Thesis Proposals
This page outlines the rules that MUST be followed to successfully complete your thesis with us. Failure to comply may jeopardize your thesis progress.
Thesis Request
The only official way to request a thesis is by sending an email to the research group mailing list: netsecresearch [at] live.unibo.it. Requests made in person or sent to individual group members will NOT be considered.
You may only request a thesis if you are up to date with your exams or have no more than two remaining.
Your thesis request email must include the following information:
- Whether it is a Bachelor’s or Master’s thesis;
- The number of CFUs;
- The number of remaining exams;
- Your expected graduation date;
- The desired topic (e.g., P4).
Once your request is accepted, you will be assigned a repository on our Git forge containing a template. You are required to complete it according to the instructions provided in the README.
Rules for Thesis Work
Biweekly Progress Updates
All thesis students are required to provide updates every two weeks on their progress by sending an email to the research group mailing list (netsecresearch [at] live.unibo.it). These updates are essential to keep the entire team informed of your current status and ongoing work.
Your email should include any developments related to your thesis or, if applicable, a brief explanation of your current academic activities (e.g., exam preparation).
Important: If you fail to submit three consecutive biweekly updates (i.e., over a six-week period), your thesis title will be considered abandoned and may be reassigned to another student.
Deadlines
It is YOUR RESPONSIBILITY to keep track of all deadlines, including title submission, thesis upload, and others.
Thesis Writing Guidelines
To ensure consistency and quality, you should follow our official Thesis Writing Guidelines.
Note on Compilative Theses
Compilative theses are intended to require minimal effort from both the student and the supervisor. You are expected to take full responsibility for developing your thesis independently. We will only review and provide feedback on the final draft. However, all MANDATORY RULES still apply, including sending regular biweekly updates.
The maximum recommended length is approximately 10,000 words, excluding the title page, abstract, table of contents, and bibliography.
For UniBo students: if you choose a compilative thesis, you should expect to receive (0 + rounding) additional points.
Note on Theses with Internship
Please read carefully the instructions provided on the course page. To complete the self-application procedure, you will need the following information (in Italian):
- Tutor: Prof. Marco Prandini
- Indirizzo sede di svolgimento tirocinio: Viale del Risorgimento 2, Bologna (BO), Italia.
- Laboratorio/Ufficio: Ulisse Lab
- Data inizio/fine tirocinio: You are free to decide but the internship end date should be at least two weeks prior to the internship final assessment/exam.
- Orario: 8:00 - 18:00.
- Oggetto dell’offerta: Title of the internship project.
- Obiettivi in termini di capacità e conoscenze da acquisire durante il tirocinio ed attività previste per raggiungerli: Simple abstract of the internship project.
- Attività previste: List all the activities you foresee carrying out.
You MUST register (verbalizzare) the internship before the graduation requirements deadline.
Available Theses
P4 - Network Security
| Type | Description | References |
|---|---|---|
| Research | Extension of P4ICS to Linux hosts using TC/eBPF for Modbus/TCP. The student will extend the existing Kathará-based P4ICS testbed with a Linux endpoint that processes Modbus/TCP traffic through eBPF programs attached to the Traffic Control ingress and egress hooks. The implementation will protect outgoing packets through AES encryption and HMAC generation, and will verify and decrypt incoming P4ICS-protected packets before delivering them to unmodified Modbus applications. The work will also address packet resizing, IP and TCP checksum updates, and the rejection of packets with invalid authentication tags. The prototype will be evaluated in terms of correctness, latency, CPU usage, and packet loss. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Extension of P4ICS to Linux hosts using XDP and AF_XDP for Modbus/TCP. The student will extend the existing Kathará-based P4ICS testbed with an XDP program that redirects Modbus/TCP packets to an AF_XDP userspace cryptographic engine. The engine will perform AES encryption and decryption, HMAC generation and verification, packet reconstruction, and transparent reinjection towards the network or the local Modbus application. The prototype will be evaluated in terms of correctness, latency, throughput, CPU usage, packet loss, and rejection of tampered packets. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Capability-aware switch-side and host-side termination for P4ICS. The student will extend the P4ICS data plane and controller so that each protected flow can be terminated either by the destination P4 switch or by an eBPF-enabled Linux endpoint. The implementation will introduce endpoint capability information, P4 table entries selecting the appropriate termination mode, and a mixed Kathará topology containing both legacy devices and host-capable endpoints. The work will validate transparent communication in both modes and measure the cost of switching between them. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Design and implementation of a common switch-to-host packet format for P4ICS. The student will define an explicit encapsulation format for communication between P4 switches and eBPF-enabled hosts. The format will include the metadata required for cryptographic processing, such as version, flags, key identifier, security epoch, sequence number, original payload length, encrypted payload, and authentication tag. The format will be implemented in the P4 parser and deparser and in a minimal Linux-side parser. The evaluation will consider parsing correctness, malformed-packet handling, byte overhead, and MTU impact. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Controller-based key provisioning for P4ICS-enabled Linux hosts. The student will implement a lightweight host agent that receives cryptographic configuration from the P4ICS controller and installs it in BPF maps or in the configuration of an AF_XDP cryptographic engine. The prototype will support key identifiers, security epochs, atomic key replacement, and explicit deletion of expired keys. The activity will focus on symmetric keys and a single Linux endpoint and will be validated using the existing Kathará testbed. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Hitless key rotation across P4 switches and eBPF-enabled endpoints. The student will design and implement a key-rotation procedure in which P4 switches and Linux endpoints temporarily accept both the current and the next security epoch. The implementation will cover installation of the new key, activation at the sender, a configurable overlap period, and removal of the previous key. The evaluation will measure packet loss, invalid authentication events, rotation latency, and behavior under delayed or partially completed updates. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Transport-independent replay protection for P4ICS. The student will extend the P4ICS packet format with an explicit per-security-association sequence number and implement replay detection on a P4 switch and on an eBPF-enabled Linux host. The prototype will maintain a bounded replay window, reject duplicated packets, tolerate limited packet reordering, and reset state when a new key epoch is activated. The implementation will be evaluated using controlled duplication, loss, reordering, and sequence-number manipulation experiments. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Extension of P4ICS host-side protection to EtherNet/IP implicit messaging over UDP. The student will adapt one of the existing host-side cryptographic datapaths to cyclic EtherNet/IP traffic and integrate it with the transport-independent replay-protection mechanism. The work will address packet loss, limited reordering, duplicate detection, sequence-number management, and transparent communication with unmodified EtherNet/IP applications. The evaluation will focus on latency, jitter, deadline violations, CPU usage, and packet loss. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Secure failure recovery for hybrid P4ICS deployments. The student will implement failure detection and recovery for eBPF-enabled P4ICS endpoints. The system will detect unavailable host agents, unloaded eBPF programs, inactive AF_XDP processes, or expired cryptographic state. According to a configurable policy, the P4 switch will either block the affected flow or temporarily revert to switch-side termination. The evaluation will measure detection time, recovery time, packet loss, and plaintext exposure during controlled host-side failures. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Development of a reproducible benchmark for hybrid P4 and eBPF protection of industrial communications. The student will extend the existing P4ICS Kathará environment with a common experimental harness for comparing plaintext communication, switch-to-switch P4ICS, TC/eBPF host protection, and XDP/AF_XDP host protection. The benchmark will automate experiment execution, repetition, traffic capture, and result collection. It will report latency distributions, jitter, throughput, packet loss, CPU usage, memory consumption, and cryptographic failure events using a common workload and configuration. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Comparative evaluation of P4ICS, TLS, IPsec, and WireGuard for Modbus/TCP communications. The student will integrate selected secure-channel alternatives into the existing Kathará testbed and compare them with the original switch-to-switch P4ICS architecture and the new host-side P4ICS implementations. The comparison will consider latency, jitter, throughput, CPU and memory usage, packet overhead, application transparency, plaintext exposure, deployment complexity, and compatibility with legacy endpoints. The work will use the same Modbus workload and experimental methodology for all configurations. | P4ICS Paper , P4ICS GitHub Repository |
| Research | Analysis of the paper "A Robust Counting Sketch for Data Plane Intrusion Detection". If feasible, re-implement part of the work in a simple P4 PoC. | NDSS Paper page |
5G Time Series Analysis
| Type | Description | References |
|---|---|---|
| Research | Analysis of the hctsa framework for highly comparative time series analysis, extraction of large feature spaces from 5G traffic time series, and study of their usefulness for profiling and anomaly detection. | hctsa Paper, hctsa GitHub |
| Research | In-depth study of the paper “Time Series Anomaly Detection using Diffusion-based Models” and implementation of its diffusion-based pipelines to detect anomalies in multivariate 5G traffic time series. | Diffusion-based AD Paper, DiffusionAE GitHub |
| Research | Analysis of the paper “NHITS: Neural Hierarchical Interpolation for Time Series Forecasting” and experimental evaluation of NHITS for long-horizon forecasting on 5G traffic and connection load time series. | NHITS Paper, NHITS GitHub |
| Research | Study of the TFB benchmark “Towards Comprehensive and Fair Benchmarking of Time Series Forecasting Methods” and use of its framework to compare classical and deep models on 5G forecasting tasks. | TFB Paper, TFB GitHub |
| Research | Study of the TAB benchmark “Unified Benchmarking of Time Series Anomaly Detection Methods” and use of its framework to test models on 5G anomaly detection tasks. | TAB Paper, TAB GitHub |
| Research | Analysis of the paper “LightGTS: A Lightweight General Time Series Forecasting Model” and evaluation of this lightweight foundation model on 5G traffic time series under zero-shot and fine-tuned settings. | LightGTS Paper, LightGTS GitHub |
INDUSTRIAL SECURITY
| Type | Description | References |
|---|---|---|
| Compilative | Analysis and description of the New Machinery Regulation (“Nuovo Regolamento Macchine”), Italian legislation relating to safety in an industrial environment. | Regulation |
| Research | Analysis of the tool "Joern - The Bug Hunter's Workbench" for the creation of code property graphs (CPGs). Then, apply CPGs to the static analysis of binary PLC programs. | Joern Github |
| Research | Analysis of the tool "Triton", a dynamic binary analysis library for dynamic symbolic execution. Then, apply Triton to the dynamic analysis of binary PLC programs. | Triton Github |
| Research | Analysis of the paper "IFFSET: In-Field Fuzzing of Industrial Control Systems using System Emulation" and execution of fuzzing tests over the firmware image from a WAGO PLC. | Paper, Github repo |
| Research | Analysis of the paper "From Standard to Practice: Towards ISA/IEC 62443-Conform Public Key Infrastructures" and implementation of the proposed guidelines in OPC UA. | Article |
| Research | Analysis of the paper "Black Flag Breach: ROP Attacks on Software PLCs", analysis of the code in the repository, and execution of some simple tests involving the Modbus protocol. | Paper, Github |
| Research | Analysis of the paper "Towards PLC-Specific Binary Analysis Tools: An Investigation of Codesys-Compiled PLC Software Applications". Based on what it is described on the paper, then try to reverse engineer some binaries using the ICSREF tool. | Paper, ICSREF github |
| Research | Analysis of the paper "ICSPatch: Automated Vulnerability Localization and Non-Intrusive Hotpatching in Industrial Control Systems using Data Dependence Graphs", analysis of the code in the repository, and execution of some simple tests. | ICSPatch Paper, Github repo |
| Research | Integration of the Modelica OPC UA Tool developed by Wolfram with an OPC UA testbed for Industrial Control Simulation and Hardware in the loop. | Tool, Testbed |
| Research | Experiments with the Industrial Control Systems Modelica Library for ICS real-time simulation. | Library |
INDUSTRIAL SECURITY x AI
| Type | Description | References |
|---|---|---|
| Research | Reconstruction-based Anomaly Detection for Industrial Control Systems. This thesis aims to implement a deep learning anomaly detector for industrial control systems. | Paper |
| Research | Explainable Anomaly Detection for Industrial Control Systems. This thesis aims to analyze and implement XAI methods for anomaly detection in industrial control systems. | Paper |
| Research | Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems. This thesis aims to analyze and implement adversarial attacks to Reconstruction-based Anomaly Detection for Industrial Control Systems. | Paper |
| Research | Adversarial purification based on Diffusion Models in Industrial Control Systems. This thesis aims to analyze and implement adversarial purification defenses based on Diffusion Models for Reconstruction-based Anomaly Detectors in Industrial Control Systems. | Paper |
| Research | Benchmarking LLM Time Series Foundation Models for Anomaly Detection in Industrial Control Systems. This thesis aims to analyze, implement and benchmark Anomaly Detectors in Industrial Control Systems based on LLM Time Series Foundation Models. | Chronos Paper, OpenTSLM |
| Research | Continual Learning for Anomaly Detection in Industrial Control Systems. This thesis aims to explore continual fine-tuning techniques for LLM Time Series Foundation Models targeted at Anomaly Detection. | Paper |
SECURITY OF UNMANNED UNDERWATER AUTONOMOUS VEHICLES
| Type | Description | References |
|---|---|---|
| Research | Instantiate an UNMANNED UNDERWATER AUTONOMOUS VEHICLES simulator that it is able to perform easy task. In the literature there are several open source projects, the most promising one is DAVE Project Link. Goal of this thesis is to deploy a version of a simulator. | Other reference |