Analysts working in Security Operations Centres (SOCs) investigate thousands of alerts daily, often leading to burnout and fatigue. In recent years, machine learning (ML) has emerged as a promising solution to automate the workflows of SOC analysts. However, analysts are often contractually obligated to investigate all alerts, thus, making it critical that they can understand how such ML-based solutions work.
The objective of this PhD project is to create ‘AI-assisted practitioners' for incident response by developing novel human-in-the-loop ML algorithms that reduce analyst workload and provide decision-making assistance. We propose to develop explainable ML algorithms that summarize large volumes of observable data (intrusion alerts, network & system logs) to discover contextually meaningful patterns from them. The student will conduct fundamental research and explore various learning paradigms to develop actionable explanations from these discovered patterns that are tailored to the operator's expertise. The evaluation of these algorithms will be done under closed-world and open-world settings. For the closed-world setting, a major challenge is the lack of suitable datasets to evaluate ML models. The student will set up a testbed together with our industry collaborators for the collection of intrusion alert datasets. For the open-world setting, the student will deploy these algorithms in real SOC environments to measure the extent of workload reduction experienced by the analysts. In doing so, we aim to develop technologies that are not only novel but also have real-world applications.
The PhD student will be embedded within the Semantics, Cybersecurity, and Services (SCS) group at the University of Twente. The student will have the opportunity to participate in internships and/or collaboration with industry partners under the TUCCR initiative. The SCS group offers a stimulating, supportive, and diverse research environment, as well as plenty of opportunities for personal and professional growth.
Information and application
Are you interested in this position? Please send your application via the 'Apply now' button below before October 7, 2024, and include:
- A cover letter (maximum 2 pages A4), emphasizing your specific interest, qualifications, motivations to apply for this position.
- A Curriculum Vitae, including a list of all courses attended and grades obtained, and, if applicable, a list of publications and references.
- An IELTS-test, Internet TOEFL test (TOEFL-iBT), or a Cambridge CAE-C (CPE). Applicants with a non-Dutch qualification and who have not had secondary and tertiary education in English can only be admitted with an IELTS-test showing a total band score of at least 6.5, internet. TOEFL test (TOEFL-iBT) showing a score of at least 90, or a Cambridge CAE-C (CPE).
Missing documents will lead to an immediate rejection of the application.
Date of first interviews: October 14, 2024.
For more information regarding this position, you are welcome to contact Azqa Nadeem (a.nadeem@utwente.nl)
About the department
Digitalization brings many new opportunities for businesses and governments by fostering the development of innovative online services. However, this development also brings new challenges, notably in terms of intelligence, interoperability, security, and privacy. The mission of the Semantics, Cybersecurity and Services (SCS) group is to advance the development of innovative online services with improved quality through context alignment and with reduced security and privacy threats.
SCS is part of the Twente University Centre for Cybersecurity Research (TUCCR), a public-private partnership where experts, professionals, entrepreneurs, researchers, and students from industry and knowledge partners collaborate to deliver talents, innovations, and know-how in the domain of cybersecurity. The mission of TUCCR is to strengthen the security and digital sovereignty of our society by performing top-level research on real-world data, systems, and network security challenges. To achieve significant societal impact, TUCCR combines technical, socio-economic, and ethical know-how and is equipped with state-of-the-art infrastructure, ranging from security labs, testbeds, and data lakes. Key outputs include innovation in the form of technologies, tools, minimum viable products, start-ups, and top-tier scientific publications, as well as first-class graduates at Bachelor, Master, and PhD levels. TUCCR’s founding partners are Betaalvereniging Nederland, BetterBe, Cisco, NCSC, NDIX, Northwave, SIDN, SURF, Thales, TNO, and the University of Twente.
About the organisation
The faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS) uses mathematics, electronics and computer technology to contribute to the development of Information and Communication Technology (ICT). With ICT present in almost every device and product we use nowadays, we embrace our role as contributors to a broad range of societal activities and as pioneers of tomorrow's digital society. As part of a people-first tech university that aims to shape society, individuals and connections, our faculty works together intensively with industrial partners and researchers in the Netherlands and abroad, and conducts extensive research for external commissioning parties and funders. Our research has a high profile both in the Netherlands and internationally. It has been accommodated in three multidisciplinary UT research institutes: Mesa+ Institute, TechMed Centre and Digital Society Institute.
Want to know more?
