PhD topics

Suggested PhD topics in Cyber Security and Privacy.

If you are interested in one of these topics, please read the application guidance first and then contact the named supervisor to discuss.


  1. Human factors of software updating. Updating software is one of the best ways to protect a computer from attack, yet many people choose to not update software. Identify the best practices for automatic updating of software so that users are happy and security patches are installed quickly. Contact: Kami Vaniea

  2. Usable security API design for SSL/TLS. Understand the current usability issues with security APIs such as SSL and TLS. Then design a new API that is easier to use resulting in higher adoption of security practices and a reduction of errors. Contact: Kami Vaniea

  3. Design and analysis of electronic voting protocols. Many countries have or plan to conduct legally binding elections using electronic voting systems. Such systems need to provide security guarantees, e.g., fairness, privacy, and verifiability. These are tricky to establish and can be in conflict with one another. Several proposed electronic voting systems have been found to fail to achieve their intended security goals, demonstrating the need for formally verified electronic voting systems. Contact: Myrto Arapinis

  4. Brain activity as a biometric: Towards more secure and robust authentication mechanisms. We seek to enable the use of human brain activity as a biometric beyond current security platforms. We expect that the use of electroencephalogram (EEG) recordings as a new authentication mechanism will achieve the long-sought advantages of universality, intrinsic liveness detection, continuous identification, and robustness against spoofing attacks. We will focus on developing techniques compatible with affordable consumer-grade EEG devices, rather than the expensive and cumbersome clinical devices. This project is set up as an interdisciplinary collaboration between researchers at Informatics and Engineering. Contact: Javier Escudero

  5. Verification of Security of the mbed OS uVisor (with ARM). The mbed OS uVisor is a core security component for ARM's mbed IoT platform. It creates isolated security domains M7 microcontrollers with a Memory Protection Unit (MPU). On top of these the uVisor provides a flexible compartmentalisation using separate security domains ("Secure Boxes"), configured with ACLs. This project will apply theorem proving methods to help define and then verify correctness and security properties of the uVisor implementation, building on previous work on instruction set models and decompilation techniques. Contact: Ian Stark

  6. Formal Specifications and Proofs for TrustZone (with ARM). Increasing complexity and connectivity in microcontroller devices motivates new protection mechanisms to improve reliability and security. ARM's TrustZone for ARMv8-M provides a separate "secure world" execution mode to enable features such as secure firmware updates, safe integration of code from multiple suppliers and controlled access to privileged peripherals. This project will study the low-level instruction set design of TrustZone for ARMv8-M, devising formal specifications describing the security properties that hold at the instruction level and proofs that these provide the intended protection against low-level attacks. Contact: Ian Stark

  7. Quantum-enhanced Cloud. The security of the cloud could be obtained through Fully Homomorphic Encryption schemes. However these schemes are potentially breakable in a post-quantum regime and require huge overhead and hence despite intensive efforts from all the major players in the information industry, they remain mainly infeasible. The primary goal of this project is to develop quantum enhanced protocols where both efficiency and security are boosted. Implementations of plug and play solutions for these new protocols will be also pursued in realistic scenarios. Contact: Elham Kashefi

  8. Mobile Crowdsensing with Location Privacy. Using sensor data from mobile phones for better understanding of users and fine-grained monitoring of the environment is a major current research topic. From point of view of privacy, the challenge is to infer important features from collective data, without compromising location and other sensitive information of any individual. Contact: Rik Sarkar

  9. Security Applications of Planning and Decision Making in Robotics. Robots are sometimes used in security applications, for example areas such as border patrol scheduling. Robots are often used within teams of other robots and humans: this leads to issues of uncertainty and incomplete information. How can we design intelligence for these applications that cannot be easily predicted or fooled by opponents? Contact: Michael Rovatsos

  10. Security of Blockchain protocols. Study the underpinnings of blockchain based distributed protocols, including the mechanisms behind Bitcoin, Ethereum and other cryptocurrency systems. Contact: Aggelos Kiayias

  11. Privacy in communication systems. Study the concept of privacy in communications and data sharing and design and analyze systems that facilitate it using suitable cryptographic and statistical methods. Contact: Aggelos Kiayias

  12. Applied and Theoretical Cryptography. Study cryptography from both applied and theoretical angles and apply it to solve problems such as secure channels, identification systems, cloud storage, secure digital content distribution and others. Contact: Aggelos Kiayias

  13. Automatic Vulnerability Predicition and Discovery. Software vulnerabilities continue to plague the industry. Tools help find problems, but current technology is limited and deploying patches is largely manual. Future systems will be proactive, searching for possible problems and deploying work-arounds or repairs automatically. Ideas from program synthesis, critics and abstraction-refinement may help here. Contact: David Aspinall

  14. Adaptive Anomaly Discovery by Learning Software Models. This project will combine methods from machine learning and formal verification, to automatically learn precise semantic models of software and devices which describe normal traffic patterns and logging behaviours. Then anomalous, potentially malicious behaviours stand out as being different to these learned behaviours.  The aim is to help manage and automatically configure application-level firewalls. This project is supported by a CASE studentship with British Telecommunications PLC and involves internships at BT Labs Adastral Park. Contact: David Aspinall

  15. Type-Based Security Behaviour Verification for Mobile AppsThis project will investigate the theoretical foundations and practical implementations of a rigorous and efficient type-and-effect system for mobile apps, in particular Android Apps.  Building on results from App Guarden, we want to design practical tools for efficiently statically checking security properties of apps, to ensure that they behave reasonably and do not contain malicious code.  Contact:  David Aspinall or Wei Chen.

  16. User Interfaces for Sensitive Health Data. How can we help users control who can see sensitive information about their health and well-being? This is particularly relevant for people who live with a long-term condition that requires support from formal carers, such as health professionals, and informal carers, such as family and friends, and for people with a stigmatised condition, such as HIV+, schizophrenia, or urinary incontinence. Contact: Maria Wolters

  17. Hardware-assisted Dependable Software Systems.  Design and build systems to improve the safety and security of software systems by leveraging the new ISA extensions available as part of commodity CPUs. More specifically, we are interested to explore the usage of new Intel ISA extensions such as Intel SGX,and Intel MPX to improve the dependability of legacy software systems written in C/C++, including operating systems and file-systems. Contact: Pramod Bhatotia

  18. Secure Remote Authentication via Game Playing. This project investigates a new approach to secure remote authentication which frames the problem as an interactive game between client and server, in which the server has to reason about the complex behaviour of the client based on observed game moves. PhD funding is available for this project. Contact: Stefano Albrecht.

  19. Detecting threats and counteracting network anomalies in home IoT.  Design, prototype on commodity home routers, and evaluate the performance of distributed machine learning tools that can classify anomalous network traffic generated by home automation appliances, personal gadgets, toys, and medical devices; develop mechanisms that automatically thwart complex attacks based on potentially imperfect inferences. The successful candidate must demonstrate good knowledge of computer networks, security, machine learning, and system level (C/C++) programming. Contact: Paul Patras.

  20. Unsupervised mobile network anomaly detection.  Design and develop unsupervised deep neural network models that recognize in real time illicit data traffic in mobile networks, in spite of protocol encryption, no previous knowledge of certain traffic types (zero-day), and growing application diversity. Train, test, and improve the robustness of such tools with open data sets and artificially generated network traffic. Candidates are expected to have good command of applied probability, data analysis, machine learning, network security, data analysis, Python programming, and network simulators. Contact: Paul Patras.

  21. Consensus in a world with quantum technologies.  The goal is to explore consensus protocols, such as Blockchain and Byzantine Agreement, in the presence of quantum technologies. Quantum technologies can be used either by adversaries in order to break existing classical protocols, or by honest parties to achieve better performance as far as efficiency or level of security provided.  In this project both directions will be considered. In the first direction (quantum adversaries) full security analysis of classical consensus protocols against quantum adversaries will be carried out, including: (i) ensuring that for all subroutines if hard problems are used to guarantee security, then these problems remain hard when the adversary has a quantum computer (e.g. base security on lattice crypto), (ii) the security definitions and the proof techniques are compatible with quantum adversaries. As far as the second direction is concerned, it is known that (simple) quantum technologies can be used to achieve enhanced Byzantine Agreement protocols.  The investigation will take into account (i) realistic constraints and (ii) proper security analysis that includes hybrid quantum-classical subroutines by addressing the issue of composability of quantum and classical protocols.  Contact: Petros Wallden or Elham Kashefi.