strategy not only addresses specificsecurity loopholes identified during penetration testing but also establishes a frameworkcapable of adapting to evolving threats. Through this research, we aim to contribute to theongoing discourse on IoMT security, underscoring the critical need for continuous adapta-tion of security measures to protect against emerging vulnerabilities in the rapidly evolvinglandscape of IoT devices. This work aspires to lay the groundwork for future research anddevelopment in IoMT security strategies, fostering a deeper understanding and implemen-tation of adequate security measures within medical technology.

Detta arbete avhandlar antagonistiska hot gentemot högstadie- och gymnasieskolor i Sverige i form av skolattacker och skolskjutningar. Fokuset har varit riktat mot projekteringsstadiet av nybyggnation och ombyggnation av skolor där förebyggande åtgärder kan genomföras för att försvåra för potentiella gärningsmän innan polis anländer och kan börja agera. Detta syftar också till att underlätta för personer som befinner sig inne i byggnaderna, samtidigt som utrymningsmöjligheterna vid brand enligt räddningstjänstens insatsidé bibehålls.De antagonistiska hoten har blivit allt vanligare i Sverige då hotbilden gentemot samhället har ökat. Denna utveckling kan leda till förödande konsekvenser där elever och skolpersonal riskerar allvarliga skador på sina liv och hälsa.Kvalitativa metoder i form av intervju med brandskyddsprojekterande brandingenjör samt tre intervjuer i pappersform med kommunala säkerhetssamordnare genomfördes som ett första steg. Därefter genomfördes studiebesök på två gymnasieskolor samt en ytterligare en intervju med sakkunnig polisinspektör inom POLKON-ämnet. Detta ligger till grund för de slutsatser och svar på frågeställningarna som lyfts i arbetet.Diskussionen kretsar kring vikten av integrerade säkerhetsperspektiv i planeringen av skolor, myndigheters samverkan och behovet av utbildning för personalen. Vid analyser av säkerhetsstrategier på skolor i de olika kommunerna belyses variationer och olika fokusområden inom säkerhetsplaneringen. Dessa inkluderar tekniska lösningar som säkerhetsappar, kameraövervakning och taggsystem, parallellt med betoning på elevers psykiska hälsa och en tidig upptäckt av eventuella hot.Det framgår att utrymnings- och inrymningsstrategier vid PDV inte alltid införs tillräckligt vid brandskyddsprojektering av skolor, vilket kan kräva anpassning och bättre hantering av vid potentiella hot.Polismyndighetens förändrade taktik mot ett än mer offensivt agerande vid PDV-situationer, liknande räddningstjänstens strategi vid brand i byggnader, betonas. Dock behövs fortsatt samordning och dialog mellan myndigheterna för att säkerställa en effektiv hantering av nödsituationer på skolor.Slutsatserna av arbetet är att ökad medvetenhet och anpassning av säkerhetsstrategier är nödvändigt för att möta dagens komplexa hot i skolor. Det betonas vikten av att införa lämpliga åtgärder för både brand och PDV i brandskyddsprojekteringen, samt säkerställa en samsyn mellan Polismyndighetens taktiska förhållningssätt och räddningstjänstens insatsstrategi för att trygga elever och personals säkerhet på skolor. Brister på krav i svensk lagstiftning bidrar till varierande säkerhetsåtgärder mellan kommuner och skolor.

This research explores the relationship between school shooter typologies, warning signs, and targeted school violence. The study's independent variables are school shooter typologies and warning signs, while the dependent variable is targeted school violence. The research wants to investigate whether a relationship exists between these variables. The null hypothesis states no relationship exists, while the alternative hypothesis suggests that a relationship exists. The research framework is based on Bronfenbrenner's Ecological System Theory, which helps understand how the environment and social interaction influence a child's development. The theory was influenced by Vygotsky's sociocultural theory—which focuses on the roles of human interactions and culturally structured activities in cognitive functioning that affect psychological growth, and Lewin's behaviorism theory—which proposed that behavior results from the individual and the environment. The findings show a strong, positive relationship, high correlation, and statistical significance difference between school shooter typologies, warning signs, and targeted school violence. The alternate hypothesis was accepted based on the findings, indicating that the relationship between these variables is not due to a coincidence or chance alone. These findings can offer valuable insights to policymakers in making informed decisions on allocating school safety resources to prevent targeted school violence.

[pt] A seca é um dos desastres naturais mais críticos que tem efeitos devastadores sobre habitats naturais, ecossistemas e muitos setores econômicos e sociais. Devido a esses graves impactos dos eventos de seca, muitos estudos estão focados no monitoramento, previsão e análise de risco de secas para auxiliar os planos de preparação e medidas de mitigação. Esta tese propõe um sistema de monitoramento e alerta de secas na região do semiárido do Brasil, chamado Drought Risk Assessment Interface (DRAI), que se baseia em um índice composto de risco de seca. O índice de risco possui duas componentes: ameaça e vulnerabilidade. A ameaça considera indicadores meteorológicos, enquanto a vulnerabilidade considera variáveis sociais. Com base na opinião de especialistas de vários países do mundo, com mais de 10 anos de experiência na área, foi definido o peso de cada um desses indicadores usando o processo de hierarquia analítica (AHP - Analytical Hierarchy Process). Os resultados foram comparados com outros índices de seca com o intuito de validar o índice proposto. Em seguida, foram levantados os principais sistemas de monitoramento e alertas em nível nacional e internacional e, então, foi proposto um padrão para geração de alertas no DRAI. Os alertas foram associados à sete medidas de mitigação de risco de seca validadas por técnicos locais. O DRAI tem como usuário final, além de outros pesquisadores, as Defesas Civis que poderão atuar diretamente nas ações de mitigação dos riscos. Como pesquisas futuras, sugere-se a automatização da coleta dos dados que compõem o índice de ameaça bem como a aplicação do estudo para todo o território brasileiro. / [en] Drought is one of the most critical natural disasters that have devastating effects on natural habitats, ecosystems and many economic and social sectors. Due to these severe impacts of drought events, many studies are focused on monitoring, forecasting and analyzing drought risk, to help with drought preparedness plans and mitigation measures. This study presents a drought early warning system in the semiarid region of Brazil, called the Drought Risk Assessment Interface (DRAI), which is based on a composite index of meteorological drought risk. The risk index has two components: hazard and vulnerability. The hazard considers meteorological indicators while the vulnerability considers social variables. Based on the opinion of experts from several countries in the world, with more than ten years of experience in the field, we define the weight of each of these indicators using the analytical hierarchy process (AHP). Then, the main early warning systems at national and international level were raised and then, a standard for generating warnings in the DRAI was proposed. The warnings were associated with seven drought risk mitigation measures validated by local technicians. DRAI has as its end user, in addition to other researchers, Civil Defenses that can act directly in risk mitigation actions. Finally, the system and its main features are presented. As future research, we suggest automating the collection of data that make up the hazard index as well as applying the study to the entire Brazilian territory.

[ES] Tanto la cantidad como la tipología de los ciberataques va en aumento día a día y la tendencia es que continúen creciendo de forma exponencial en los próximos años. Estos ciberataques afectan a todos los dispositivos, independientemente de si su propietario es un particular (o ciudadano), una empresa privada, un organismo público o una infraestructura crítica y los objetivos de estos ataques son muchos, desde la solicitud de una recompensa económica hasta el robo de información clasificada. Dado este hecho, los individuos, las organizaciones y las corporaciones deben tomar medidas para prevenirlos y, en caso de que en algún momento los reciban, analizarlos y reaccionar en caso de que fuese necesario. Cabe destacar que aquellos ataques que buscan ser más eficientes, son capaces de ocultarse un largo tiempo, incluso después de sus acciones iniciales, por lo que la detección del ataque y el saneamiento del sistema puede llegar a dificultarse a niveles insospechados o, incluso, no tenerse la certeza de que se ha hecho correctamente. Para prevenir, analizar y reaccionar ante los ataques más complejos, normalmente conocidos como ataques de día cero, las organizaciones deben tener ciberespecialistas conocidos como cazadores de amenazas. Éstos son los encargados de monitorizar los dispositivos de la empresa con el objetivo de detectar comportamientos extraños, analizarlos y concluir si se está produciendo un ataque o no con la finalidad de tomar decisiones al respecto. Estos ciberespecialistas deben analizar grandes cantidades de datos (mayormente benignos, repetitivos y con patrones predecibles) en cortos periodos de tiempo para detectar ciberataques, con la sobrecarga cognitiva asociada. El uso de inteligencia artificial, específicamente aprendizaje automático y aprendizaje profundo, puede impactar de forma notable en el análisis en tiempo real de dichos datos. Además, si los ciberespecialistas son capaces de visualizar los datos de forma correcta, éstos pueden ser capaces de obtener una mayor consciencia situacional del problema al que se enfrentan. Este trabajo busca definir una arquitectura que contemple desde la adquisición de datos hasta la visualización de los mismos, pasando por el procesamiento de éstos y la generación de hipótesis acerca de lo que está sucediendo en la infraestructura monitorizada. Además, en la definición de la misma se deberá tener en consideración aspectos tan importantes como la disponibilidad, integridad y confidencialidad de los datos, así como la alta disponibilidad de los distintos componentes que conformen ésta. Una vez definida la arquitectura, este trabajo busca validarla haciendo uso de un prototipo que la implemente en su totalidad. Durante esta fase de evaluación, es importante que quede demostrada la versatilidad de la arquitectura propuesta para trabajar en diferentes casos de uso, así como su capacidad para adaptarse a los cambios que se producen en las distintas técnicas de aprendizaje automático y aprendizaje profundo. / [CA] Tant la quantitat com la tipologia dels ciberatacs va en augment dia a dia i la tendència és que continuen creixent de manera exponencial en els pròxims anys. Aquestos ciberatacs afecten a tots els dispositius, independentment de si el seu propietari és un particular (o ciutadà), una empresa privada, un organisme públic o una infraestructura crítica i els objectius d'aquestos atacs són molts, des de la sol·licitud d'una recompensa econòmica fins al robatori d'informació classificada. Donat aquest fet, els individus, les organitzacions i les corporacions deuen prendre mesures per a previndre'ls i, en cas que en algun moment els reben, analitzar-los i reaccionar en cas que fora necessari. Cal destacar que aquells atacs que busquen ser més eficients, són capaços d'ocultar-se un llarg temps, fins i tot després de les seues accions inicials, per la qual cosa la detecció de l'atac i el sanejament del sistema pot arribar a dificultar-se a nivells insospitats o, fins i tot, no tindre's la certesa que s'ha fet correctament. Per a previndre, analitzar i reaccionar davant els atacs més complexos, normalment coneguts com a atacs de dia zero, les organitzacions han de tindre ciberespecialistes coneguts com caçadors d'amenaces. Aquestos són els encarregats de monitoritzar els dispositius de l'empresa amb l'objectiu de detectar comportaments estranys, analitzar-los i concloure si s'està produint un atac o no amb la finalitat de prendre decisions al respecte. Aquestos ciberespecialistes han d'analitzar grans quantitats de dades (majoritàriament benignes, repetitives i amb patrons predictibles) en curts períodes de temps per a detectar els ciberatacs, amb la sobrecàrrega cognitiva associada. L'ús d'intel·ligència artificial, específicament aprenentatge automàtic i aprenentatge profund, pot impactar de manera notable en l'anàlisi en temps real d'aquestes dades. A més, si els ciberespecialistes són capaços de visualitzar les dades de manera correcta, aquestos poden ser capaços d'obtindre una major consciència situacional del problema al qual s'enfronten. Aquest treball busca definir una arquitectura que contemple des de l'adquisició de dades fins a la visualització d'aquestes, passant pel processament de la informació recol·lectada i la generació d'hipòtesis sobre el que està succeint en la infraestructura monitoritzada. A més, en la definició de la mateixa s'haurà de tindre en consideració aspectes tan importants com la disponibilitat, integritat i confidencialitat de les dades, així com la alta disponibilitat dels diferents components que conformen aquesta. Una volta s'hatja definit l'arquitectura, aquest treball busca validar-la fent ús d'un prototip que la implemente íntegrament. Durant aquesta fase d'avaluació, és important que quede demostrada la versatilitat de l'arquitectura proposada per a treballar en diferents casos d'ús, així com la seua capacitat per a adaptar-se als canvis que es produïxen en les diferents tècniques d'aprenentatge automàtic i aprenentatge profund. / [EN] Both the number and type of cyber-attacks are increasing day by day and the trend is that they will continue to grow exponentially in the coming years. These cyber-attacks affect all devices, regardless of whether the owner is an individual (or citizen), a private company, a public entity or a critical infrastructure, and the targets of these attacks are many, ranging from the demand for financial reward to the theft of classified information. Given this fact, individuals, organisations and corporations must take steps to prevent them and, in case they ever receive them, analyse them and react if necessary. It should be noted that those attacks that seek to be more efficient are able to hide for a long time, even after their initial actions, so that the detection of the attack and the remediation of the system can become difficult to unsuspected levels or even uncertain whether it has been done correctly. To prevent, analyse and react to the most complex attacks, usually known as zero-day attacks, organisations must have cyber-specialists known as threat hunters. They are responsible for monitoring the company's devices in order to detect strange behaviours, analyse it and conclude whether or not an attack is taking place in order to make decisions about it. These cyber-specialists must analyse large amounts of data (mostly benign, repetitive and with predictable patterns) in short periods of time to detect cyber-attacks, with the associated cognitive overload. The use of artificial intelligence, specifically machine learning and deep learning, can significantly impact the real-time analysis of such data. Not only that, but if these cyber-specialists are able to visualise the data correctly, they may be able to gain greater situational awareness of the problem they face. This work seeks to define an architecture that contemplates from data acquisition to data visualisation, including data processing and the generation of hypotheses about what is happening in the monitored infrastructure. In addition, the definition of the architecture must take into consideration important aspects such as the availability, integrity and confidentiality of the data, as well as the high availability of the different components that make it up. Once the architecture has been defined, this work seeks to validate it by using a prototype that fully implements it. During this evaluation phase, it is important to demonstrate the versatility of the proposed architecture to work in different use cases, as well as its capacity to adapt to the changes that occur in the different machine learning and deep learning techniques. / Aragonés Lozano, M. (2024). Threat Hunting basado en técnicas de Inteligencia Artificial [Tesis doctoral]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/204427

A malicious actor often relies on security vulnerabilities of IT systems to launch a cyber attack. Most cloud services are supported by an orchestration of large and complex systems which are prone to vulnerabilities, making threat assessment very challenging. In this research, I developed formal and practical ontology-based techniques that enable automated evaluation of a cloud system's security threats. I use an architecture for threat assessment of cloud systems that leverages a dynamically generated ontology knowledge base. I created an ontology model and represented the components of a cloud system. These ontologies are designed for a set of domains that covers some cloud's aspects and information technology products' cyber threat data. The inputs to our architecture are the configurations of cloud assets and components specification (which encompass the desired assessment procedures) and the outputs are actionable threat assessment results. The focus of this work is on ways of enumerating, assessing, and mitigating emerging cyber security threats. A research toolkit system has been developed to evaluate our architecture. We expect our techniques to be leveraged by any cloud provider or consumer in closing the gap of identifying and remediating known or impending security threats facing their cloud's assets.

The decision of the landmark United States Supreme Court case Miranda v. Arizona (1966) established procedural safeguards to protect custodial suspects' 5th and 6th Amendment rights through requiring provision of what is now known as the Miranda warnings prior to interrogation. Suspects may elect to waive their rights once informed; however, research indicates that many individuals have inadequate knowledge and appreciation of their Miranda rights and consequences of waiving them. Miranda abilities and individual factors are critical factors in determining the validity of Miranda rights waivers. Researchers implicated many factors as influencing waiver decisions (e.g., intellectual ability, psychopathology, age); however, the differential impact of racial/ethnic identity is relatively unexplored. The importance of the investigation of race/ethnicity in Miranda abilities and decisions is underscored by the established differences in perceptions of police officers for racial/ethnic groups. Additionally, scholars have identified a potential presence of stereotype threat contributing to detrimental interrogation decisions. The current study advances previous research through examining the influence of racial/ethnic identity on Miranda abilities and waiver decision. This study also seeks to further the understanding of the effects of perceptions of police officers and presence of stereotype threat through investigate the role of those variables in Miranda abilities and decisions. Using a diverse sample via MTurk, the purpose of the study is to investigate these relevant factors in the intersection of Miranda and race/ethnicity to help inform researchers, forensic practitioners, and policy-makers.