PhD students I supervise or have supervised in the Threat Analysis group. Their papers are also listed on the publications page.
Ongoing
Leon Kersten
Leon works on how Tier 1 analysts in a Security Operations Center investigate alerts, and on how to support them. He developed a structured threat analysis process for Tier 1 investigations, a tool that helps analysts contextualise and understand network security events, and a field study of the alert investigation process. He also contributed to a test tool for the skills of Tier 1 analysts and to T1GER, a re-designed cyber range exercise for training SOC analysts. Earlier, he studied how the believability of phishing emails affects phishing reporting.
Selected papers:
- T1GER: An Instructional Re-Design of a Cyber Range Exercise in a Commercial Security Operations Center. CHI 2026. Publisher Code
- A Field Study to Uncover and a Tool to Support the Alert Investigation Process of Tier-1 Analysts. USEC 2025.
- A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operations. Workshop on Security Operation Center Operations and Construction 2025.
- A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events. ACSAC 2024. PDF
- ‘Give Me Structure’: Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Center. USENIX SOUPS 2023. PDF
- Investigating the Effect of Phishing Believability on Phishing Reporting. IEEE EuroS&PW 2022. Publisher
Koen Teuwen
Koen works on the engineering of network intrusion detection rules for Security Operations Centers. He studied why some rules generate excessive noise and derived design principles for low-noise rules, built SuriCap, a platform to measure and evaluate how rules are engineered, studied how detection engineers write rules in practice, and looked at how ruleset tuning and data imbalance affect explainable alert classification. He also develops suricata-check, an open-source tool to assess the design of Suricata rules.
Selected papers:
- How It’s Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules. WTMC 2026. Publisher Preprint
- Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers. ASIA CCS 2025. Publisher Code
- POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering. ASIA CCS 2025.
- On the Effect of Ruleset Tuning and Data Imbalance on Explainable Network Security Alert Classifications: a Case-Study on DeepCASE. IEEE EuroS&PW 2025.
Roy Ricaldi
Roy studies how cybercriminal communities organise and change over time, with a focus on Telegram. His work covers the trust signals that support the cybercrime economy on Telegram, TeleHunt, a framework and tool to find cybercriminal communities on Telegram, the topics discussed on the dark web over time, and how criminals decide to move between platforms. He also works on an experimental design to observe attacker actions on an access-as-a-service platform.
Selected papers:
- TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram. ARES 2026. Preprint Code
- Topical Shifts in the Dark Web: A Longitudinal Analysis of Content from the Cybercrime Ecosystem. IEEE EuroS&PW 2026.
- Uncovering the Trust Signals Supporting Telegram’s Cybercrime Economy. APWG eCrime 2025. Publisher
- An Experimental Design to Investigate Attacker Actions on an Access-as-a-Service ‘Criminal’ Platform. IEEE EuroS&PW 2025.
- Where is Dmitry going? Framing ‘migratory’ decisions in the criminal underground. arXiv preprint 2024. Preprint PDF
Matteo Asuni
Matteo works on the risks of agentic AI.
Susanne Wulz
Susanne works on the automation of cyber threat intelligence, within the INTERSCT project.
Graduated
Michele Campobasso
Thesis: Understanding and Characterizing the Cybercriminal Ecosystem Enabling Attack Innovation at Scale.
Michele studied the criminal markets that trade new attack tools and services. He characterised Impersonation-as-a-Service, a criminal infrastructure for impersonating Internet users at scale, and measured which user profiles attackers buy on such a market. He developed a framework to infer which underground communities are relevant to the threat landscape, and crawlers to collect data from underground forums (CARONTE and THREAT/crawl).
Selected papers:
- Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. USENIX Security 2023. Preprint
- You can tell a cybercriminal by the company they keep: A framework to infer the relevance of underground communities to the threat landscape. WEIS 2023. Preprint
- THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums. APWG eCrime 2022. Preprint
- A primer on the proliferation of offensive cyber capabilities. Atlantic Council 2021. Report
- Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale. ACM CCS 2020. Preprint
- SAIBERSOC: Synthetic Attack Injection to Benchmark and Evaluate the Performance of Security Operation Centers. ACSAC 2020, Distinguished Paper with Artifacts Award. Preprint
- CARONTE: Crawling Adversarial Resources Over Non-Trusted, High-Profile Environments. IEEE EuroS&P WACCO 2019. Preprint
Pavlo Burda
Thesis: Let the weakest link fail, but gracefully: understanding tailored phishing and measures against it.
Pavlo studied tailored phishing: how attackers use information about their targets, and how organisations can defend against it. His work includes a field experiment with tailored phishing techniques in industry and academia, a case study of tailored phishing against a small IT company, a systematic review of cognition in social engineering research, and studies of why employees report phishing emails.
Selected papers:
- Phishing reporting in organizations: What motivates employees to take action? Information & Computer Security 2026.
- Cognition in social engineering empirical research: a systematic literature review. ACM Transactions on Computer-Human Interaction 2024. PDF
- ‘Protect and Fight Back’: A Case Study on User Motivations to Report Phishing Emails. EuroUSEC 2024. PDF
- The (Relative) Impact of Email Cues on the Perceived Threat of Phishing Attacks: A User Perspective on Phishing Deceptiveness. IEEE EuroS&PW 2024. Publisher
- The Peculiar Case of Tailored Phishing against SMEs: Detection and Collective Defense Mechanisms at a Small IT Company. IEEE EuroS&PW 2023. Publisher
- Dissecting Social Engineering Attacks Through the Lenses of Cognition. IEEE EuroS&P WACCO 2021. Preprint
- Don’t Forget the Human: a Crowdsourced Approach to Automate Response and Containment Against Spear Phishing Attacks. IEEE EuroS&P WACCO 2020. Publisher
- Testing the effectiveness of tailored phishing techniques in industry and academia: a field experiment. ARES 2020. Preprint