In recent years, machine learning (ML) solutions are increasingly being deployed in Security Operations Centres (SOCs) to enhance security coverage, and to reduce the number of missed attacks. Not only do these ML systems create many false positives, it is often very difficult to understand how they work in the first place. Moreover, the forensic analysis of incidents and incident response are largely manual procedures, leading to analyst burnout and ‘alert fatigue'.
The objective of this PhD project is to create ‘AI-assisted practitioners' for incident response by developing novel ML algorithms that reduce analyst workload and provide decision-making assistance. We propose to develop explainable ML algorithms that summarize large volumes of observable data (intrusion alerts, network & system logs) in order to discover contextually meaningful patterns from them. The student will explore multi-modal learning and generative AI to produce actionable explanations from these discovered patterns that are tailored to the operator's expertise. The evaluation of these algorithms will be done under closed-world and open-world settings. For the closed-world setting, a major challenge is the lack of suitable datasets to evaluate ML models. The student will set up a testbed together with our industry collaborators for the collection of intrusion alert datasets. For the open-world setting, the student will deploy these algorithms in real SOC environments in order to measure the extent of workload reduction experienced by security analysts. In doing so, we aim to develop technologies that are not only novel but also have real-world applications.
The PhD student will be embedded within the Semantics, Cybersecurity, and Services (SCS) group at University of Twente. The student will have the opportunity to participate in internships and/or collaboration with industry partners under the TUCCR initiative. The SCS group offers a stimulating, supportive, and diverse research environment, as well as plenty of opportunities for personal and professional growth.Your profile
Are you interested in this position? Please send your application before 16 February via the 'Apply now' button below , and include:
For more information regarding this position, you are welcome to contact Azqa Nadeem ([email protected])About the department
Digitalization brings many new opportunities for businesses and governments by fostering the development of innovative online services. However, this development also brings new challenges, notably in terms of intelligence, interoperability, security, and privacy. The mission of the Semantics, Cybersecurity and Services (SCS) group is to advance the development of innovative online services with improved quality through context-alignment and with reduced security and privacy threats.
SCS is part of the Twente University Centre for Cybersecurity Research (TUCCR), a public-private partnership where experts, professionals, entrepreneurs, researchers, and students from industry and knowledge partners collaborate to deliver talents, innovations, and know-how in the domain of cybersecurity. The mission of TUCCR is to strengthen the security and digital sovereignty of our society by performing top-level research on real-world data, systems, and network security challenges. To achieve significant societal impact, TUCCR combines technical, socio-economic, and ethical know- how and is equipped with state-of-the-art infrastructure, ranging from security labs, testbeds, and data lakes. Key outputs include innovation in the form of technologies, tools, minimum viable products, start-ups, top-tier scientific publications, as well as first-class graduates at Bachelor, Master, and PhD level. TUCCR's founding partners are Betaalvereniging Nederland, BetterBe, Cisco, NCSC, NDIX, Northwave, SIDN, SURF, Thales, TNO, and the University of Twente.About the organisation
The faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS) uses mathematics, electronics and computer technology to contribute to the development of Information and Communication Technology (ICT). With ICT present in almost every device and product we use nowadays, we embrace our role as contributors to a broad range of societal activities and as pioneers of tomorrow's digital society. As part of a people-first tech university that aims to shape society, individuals and connections, our faculty works together intensively with industrial partners and researchers in the Netherlands and abroad, and conducts extensive research for external commissioning parties and funders. Our research has a high profile both in the Netherlands and internationally. It has been accommodated in three multidisciplinary UT research institutes: Mesa+ Institute, TechMed Centre and Digital Society Institute.Want to know more? Nadeem, A. (Azqa)
LecturerNadeem, A. (Azqa)
Do you have questions about this vacancy? Then you can contact Azqa for all substantive questions about this position and the application procedure. For general questions about working for the UT, please refer to the chatbot.Contact
Email:[email protected]How to apply Step 1
Apply. When you see a vacancy that appeals to you, you can apply online. We ask you to upload a CV and motivation letter and/or list of publications. You will receive a confirmation of receipt by e-mail.Step 2
Selection. The selection committee will review your application and you will receive a response within 2 weeks after the vacancy has been closed.Step 3
1st interview. The 1st (online or in person) meeting serves as an introduction where we introduce ourselves to you and you to us. You may be asked to give a short presentation. This will be further explained in the invitation.Step 4
2nd interview. In the second interview, we will further discuss the job content, your skills and your talents.Step 5
The offer. If the conversations are positive, you will be made a suitable offer.Your Colleagues
At the UT it's all about people, in line with our university's High Tech Human Touch philosophy. In everything we do, the well-being and future of our students and staff are paramount. From research and teaching to personnel management, campus management and the use of new technologies.
Our university is a public institution that serves society. We are accountable to society for the ways in which we use our academic freedom. We are responsible for ensuring that the power of science and technology is harnessed to achieve the best possible impact in a changing world. We cherish our rich tradition of combining technical and social sciences in our five profiling themes: Improving healthcare by personalized technologies; Creating intelligent manufacturing systems; Shaping our world with smart materials; Engineering our digital society; and Engineering for a resilient world.
We help society meet the challenges of today and tomorrow. But we are also transparent about what science and technology can and cannot do in finding sustainable solutions. And help translate these solutions into everyday life.
We want our communities to flourish and show resilience, so we seize opportunities for innovation. We are knowledgeable and have an eye for what society needs. Our students and staff receive all the guidance they need in their quest for ecological, social and economic sustainability. “The University of Twente is all about people. Our sustainable technologies help to strengthen society.”
Browse all jobs