http://hdl.handle.net/2268.2/6044 Thu, 20 Aug 2026 07:59:33 GMT 2026-08-20T07:59:33Z http://hdl.handle.net/2268.2/26194 Title: Master thesis : FIDOLOGY : A Measurement Study of FIDO2 Adoption Across the Web Abstract: The FIDO2 standard enables passwordless user authentication using security tokens and combines the Web Authentication specification (WebAuthn) with the new Client-to-Authenticator Protocol (Ctap2) protocol. Since its launch in 2018, websites have gradually begun to adopt it, but to date, the real state of adoption of FIDO2 in the wild is not known. This work aims to fill this gap by creating Fidology, a tool that categorizes the authentication mechanisms implemented by websites into five categories, by implementing, in a non-intrusive and deterministic way, an automated pipeline using headless browser and multi-layered signals inference. First applied to a manually crafted groundtruth and then evaluated against a much larger dataset, this tool has shown that classical password-based mechanisms continue to dominate the world of authentication, whilst FIDO2 clues are detected on a small but non-negligible proportion of websites. In addition to this state of FIDO2 deployment, authentication flows are captured to analyse cryptographic challenges and other metrics, with the aim to evaluate the security level of websites previously identified as belonging to the FIDO2-Native category. While most of them meet, and and in some cases even exceed, the expected Fido requirements, critical issues like challenge reuse across sessions are discovered. Sun, 28 Jun 2026 22:00:00 GMT http://hdl.handle.net/2268.2/26194 2026-06-28T22:00:00Z http://hdl.handle.net/2268.2/26116 Title: Master thesis : Firewall polymorphism prototype architecture Abstract: Modern firewall clusters provide redundancy against hardware failure but not against implementation-level attacks: a cluster of N identical instances is no harder to bypass than a single one. This thesis proposes firewall polymorphism, an architecture that addresses availability, throughput, and software diversity simultaneously. The design encloses a set of heterogeneous, unmodified firewall instances inside a demilitarised zone bounded by two purpose-built components: a load balancer on the client side and a controller on the server side. The load balancer duplicates each incoming packet, forwarding a full copy to a hash-selected primary firewall and headers-only copies to all remaining instances. The controller collects the returning copies and implements a unanimity vote: a packet reaches the protected server only when every alive firewall has independently forwarded it. Because the firewalls share no state and may run different software or vendor implementations, an attacker must simultaneously bypass every instance to reach the server. A heartbeat protocol detects firewall failures within a configurable timeout, adjusts the vote threshold dynamically, and reassigns flows to surviving instances without resetting connections. For established flows, an XDP kernel-level fast path bypasses AF_XDP userspace entirely, forwarding packets directly to the server interface via bpf_redirect. The system is implemented using Linux XDP and AF_XDP and evaluated in a containerised topology. Correctness tests confirm that the voting and failover mechanisms behave as specified. Throughput measurements show the pipeline tracks a direct-path baseline closely up to approximately 500Mbit/s, a limit imposed by the single-threaded AF_XDP architecture of the prototype, with negligible overhead at lower rates. Sun, 28 Jun 2026 22:00:00 GMT http://hdl.handle.net/2268.2/26116 2026-06-28T22:00:00Z http://hdl.handle.net/2268.2/25187 Title: Master thesis : SNAC Compliance and Augmentation of the OpenThread Border Router Abstract: The fast expansion of the Internet of Things industry has created the need for a low-power, IPv6-based networking technology specifically designed for battery-powered devices, a solution provided by the Thread protocol. This thesis focuses on OpenThread, the open source implementation of this protocol developed by Google, and more particularly on the analysis and enhancement of the OpenThread Border Router (OTBR), the gateway responsible for connecting the Thread network to other IP networks. This project is divided into four main parts. A dedicated laboratory test environment is deployed for the successful realization of the tasks described below. One of the primary goals of this thesis is to analyze and study the conformity of the implementation of the OTBR with the SNAC draft specification, defined by the IETF which describes how to link a stub network such as a Thread network to a standard Wi-Fi network. As a result, this work confirms the OTBR’s compliance as it successfully supports all core services required by SNAC. Secondly, the project focuses on the development of an IPFIX functionality for the OTBR as an internal additional service. This involves the definition of observation points within the observation domain and the creation of a metering process responsible for measuring flow statistics in the OpenThread core. Simultaneously, an exporting process service is implemented in the OTBR source code to transmit these records to the IPFIX collector as IPFIX messages. As a continuation of the previous objective, this thesis also involves the deployment and configuration of a IPFIX collector tailored specifically for the IPFIX messages send by the OTBR IPFIX exporter module which includes some Thread network specific statistics. The solution relies on pmacct combined with Telegraf for collecting and aggregating the IPFIX messages and ingesting the flow data into a PostgreSQL database configured with the TimescaleDB extension. Furthermore, Grafana is used to visualize and monitor the collected flow information stored in the database. As a result, a complete IPFIX solution is obtained for the OTBR, which allows to perform network troubleshooting, unusual device behavior detection and performance analysis of the Thread network. Finally, the thesis also focuses on the development of an Time Exceeded Detector functionality for the OTBR as an internal additional service. This development work involves the implementation of a simulation mechanism which predicts the path taken by every packet coming from the infrastructure network using topology information obtained in the OTBR via OpenThread mesh diagnostics messages and the Dijkstra’s algorithm. If the hop limit of such a packet is detected to expire before reaching the destination, an ICMPv6 time exceeded message is sent back to the sender of the original packet. As a result, this prevents injecting useless packets into the Thread network and also enables the traceroute functionality in Thread. Thu, 22 Jan 2026 23:00:00 GMT http://hdl.handle.net/2268.2/25187 2026-01-22T23:00:00Z http://hdl.handle.net/2268.2/24935 Title: Introduction to Virtual Machine Introspection for System Monitoring of Legacy Windows Environments Abstract: This master's thesis explores the field of Virtual Machine Introspection (VMI) with two focuses: firstly, to establish a solid understanding of VMI, its principles, and its implementation in existing frameworks. Secondly, to apply this knowledge to extend an existing VMI framework, DRAKVUF, to support legacy Windows systems. The work demonstrates the feasibility and value of extending VMI capabilities to legacy systems. This master's thesis is organized in the following way: Chapter 1 is the introduction, Chapter 2 the objectives and structure of the thesis, Chapter 3 review the technical background needed to understand this work, Chapter 4 presents the virtualized setups used to test the frameworks explored, Chapter 5 introduces VMI for system monitoring, exploring both the broad VMI concept and the technical implementations of VMI by VMI frameworks, Chapter 6 performs an exploratory study of API monitoring with and without VMI, reviewing both traditional API monitoring techniques and frameworks, and a concrete VMI API monitoring, Chapter 7 presents the implementation, testing, and evaluation work made in this thesis (although other chapters also contain practical parts), and finally, Chapter 8 presents the conclusions. Sun, 07 Sep 2025 22:00:00 GMT http://hdl.handle.net/2268.2/24935 2025-09-07T22:00:00Z