publications

2026

1. 

   LOTL-hunter: Detecting multi-stage living-off-the-land attacks in cyber-physical systems using decision fusion techniques with digital twins

   Carol Lo, Thu Yein Win, Zeinab Rezaeifar, Zaheer Khan, and Phil Legg

   Future Generation Computer Systems, 2026

   Abs DOI HTML

   The integration of smart sensors and actuators in industrial environments has expanded the cyber-physical attack surface, making it increasingly difficult to distinguish anomalies caused by cyberattacks from those due to mechanical or electrical faults. This challenge is exacerbated by stealthy, multi-stage attacks leveraging Living off the Land (LOTL) techniques, which often evade conventional anomaly detection or intrusion detection systems (IDS). This study presents a Digital Twin-based testbed for safe, repeatable simulation of multi-stage cyber-physical attacks targeting Cyber-Physical Systems (CPS) and Industrial Control Systems (ICS). We propose a two-level decision fusion method that aggregates and aligns anomalies across network, process, and host domains in synchronized 1-minute intervals. The first-level fusion improves OT-layer detection by applying confidence-aware decision logic to outputs combined from (a) a supervised deep learning model (LSTM-FCN) for process anomalies, (b) an unsupervised model (Isolation Forest) for OPC UA network anomalies, and (c) process alarm signals. The second-level fusion integrates these results with host-based anomalies, computed through point-based scoring of Wazuh alerts, to provide comprehensive IT/OT situational awareness. Experimental results demonstrate improved detection of stealthy, multi-stage APT attack behaviours. Additionally, Large Language Models (LLM) provide summarization of the integrated IT/OT anomaly logs into human-readable insights, enhancing interpretability and supporting cyber threat hunting.

2. 

   Advances in Teaching and Learning for Cyber Security Education

   Phil Legg, Natalie Coull, Charles Clarke, Harjinder Lallie, and Hany Atlam

   2026

   Abs DOI HTML

   This book provides reflection and account of innovative practice for how we approach teaching and learning for cyber security education. Cyber security continues to play a crucial role in our modern society, with a need to secure supply chain attacks and critical infrastructure. How we therefore educate in this area and how we encourage new ways of thinking and new ways of addressing these challenges require a community effort across academia, industry, and government to continually reflect and enhance our practice. The variety of works in this book includes the development of cyber escape rooms, gamification approaches for cyber security education, and AI-based learning platforms. The topics span across how we rethink of the insider threat in the age of AI, how social media interplays with cyber security education, and how we teach geopolitical aspects of cyber security. As a rapidly growing area of education, there are many fascinating examples of innovative teaching and assessment taking place; however, as a community we can do more to share best practice and enhance collaboration across the education sector. CSE Connect is a UK-based community group that promotes sharing and collaboration in cyber security education so that we can upskill and innovate the community together both nationally and internationally. The chapters of this book were presented at the 5th Annual Advances in Teaching and Learning for Cyber Security Education conference, hosted by CSE Connect at the University of Warwick, UK, on July 22, 2025. The book is of interest to educators, students, and practitioners in cyber security, both for those looking to upskill in cyber security education, as well as those aspiring to work within the cyber security sector.

2025

1. 

   An Explainable Ensemble-based Intrusion Detection System for Software-Defined Vehicle Ad-hoc Networks

   Shakil Ibne Ahsan, Phil Legg, and S M Iftekharul Alam

   Cyber Security and Applications, 2025

   Abs DOI HTML

   Intrusion Detection Systems (IDS) are widely employed to detect and mitigate external network security events. Vehicle ad-hoc Networks (VANETs) continue to evolve, especially with developments related to Connected Autonomous Vehicles (CAVs). In this study, we explore the detection of cyber threats in vehicle networks through ensemble-based machine learning, to strengthen the performance of the learnt model compared to relying on a single model. We propose a model that uses Random Forest and CatBoost as our main ’investigators’, with Logistic Regression used to then reason on their outputs to make a final decision. To further aid analysis, we use SHAP (SHapley Additive exPlanations) analysis to examine feature importance towards the final decision stage. We use the Vehicular Reference Misbehavior (VeReMi) dataset for our experimentation and observe that our approach improves classification accuracy, and results in fewer misclassifications compared to previous works. Overall, this layered approach to decision-making - combining teamwork among models with an explainable view of why they act as they do - can help to achieve a more reliable and easy-to-understand cyber security solution for smart transportation networks.

2. 

   Leveraging activation and optimisation layers as dynamic strategies in the multi-task fuzzing scheme

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and Jun Hong

   Computer Standards & Interfaces, 2025

   Abs DOI HTML

   Fuzzing is a common technique for identifying vulnerabilities in software. Recent approaches, like She et al.’s Multi-Task Fuzzing (MTFuzz), use neural networks to improve fuzzing efficiency. However, key elements like network architecture and hyperparameter tuning are still not well-explored. Factors like activation layers, optimisation function design, and vanishing gradient strategies can significantly impact fuzzing results by improving test case selection. This paper delves into these aspects to improve neural network-driven fuzz testing. We focus on three key neural network parameters to improve fuzz testing: the Leaky Rectified Linear Unit (LReLU) activation, Nesterov-accelerated Adaptive Moment Estimation (Nadam) optimisation, and sensitivity analysis. LReLU adds non-linearity, aiding feature extraction, while Nadam helps to improve weight updates by considering both current and future gradient directions. Sensitivity analysis optimises layer selection for gradient calculation, enhancing fuzzing efficiency. Based on these insights, we propose LMTFuzz, a novel fuzzing scheme optimised for these Machine Learning (ML) strategies. We explore the individual and combined effects of LReLU, Nadam, and sensitivity analysis, as well as their hybrid configurations, across six different software targets. Experimental results demonstrate that LReLU, individually or when paired with sensitivity analysis, significantly enhances fuzz testing performance. However, when combined with Nadam, LReLU shows improvement on some targets, though less pronounced than its combination with sensitivity analysis. This combination improves accuracy, reduces loss, and increases edge coverage, with improvements of up to 23.8%. Furthermore, it leads to a significant increase in unique bug detection, with some targets detecting up to 2.66 times more bugs than baseline methods.

3. 

   TRIST: Towards a Container-Based ICS Testbed for Cyber Threat Simulation and Anomaly Detection

   C. Lo, J. Christie, T.Y. Win, Z. Rezaeifar, Z. Khan, and P Legg

   In Proceedings of the International Conference on Cybersecurity, Situational Awareness and Social Media (Cyber Science 2024), 2025

   Abs DOI HTML

   Cyber-attacks on Industrial Control Systems (ICS), as exemplified by the incidents at the Maroochy water treatment plant and the Ukraine’s electric power grid, have demonstrated that cyber threats can inflict significant physical impacts. These incidents caused widespread service disruptions and substantial economic losses, underscoring the urgent need for an in-depth understanding of cyber threats in industrial environments. Industrial security research is usually conducted on physical testbeds to avoid safety issues, production interruptions and other operational constraints in industrial processes. Nevertheless, security defenders often encounter obstacles in developing or accessing physical testbeds due to associated costs and complexities. These factors hinder research progress to devise early detection mechanisms for cyber threats—essential for effective incident response. To overcome these obstacles, this paper presents a container-based virtual testbed. Its lightweight architecture enables replicable and efficient deployment of testbeds at low cost for simulating cyber threats on Cyber-Physical Systems (CPS)—the cornerstone of industrial automation and control systems. Also, the container-based virtual testbed provides a cost-effective option for producing datasets for training, testing and optimization of unsupervised anomaly detection models. Besides, an evaluation on resource consumption is conducted. The paper also discusses the benefits and limitations of proposed container-based ICS testbeds and suggests future research areas.

4. 

   Machine Learning and Data Analytics for Cyber Security

   Phil Legg and Giorgio Giacinto

   2025

   Abs HTML

   The aim of this reprint is to provide an overview of the current challenges within the cyber security community today, as recognized by our contributors. This reprint provides 16 papers from the Topical Collection on “Machine Learning and Data Analytics for Cyber Security” that cover topics of large language models for cybersecurity claim classification, adversarial machine learning attacks against intrusion detection systems, the detection of PLC process control anomalies, identifying session-replay bots compared to human users, and mitigating against side-channel attacks.

5. gh0stEdit: Exploiting Layer-Based Access Vulnerability Within Docker Container Images

   Alan Mills, Jonathan White, and Phil Legg

   arXiv, 2025

   Abs HTML PDF

   Containerisation is a popular deployment process for application-level virtualisation using a layer-based approach. Docker is a leading provider of containerisation, and through the Docker Hub, users can supply Docker images for sharing and repurposing popular software application containers. Using a combination of in-built inspection commands, publicly displayed image layer content, and static image scanning, Docker images are designed to ensure end users can clearly assess the content of the image before running them. In this paper we present gh0stEdit , a vulnerability that fundamentally undermines the integrity of Docker images and subverts the assumed trust and transparency they utilise. The use of gh0stEdit allows an attacker to maliciously edit Docker images, in a way that is not shown within the image history, hierarchy or commands. This attack can also be carried out against signed images (Docker Content Trust) without invalidating the image signature. We present two use case studies for this vulnerability, and showcase how gh0stEdit is able to poison an image in a way that is not picked up through static or dynamic scanning tools. Our attack case studies highlight the issues in the current approach to Docker image security and trust, and expose an attack method which could potentially be exploited in the wild without being detected. To the best of our knowledge we are the first to provide detailed discussion on the exploit of this vulnerability.

6. Examining the Role of Online Communities in the Prevention of Child Sexual Abuse

   Nick Addis, Ella Rees, Ian Johnson, Phil Legg, and Maggie Brennan

   2025

   Abs HTML

   2024 witnessed the highest levels of online child sexual abuse material ever observed since records began, with the Internet Watch Foundation (IWF) identifying 291,273 webpages containing child sexual abuse imagery, links to imagery, or the advertising of this (IWF, 2025), facilitated through online communities accessible via the surface web (i.e. social media platforms, and online gaming communities). The sheer scale and harms caused by these crimes have led to calls for this to be viewed as a global public health issue, in need of an immediate and coordinated response. However, research into the nature of such online communities is largely limited in scope, with focus predominantly targeting potential perpetrators and their access to online communities (rather than the safeguarding activities of specific online platforms). This chapter seeks to bridge this gap, presenting work exploring the role played by online communities (i.e. through social media and gaming platforms) in preventing online child sexual abuse. Specifically, the chapter examines current practices utilised by such platforms (as well as challenges faced) in the fight against online child sexual abuse. This includes the impact of the ever-growing use of generative AI, as well as the need to hold technology companies to account for content hosted on their platforms, particularly considering the recently implemented Online Safety Act 2023.

7. 

   Jailbreaking LLMs Through Tense Manipulation in Multi-Turn Dialogues

   Michael Tchuindjang, Nathan Duran, Phil Legg, and Faiza Medjek

   In Advances in Computational Intelligence Systems: Contributions Presented at the 24th UK Workshop on Computational Intelligence, September 3-5, 2025, Edinburgh, UK, 2025

   Abs HTML

   Large Language Models (LLMs) have demonstrated great potential across many domains, however their susceptibility to jailbreak attacks presents opportunities for malicious actors. These attacks manipulate LLMs to divulge sensitive information or generate harmful content, that could further be utilised in nefarious ways, including as part of cyber-enabled crime, hence presenting a crucial cyber security challenge for the safe and secure interaction of AI-enabled systems. Previous studies highlight the security challenges posed by multi-turn interactions, in which attackers strategically conceal their malicious intent through extended conversations. However, the influence of tense variations on the efficacy of such attacks has received limited attention. This study addresses this gap by systematically examining the role of tense manipulation in multi-turn jailbreak attacks on LLMs. We introduce a novel multi-turn jailbreak attack that specifically exploits past tense reformulation, along with a multi-turn dialogue dataset designed for cyber-related attacks. Experiments conducted on both open-source LLMs (Llama 2-7B, Qwen 2-7B) and closed-source LLMs (GPT-4o-mini, Gemini 2-flash) demonstrate that past tense reformulation significantly enhances attack performance, yielding an average increase of 25.30% with larger effect on closed-source models. These findings highlight the urgent need to strengthen LLM defence strategies against tense variations in multi-turn dialogues. The dataset and jailbreak artefacts are available at: https://github.com/Micdejc/llm_multiturn_attacks

8. 

   Federated Learning with Adversarial Optimisation for Secure and Efficient 5G Edge Computing Networks

   Saniya Zafar, Jonathan White, and Phil Legg

   Big Data and Cognitive Computing, 2025

   Abs DOI HTML

   With the evolution of 5G edge computing networks, privacy-aware applications are gaining significant attention due to their decentralised processing capabilities. However, these networks face substantial challenges to ensure privacy and security, specifically in a Federated Learning (FL) setup, where adversarial attacks can potentially influence the model integrity. Conventional privacy-preserving FL mechanisms are often susceptible to such attacks, leading to degraded model performance and severe security vulnerabilities. To address this issue, we propose FL with adversarial optimisation framework to improve adversarial robustness in 5G edge computing networks while ensuring privacy preservation. The proposed framework considers two models; a classifier model and an adversary model, where the classifier model is integrated with the adversary model, trained jointly considering Fast Gradient Sign Method (FGSM) for generation of adversarial perturbations. This adversarial optimisation enhances classifier’s resilience to attacks, thereby improving both privacy preservation and model accuracy. Experimental analysis reveals that the proposed model achieves up to 99.44% accuracy on adversarial test data, while improving robustness and sustaining high precision and recall across varying client scenarios. The experimental results further ensure the effectiveness of the proposed model in terms of communication efficiency and computational efficiency while reducing inference time and FLOPs making it ideal for secure 5G edge computing applications.

2024

1. Cyber Security Unplugged: Teaching Security Management Through Immersive Gameplay

   Alan Mills, Ian Caple, Phil Legg, Sophie Fenn, and Aida Abzhaparova

   In Advances in Teaching and Learning for Cyber Security Education, 2024

   Abs HTML

   Cyber security education and the online safety of young people is key on the government agenda. A variety of initiatives are designed to raise awareness about the threats and safeguards related to children and their use of technology. Furthermore, cyber security incidents are frequently impacting young people by directly disrupting the services they rely on, from schools to social media. As a result of a vast array of national, regional and local government funded programmes, young people are becoming increasingly aware of the importance of cyber security, both as an a societal need but also as a potential career path. However, what remains is still a gap between the need for cyber education and the diverse range of careers in this field. This chapter presents an innovative pedagogic and gamified experience for teaching fundamental security management concepts, that differs from typical learning environments that focus on technical skills. The game was co-developed with school teachers and designed for teachers and educators to use in a variety of settings, such as schools, HE, and business. This game has been successful in demystifying the field of cyber security for new players, explaining the entry points into the field, and demonstrating the wide-range of skills and behaviours required to pursue careers in cyber security. By drawing from the successful application of this game, the chapter highlights the importance of using immersive, offline, and non-technical (“unplugged”) pedagogies. Furthermore, it demonstrates how educators can explain the complexities of cyber security and entice young people to further explore a multitude of roles and careers in this field.

2. 

   Advances in Teaching and Learning for Cyber Security Education

   Phil Legg, Natalie Coull, and Charles Clarke

   2024

   Abs DOI HTML

   This book showcases latest trends and innovations for how we teach and approach cyber security education. Cyber security underpins the technological advances of the 21st century and is a fundamental requirement in today’s society. Therefore, how we teach and educate on topics of cyber security and how we overcome challenges in this space require a collective effort between academia, industry and government. The variety of works in this book include AI and LLMs for cyber security, digital forensics and how teaching cases can be generated at scale, events and initiatives to inspire the younger generations to pursue cyber pathways, assessment methods that provoke and develop adversarial cyber security mindsets and innovative approaches for teaching cyber management concepts. As a rapidly growing area of education, there are many fascinating examples of innovative teaching and assessment taking place; however, as a community we can do more to share best practice and enhance collaboration across the education sector. CSE Connect is a community group that aims to promote sharing and collaboration in cyber security education so that we can upskill and innovate the community together. The chapters of this book were presented at the 4th Annual Advances in Teaching and Learning for Cyber Security Education conference, hosted by CSE Connect at the University of the West of England, Bristol, the UK, on July 2, 2024. The book is of interest to educators, students and practitioners in cyber security, both for those looking to upskill in cyber security education, as well as those aspiring to work within the cyber security sector.

3. 

   Privacy-Based Triage of Suspicious Activity Reports Using Offline Large Language Models

   Phil Legg, Nicholas Ryder, Samantha Bourton, Diana Johnson, and Reuben Walker

   In Advancements in Cyber Crime Investigations and Modern Data Analytics, 2024

   Abs HTML

   Suspicious Activity Reports (SAR) form a vital part of incident response and case management for the investigation of known or suspected money laundering. However, those submitting SARs, and those tasked with analysing SARs, often find the task overwhelming due to the complexity of reporting, the incompleteness of information available, and the ability to classify reports effectively for further processing. We explore the use of Natural Language Processing to facilitate this process. Specifically, we utilise the recent advances of Large Language Models to understand and classify SARs against the glossary code terms set out by the UK National Crime Agency. We also explore the privacy concerns of handling confidential and sensitive data with recent AI advancements and propose the use of offline open-source models, coupled with bespoke fine-tuning, to improve task-specific performance using a model that can be deployed locally without requiring data to be shared with external third parties. Our results show that this approach can yield effective classification accuracy on our test cases, offering a solution to develop bespoke smaller, offline models that maintain privacy and confidentiality, over online models that would compromise data privacy.

4. Privacy-preserving intrusion detection in software-defined VANET using federated learning with BERT

   Shakil Ibne Ahsan, Phil Legg, and SM Alam

   arXiv preprint arXiv:2401.07343, 2024

   HTML

5. 

   Cyber Funfair: Creating Immersive and Educational Experiences for Teaching Cyber Physical Systems Security

   Alan Mills, Jonathan White, and Phil Legg

   In SIGCSE 2024: Proceedings of the 55th ACM Technical Symposium on Computer Science Education, 2024

   Abs HTML

   Delivering meaningful and inspiring cyber security education for younger audiences can often be a challenge due to limited expertise and resources. Key to any outreach activity is that it both develops a learner’s curiosity, as well as providing educational objectives. To address this need, we developed a novel learning and awareness activity that addresses the Cyber Physical Systems (CPS) Security knowledge area as mapped by the Cyber Security Body of Knowledge (CyBOK). At the core of our activity is the integration of the Raspberry Pi device with LEGO SPIKE kits. LEGO SPIKE is part of the LEGO Education system that combines colourful LEGO building blocks with motors and sensors, creating an adaptable and engaging learning environment. This hands-on approach allows participants to witness the tangible consequences of cyber and network actions in a physical and engaging format. To evaluate the effectiveness of the activity, we used the activity as part of an outreach activity day attended by approximately 300 students aged between 12-14 from schools across the West of England. Participants of the activity were surveyed and the results showed an increase in understanding of CPS specific and wider cyber security for over 90% of respondents. Activity engagement was also well received with no negative feedback. We report on our survey findings and discuss best practices to support other practitioners in developing hands-on interactive experiences for engaging and educational cyber security activities.

6. 

   Vulnerability detection through machine learning-based fuzzing: A systematic review

   Sadegh Bamohabbat Chafjiri, Phil Legg, Jun Hong, and Michail-Antisthenis Tsompanas

   Computers & Security, 2024

   Abs HTML

   Modern software and networks underpin our digital society, yet the rapid growth of vulnerabilities that are uncovered within these threaten our cyber security posture. Addressing these issues at scale requires automated proactive approaches that can identify and mitigate these vulnerabilities in a suitable time frame. Fuzzing techniques have emerged as crucial methods to preemptively tackle these risks. However, traditional fuzzing methods encounter various challenges, such as a lack of strategy for deep bug identification, time-intensive bug analysis, quality of inputs, seed scheduling and others. To overcome these challenges, diverse Machine Learning (ML) models and optimisation techniques have been employed, including advanced feature engineering, optimised seed selection, refined predictive/fitness models, and Gradient-based optimisation. Furthermore, the use of ML architectures such as Long Short-Term Memory (LSTM), Generative Adversarial Network (GAN), Sequence-to-Sequence (Seq2Seq), and Generative Randomised Unit (GRU), have demonstrated greater effectiveness within ML-based fuzzing. In this paper, we delve into this paradigm shift, aiming to address fundamental challenges across different ML categories. We survey popular ML categories such as Traditional Machine Learning (TML), Deep Learning (DL), Reinforcement Learning (RL), and Deep Reinforcement Learning (DRL), to investigate their potential for enhancing traditional fuzzing approaches. We explore the respective advantages in each category of ML-based fuzzing, while also analysing the challenges unique to each category. Our work provides a comprehensive survey across the fuzzing domain and how machine learning techniques have been utilised, that we believe will be of use to future researchers in this domain.

7. 

   Improving Search Space Analysis of Fuzzing Mutators Using Cryptographic Structures

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and Jun Hong

   In Proceedings of Ninth International Conference on Cyber Security, Privacy in Communication Networks (ICCS 2023), 2024

   HTML

8. 

   GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range

   Alan Mills, Jonathan White, and Phil Legg

   Journal of Cybersecurity and Privacy, 2024

   HTML PDF

9. 

   Digital twins of cyber physical systems in smart manufacturing for threat simulation and detection with deep learning for time series classification

   Carol Lo, Thu Yein Win, Zeinab Rezaeifar, Zaheer Khan, and Phil Legg

   In 29th International Conference on Automation and Computing (ICAC2024), University of Sunderland, UK, 2024

   HTML

10. 

    Analyst-driven XAI for time series forecasting: Analytics for telecoms maintenance

    James Barrett, Phil Legg, Jim Smith, and Chip Boyle

    In ACM 9th International Conference on Machine Learning Technologies (ICMLT) 2024, 2024

    HTML

11. 

    Evaluating data distribution strategies in federated learning: A trade-off analysis between privacy and performance for IoT security

    Jonathan White and Phil Legg

    In Proceedings of Ninth International Conference on Cyber Security, Privacy in Communication Networks (ICCS 2023), 2024

    HTML
12. Trends and Challenges in Data Analytics and Machine Learning Using Call Detail Records in Telecom Systems

    James Barrett, Phil Legg, Jim Smith, Tim Barnes, and Charles Boyle

    Preprints, 2024

    HTML PDF

2023

1. 

   Improving Search Space Analysis of Fuzzing Mutators Using Cryptographic Structures

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and Jun Hong

   In International Conference on Cyber Security, Privacy in Communication Networks, 2023

   Abs DOI HTML

   This paper introduces a novel approach to enhance the performance of software fuzzing mutator tools, by leveraging cryptographic structures known as substitution-permutation networks and Feistel networks. By integrating these structures into the existing HonggFuzz fuzzing library, we propose HonggFuzz+ and demonstrate its effectiveness over other leading fuzzers, such as how the method can uncover bugs and edges earlier due to enhanced search space optimisation. By introducing these two structures, we can diversify memory region relationships that can ultimately improve the performance of HonggFuzz. We demonstrate our approach on a range of common software examples from previous software fuzzing literature. Our results show better or as good performance across a range of software targets when compared to other leading fuzzing techniques. We discuss the relevance of the findings and consider future directions for improving software fuzzing search space analysis.

2. Federated Learning: Data Privacy and Cyber Security in Edge-Based Machine Learning

   Jonathan White and Phil Legg

   In Data Protection in a Post-Pandemic Society, 2023

   HTML

3. 

   Longitudinal Risk-based Security Assessment of Docker Software Container Images

   Alan Mills, Jonathan White, and Phil Legg

   Computers and Security, 2023

   Abs HTML

   As the use of software containerisation has increased, so too has the need for security research on their usage, with various surveys and studies conducted to assess the overall security posture of software container images. To date, there has been very little work that has taken a longitudinal view of container security to observe whether vulnerabilities are being resolved over time, as well as understanding the real-world implications of reported vulnerabilities, to assess the evolving security posture. In this work, we study the evolution of 380 software container images across 3 analysis periods between July 2022 and January 2023 to analyse maintenance and vulnerabilities factors over time. We sample across the 3 DockerHub categories: Official, Verified and OSS (Sponsored) Open Source Software. We found that the number of vulnerabilities present increased over time despite many containers receiving regular updates by providers. We also found that the choice of container OS can dramatically impact the number of reported vulnerabilities present over time, with Debian-based images typically having many more vulnerabilities that other Linux distributions, and with some containers still reporting vulnerabilities that date back as far as 1999. However, when taking into account additional reported attributes such as the attack vector required and the existence of a public exploit rated higher than negligible, we found that for each analysis period, less than 1% of all vulnerabilities present what we would consider as high risk real-world impact. Through our investigation, we aim to improve the understanding of the threat landscape posed by software containerisation that is further complicated by the discrepancies between different vulnerability reporting tools.

2022

1. 

   Investigating Malware Propagation and Behaviour Using System and Network Pixel-Based Visualisation

   Jacob Williams and Phil Legg

   SN Computer Science, 2022

   HTML

2. 

   Functionality-preserving adversarial machine learning for robust classification in cybersecurity and intrusion detection domains: A survey

   Andrew McCarthy, Essam Ghadafi, Panagiotis Andriotis, and Phil Legg

   Journal of Cybersecurity and Privacy, 2022

   HTML PDF

3. 

   OGMA: visualisation for software container security analysis and automated remediation

   Alan Mills, Jonathan White, and Phil Legg

   In 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022

   HTML

4. 

   Teaching Offensive and Defensive Cyber Security in Schools using a Raspberry Pi Cyber Range

   Phil Legg, Alan Mills, and Ian Johnson

   In Colloquium on Information Systems Security Education (CISSE), 2022

   HTML

5. 

   Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification

   Andrew McCarthy, Essam Ghadafi, Panagiotis Andriotis, and Phil Legg

   Journal of Information Security and Applications, 2022

   Abs HTML

   Machine learning is key for automated detection of malicious network activity to ensure that computer networks and organizations are protected against cyber security attacks. Recently, there has been growing interest in the domain of adversarial machine learning, which explores how a machine learning model can be compromised by an adversary, resulting in misclassified output. Whilst to date, most focus has been given to visual domains, the challenge is present in all applications of machine learning where a malicious attacker would want to cause unintended functionality, including cyber security and network traffic analysis. We first present a study on conducting adversarial attacks against a well-trained network traffic classification model. We show how well-crafted adversarial examples can be constructed so that known attack types are misclassified by the model as benign activity. To combat this, we present a novel defensive strategy based on hierarchical learning to help reduce the attack surface that an adversarial example can exploit within the constraints of the parameter space of the intended attack. Our results show that our defensive learning model can withstand crafted adversarial attacks and can achieve classification accuracy in line with our original model when not under attack.

6. 

   Interactive cyber-physical system hacking: Engaging students early using Scalextric

   Jonathan White, Phil Legg, and Alan Mills

   In Colloquium on Information Systems Security Education (CISSE), 2022

   HTML

2021

1. 

   Deep Learning-Based Security Behaviour Analysis in IoT Environments: A Survey

   Yawei Yue, Shancang Li, Phil Legg, and Fuzhong Li

   Security and communication Networks, 2021

   HTML

2. 

   Feature vulnerability and robustness assessment against adversarial machine learning attacks

   Andrew McCarthy, Panagiotis Andriotis, Essam Ghadafi, and Phil Legg

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

3. 

   “Hacking an IoT Home”: New opportunities for cyber security education combining remote learning with cyber-physical systems

   Phil Legg, Thomas Higgs, Pennie Spruhan, Jonathan White, and Ian Johnson

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

4. 

   Unsupervised one-class learning for anomaly detection on home IoT network devices

   Jonathan White and Phil Legg

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

2020

1. The visual design of network data to enhance cyber security awareness of the everyday internet user

   Fiona Carroll, Phil Legg, and Bastian Bønkel

   In 2020 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2020

   HTML
2. Shouting Through Letterboxes: A study on attack susceptibility of voice assistants

   Andrew McCarthy, Benedict R Gaster, and Phil Legg

   In 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020

   HTML
3. “What did you say?”: Extracting unintentional secrets from predictive text learning systems

   Gwyn Wilkinson and Phil Legg

   In 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020

   HTML

4. 

   Investigating anti-evasion malware triggers using automated sandbox reconfiguration techniques

   Alan Mills and Phil Legg

   Journal of Cybersecurity and Privacy, 2020

   HTML PDF

2019

1. What makes for effective visualisation in cyber situational awareness for non-expert users?

   Fiona Carroll, Phil Legg, and Adam Chakof

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   Abs HTML

   As cyber threats continue to become more prevalent, there is a need to consider how best we can understand the cyber landscape when acting online, especially so for non-expert users. Satellite navigation systems provide the de facto standard for many modern day navigation tasks in the physical domain, so we consider the question of how one could navigate the online domain using similar concepts. In this paper, we study the design of a cyber sat nav for improving situational awareness of nonexpert users. We focus on three core tasks: understanding where we are in cyber space, understanding how we got there, and understanding future states that we may traverse to. To support understanding, we explore the use of visualisation techniques to portray complex online activities in clear and engaging formats for non-expert users.

2. Venue2vec: An efficient embedding model for fine-grained user location prediction in geo-social networks

   Shuai Xu, Jiuxin Cao, Phil Legg, Bo Liu, and Shancang Li

   IEEE Systems Journal, 2019

   Abs HTML

   Geo-Social Networks (GSN) significantly improve location-aware capability of services by offering geo-located content based on the huge volumes of data generated in the GSN. The problem of user location prediction based on user-generated data in GSN has been extensively studied. However, existing studies are either concerning predicting users’ next check-in location or predicting their future check-in location at a given time with coarse granularity. A unified model that can predict both scenarios with fine granularity is quite rare. Also, due to the heterogeneity of multiple factors associated with both locations and users, how to efficiently incorporate these information still remains challenging. Inspired by the recent success of word embedding in natural language processing, in this paper, we propose a novel embedding model called Venue2Vec which automatically incorporates temporal-spatial context, semantic information, and sequential relations for fine-grained user location prediction. Locations of the same type, and those that are geographically close or often visited successively by users will be situated closer within the embedding space. Based on our proposed Venue2Vec model, we design techniques that allow for predicting a user’s next check-in location, and also their future check-in location at a given time. We conduct experiments on three real-world GSN datasets to verify the performance of the proposed model. Experimental results on both tasks show that Venue2Vec model outperforms several state-of-the-art models on various evaluation metrics. Furthermore, we show how the Venue2Vec model can be more time-efficient due to being parallelizable.

3. Tools and techniques for improving cyber situational awareness of targeted phishing attacks

   Phil Legg and Tim Blackman

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   Abs HTML

   Phishing attacks continue to be one of the most common attack vectors used online today to deceive users, such that attackers can obtain unauthorised access or steal sensitive information. Phishing campaigns often vary in their level of sophistication, from mass distribution of generic content, such as delivery notifications, online purchase orders, and claims of winning the lottery, through to bespoke and highly-personalised messages that convincingly impersonate genuine communications (e.g., spearphishing attacks). There is a distinct trade-off here between the scale of an attack versus the effort required to curate content that is likely to convince an individual to carry out an action (typically, clicking a malicious hyperlink). In this short paper, we conduct a preliminary study on a recent realworld incident that strikes a balance between attacking at scale and personalised content. We adopt different visualisation tools and techniques for better assessing the scale and impact of the attack, that can be used both by security professionals to analyse the security incident, but could also be used to inform employees as a form of security awareness and training. We pitched the approach to IT professionals working in information security, who believe this may provide improved awareness of how targeted phishing campaigns can impact an organisation, and could contribute towards a pro-active step of how analysts will examine and mitigate the impact of future attacks across the organisation.

4. Efficient and interpretable real-time malware detection using random-forest

   Alan Mills, Theodoros Spyridopoulos, and Phil Legg

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   HTML
5. Visual analytics for collaborative human-machine confidence in human-centric active learning tasks

   Phil Legg, Jim Smith, and Alexander Downing

   Human-centric computing and information sciences, 2019

   HTML PDF

2018

1. Predicting the occurrence of world news events using recurrent neural networks and auto-regressive moving average models

   Emmanuel M Smith, Jim Smith, Phil Legg, and Simon Francis

   In Advances in Computational Intelligence Systems: Contributions Presented at the 17th UK Workshop on Computational Intelligence, September 6-8, 2017, Cardiff, UK, 2018

   Abs HTML

   The ability to predict future states is fundamental for a wide variety of applications, from weather forecasting to stock market analysis. Understanding the related data attributes that can influence changes in time series is a challenging task that is critical for making accurate predictions. One particular application of key interest is understanding the factors that relate to the occurrence of global activities from online world news reports. Being able to understand why particular types of events may occur, such as violence and peace, could play a vital role in better protecting and understanding our global society. In this work, we explore the concept of predicting the occurrence of world news events, making use of Global Database of Events, Language and Tone online news aggregation source. We compare traditional Auto-Regressive Moving Average models with more recent deep learning strategies using Long Short-Term Memory Recurrent Neural Networks. Our results show that the latter are capable of achieving lower error rates. We also discuss how deep learning methods such as Recurrent Neural Networks have the potential for greater capability to incorporate complex associations of data attributes that may impact the occurrence of future events.

2. Visualising state space representations of LSTM networks

   Emmanuel M Smith, Jim Smith, Phil Legg, and Simon Francis

   In Workshop on Visualization for AI Explainability (VISxAI), 2018

   HTML
3. Predicting user confidence during visual decision making

   Jim Smith, Phil Legg, Milos Matovic, and Kristofer Kinsey

   ACM Transactions on Interactive Intelligent Systems (TiiS), 2018

   HTML

2017

1. Human-machine decision support systems for insider threat detection

   Philip A Legg

   Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications, 2017

   Abs HTML

   Insider threats are recognised to be quite possibly the most damaging attacks that an organisation could experience. Those on the inside, who have privileged access and knowledge, are already in a position of great responsibility for contributing towards the security and operations of the organisation. Should an individual choose to exploit this privilege, perhaps due to disgruntlement or external coercion from a competitor, then the potential impact to the organisation can be extremely damaging. There are many proposals of using machine learning and anomaly detection techniques as a means of automated decision-making about which insiders are acting in a suspicious or malicious manner, as a form of large scale data analytics. However, it is well recognised that this poses many challenges, for example, how do we capture an accurate representation of normality to assess insiders against, within a dynamic and ever-changing organisation? More recently, there has been interest in how visual analytics can be incorporated with machine-based approaches, to alleviate the data analytics challenges of anomaly detection and to support human reasoning through visual interactive interfaces. Furthermore, by combining visual analytics and active machine learning, there is potential capability for the analysts to impart their domain expert knowledge back to the system, so as to iteratively improve the machine-based decisions based on the human analyst preferences. With this combined human-machine approach to decision-making about potential threats, the system can begin to more accurately capture human rationale for the decision process, and reduce the false positives that are flagged by the system. In this work, I reflect on the challenges of insider threat detection, and look to how human-machine decision support systems can offer solutions towards this.

2. RicherPicture: Semi-automated cyber defence using context-aware data analytics

   Arnau Erola, Ioannis Agrafiotis, Jassim Happa, Michael Goldsmith, Sadie Creese, and Philip A Legg

   In 2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), 2017

   HTML

2016

1. Automated registration of multimodal optic disc images: clinical assessment of alignment accuracy

   Wai Siene Ng, Phil Legg, Venkat Avadhanam, Kyaw Aye, Steffan HP Evans, Rachel V North, Andrew D Marshall, Paul Rosin, and James E Morgan

   Journal of Glaucoma, 2016

   Abs HTML

   Purpose: To determine the accuracy of automated alignment algorithms for the registration of optic disc images obtained by 2 different modalities: fundus photography and scanning laser tomography. Materials and methods: Images obtained with the Heidelberg Retina Tomograph II and paired photographic optic disc images of 135 eyes were analyzed. Three state-of-the-art automated registration techniques Regional Mutual Information, rigid Feature Neighbourhood Mutual Information (FNMI), and nonrigid FNMI (NRFNMI) were used to align these image pairs. Alignment of each composite picture was assessed on a 5-point grading scale: "Fail" (no alignment of vessels with no vessel contact), "Weak" (vessels have slight contact), "Good" (vessels with <50% contact), "Very Good" (vessels with >50% contact), and "Excellent" (complete alignment). Custom software generated an image mosaic in which the modalities were interleaved as a series of alternate 5×5-pixel blocks. These were graded independently by 3 clinically experienced observers. Results: A total of 810 image pairs were assessed. All 3 registration techniques achieved a score of "Good" or better in >95% of the image sets. NRFNMI had the highest percentage of "Excellent" (mean: 99.6%; range, 95.2% to 99.6%), followed by Regional Mutual Information (mean: 81.6%; range, 86.3% to 78.5%) and FNMI (mean: 73.1%; range, 85.2% to 54.4%). Conclusions: Automated registration of optic disc images by different modalities is a feasible option for clinical application. All 3 methods provided useful levels of alignment, but the NRFNMI technique consistently outperformed the others and is recommended as a practical approach to the automated registration of multimodal disc images.

2. Enhancing cyber situation awareness for non-expert users using visual analytics

   Philip A Legg

   In 2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA), 2016

   Abs HTML

   Situation awareness is often described as the perception and comprehension of the current situation, and the projection of future status. Whilst this may be understood in an organisational cybersecurity context, there is a strong case to be made for effective cybersecurity situation awareness that is tailored to the needs of the Non-Expert User (NEU). Our online usage habits are rapidly evolving with smartphones and tablets being widely used to access resources online. In order for NEUs to remain safe online, there is a need to enhance awareness and understanding of cybersecurity concerns, such as how devices may be acting online, and what data is being shared between devices. In this paper, we explore the notion of personal situation awareness for NEUs. We conduct a small-scale study to understand how NEUs perceive cybersecurity. We also propose how visual analytics could be used to help encourage NEUs to actively monitor and observe their activity for greater online awareness. The guidance developed through the course of this work can help practitioners develop tools that could help NEUs better understand their online actions, with the aim to result in safer experiences when acting online.

3. Glyph visualization: A fail-safe design scheme based on quasi-hamming distances

   Philip A Legg, Eamonn Maguire, Simon Walton, and Min Chen

   IEEE computer graphics and applications, 2016

   HTML
4. Visual Analytics for Non-Expert Users in Cyber Situation Awareness

   Philip A Legg

   Int. J. Cyber Situational Aware., 2016

   HTML

2015

1. Glyph sorting: Interactive visualization for multi-dimensional data

   David HS Chung, Philip A Legg, Matthew L Parry, Rhodri Bown, Iwan W Griffiths, Robert S Laramee, and Min Chen

   Information Visualization, 2015

   Abs HTML

   Glyph-based visualization is an effective tool for depicting multivariate information. Since sorting is one of the most common analytical tasks performed on individual attributes of a multi-dimensional dataset, this motivates the hypothesis that introducing glyph sorting would significantly enhance the usability of glyph-based visualization. In this article, we present a glyph-based conceptual framework as part of a visualization process for interactive sorting of multivariate data. We examine several technical aspects of glyph sorting and provide design principles for developing effective, visually sortable glyphs. Glyphs that are visually sortable provide two key benefits: (1) performing comparative analysis of multiple attributes between glyphs and (2) to support multi-dimensional visual search. We describe a system that incorporates focus and context glyphs to control sorting in a visually intuitive manner and for viewing sorted results in an interactive, multi-dimensional glyph plot that enables users to perform high-dimensional sorting, analyse and examine data trends in detail. To demonstrate the usability of glyph sorting, we present a case study in rugby event analysis for comparing and analysing trends within matches. This work is undertaken in conjunction with a national rugby team. From using glyph sorting, analysts have reported the discovery of new insight beyond traditional match analysis.

2. Identifying attack patterns for insider threat detection

   Ioannis Agrafiotis, Jason RC Nurse, Oliver Buckley, Phil Legg, Sadie Creese, and Michael Goldsmith

   Computer Fraud & Security, 2015

   Abs HTML

   The threat that insiders pose to businesses, institutions and governmental organisations continues to be of serious concern. Recent industry surveys provide unequivocal evidence to support the significance of this threat and its prevalence in enterprises today.1 In an attempt to address this challenge, several approaches and systems have been proposed by practitioners and researchers. These focus on defining the insider threat and exploring the human and psychological factors involved, through to the detection and deterrence of these threats via technological and behavioural theories. Insider threats pose major concerns to businesses, institutions and governmental organisations. Few solutions to this problem consider all the technical, organisational and behavioural aspects. In new research, Ioannis Agrafiotis, Jason RC Nurse, Oliver Buckley, Phil Legg, Sadie Creese and Michael Goldsmith define attack patterns that could be key in assisting insider-threat detection, based on 120 real-world case studies. They present their findings, representing each case study as a series of attack steps and identify common trends between different attacks.

3. Knowledge-assisted ranking: A visual analytic application for sports event data

   David HS Chung, Matthew L Parry, Iwan W Griffiths, Robert S Laramee, Rhodri Bown, Philip A Legg, and Min Chen

   IEEE Computer Graphics and Applications, 2015

   Abs HTML

   Organizing sports video data for performance analysis can be challenging, especially in cases involving multiple attributes and when the criteria for sorting frequently changes depending on the user’s task. The proposed visual analytic system enables users to specify a sort requirement in a flexible manner without depending on specific knowledge about individual sort keys. The authors use regression techniques to train different analytical models for different types of sorting requirements and use visualization to facilitate knowledge discovery at different stages of the process. They demonstrate the system with a rugby case study to find key instances for analyzing team and player performance. Organizing sports video data for performance analysis can be challenging in cases with multiple attributes, and when sorting frequently changes depending on the user’s task. As this video shows, the proposed visual analytic system allows interactive data sorting and exploration. https://youtu.be/Cs6SLtPVDQQ.

4. Using internet activity profiling for insider-threat detection

   Bushra A Alahmadi, Philip A Legg, and Jason RC Nurse

   In Special Session on Security in Information Systems, 2015

   Abs HTML PDF

   The insider-threat problem continues to be a major risk to both public and private sectors, where those people who have privileged knowledge and access choose to abuse this in some way to cause harm towards their organisation. To combat against this, organisations are beginning to invest heavily in deterrence monitoring tools to observe employees’ activity, such as computer access, Internet browsing, and email communications. Whilst such tools may provide some way towards detecting attacks afterwards, what may be more useful is preventative monitoring, where user characteristics and behaviours inform about the possibility of an attack before it happens. Psychological research advocates that the behaviour and preference of a person can be explained to a great extent by psychological constructs called personality traits, which could then possibly indicate the likelihood of an individual being a potential insider threat. By considering how browsing content relates to psychological constructs (such as OCEAN), and how an individual’s browsing behaviour deviates over time, potential insider-threats could be uncovered before significant damage is caused. The main contribution in this paper is to explore how Internet browsing activity could be used to predict the individual’s psychological characteristics in order to detect potential insider-threats. Our results demonstrate that predictive assessment can be made between the content available on a website, and the associated personality traits, which could greatly improve the prospects of preventing insider attacks.

5. Visualizing the insider threat: challenges and tools for identifying malicious user activity

   Philip A Legg

   In 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), 2015

   Abs HTML

   One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be indicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.

6. Quasi-Hamming distances: An overarching concept for measuring glyph similarity

   Philip A Legg, Eamonn Maguire, Simon Walton, and Min Chen

   Computer Graphics and Visual Computing: Extended Abstract, 2015

   HTML PDF
7. Caught in the act of an insider attack: detection and assessment of insider threat

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and Sadie Creese

   In 2015 IEEE International Symposium on Technologies for Homeland Security (HST), 2015

   HTML
8. Feature neighbourhood mutual information for multi-modal image registration: an application to eye fundus imaging

   Philip A Legg, Paul L Rosin, Dave Marshall, and James E Morgan

   Pattern Recognition, 2015

   HTML
9. Automated insider threat detection system using user and role-based profile assessment

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and Sadie Creese

   IEEE Systems Journal, 2015

   HTML

2014

1. Systematic snooker skills test to analyze player performance

   David HS Chung, Iwan W Griffiths, Phil A Legg, Matthew L Parry, A Morris, Min Chen, W Griffiths, and Alex Thomas

   International Journal of Sports Science & Coaching, 2014

   Abs HTML

   The process of rigorous training and coaching is one that is essential to any sports player aiming to develop their abilities further. From the novice player through to professional athletes, it is vital to maintain and assess their level of performance in order to progress to a higher standard. However, traditional practice routines can often be non-strategic and devised with an “ad-hoc” approach. In order for a training regime to be beneficial to a player, methods to examine a player’s performance are desirable and can offer quantifiable feedback that will help the player to understand their current weaknesses and provide a benchmark to improve upon. This article focuses on the introduction of a systematic skills test. We assess the fundamental physics of snooker and from this we identify a set of key skills that characterises the basis of all snooker shots. We present 5 snooker tests that can be used to quantify the performance of these key skills. This allows us to analyse snooker players in an objective manner based on their level of ability for each key skill. The article concludes with a user study that assesses the performance of novice, intermediate and professional players when performing our proposed snooker skills test, which demonstrates the ability to make accurate comparison between players of different ability.

2. Reflecting on the ability of enterprise security policy to address accidental insider threat

   Oliver Buckley, Jason RC Nurse, Philip A Legg, Michael Goldsmith, and Sadie Creese

   In 2014 Workshop on Socio-Technical Aspects in Security and Trust, 2014

   Abs HTML

   An enterprise’s information security policy is an exceptionally important control as it provides the employees of an organisation with details of what is expected of them, and what they can expect from the organisation’s security teams, as well as informing the culture within that organisation. The threat from accidental insiders is a reality across all enterprises and can be extremely damaging to the systems, data and reputation of an organisation. Recent industry reports and academic literature underline the fact that the risk of accidental insider compromise is potentially more pressing than that posed by a malicious insider. In this paper we focus on the ability of enterprises’ information security policies to mitigate the accidental insider threat. Specifically we perform an analysis of real-world cases of accidental insider threat to define the key reasons, actions and impacts of these events – captured as a grounded insider threat classification scheme. This scheme is then used to performa review of a set of organisational security policies to highlight their strengths and weaknesses when considering the prevention of incidents of accidental insider compromise. We present a set of questions that can be used to analyse an existing security policy to help control the risk of the accidental insider threat.

3. Guest Editorial: Emerging Trends in Research for Insider Threat Detection.

   William R Claycomb, Philip A Legg, and Dieter Gollmann

   J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 2014

   HTML PDF
4. Understanding insider threat: A framework for characterising attacks

   Jason RC Nurse, Oliver Buckley, Philip A Legg, Michael Goldsmith, Sadie Creese, Gordon RT Wright, and Monica Whitty

   In 2014 IEEE security and privacy workshops, 2014

   Abs HTML

   The threat that insiders pose to businesses, institutions and governmental organisations continues to be of serious concern. Recent industry surveys and academic literature provide unequivocal evidence to support the significance of this threat and its prevalence. Despite this, however, there is still no unifying framework to fully characterise insider attacks and to facilitate an understanding of the problem, its many components and how they all fit together. In this paper, we focus on this challenge and put forward a grounded framework for understanding and reflecting on the threat that insiders pose. Specifically, we propose a novel conceptualisation that is heavily grounded in insider-threat case studies, existing literature and relevant psychological theory. The framework identifies several key elements within the problem space, concentrating not only on noteworthy events and indicators- technical and behavioural- of potential attacks, but also on attackers (e.g., the motivation behind malicious threats and the human factors related to unintentional ones), and on the range of attacks being witnessed. The real value of our framework is in its emphasis on bringing together and defining clearly the various aspects of insider threat, all based on real-world cases and pertinent literature. This can therefore act as a platform for general understanding of the threat, and also for reflection, modelling past attacks and looking for useful patterns.

5. Towards a User and Role-based Sequential Behavioural Analysis Tool for Insider Threat Detection.

   Ioannis Agrafiotis, Philip A Legg, Michael Goldsmith, and Sadie Creese

   J. Internet Serv. Inf. Secur., 2014

   Abs HTML PDF

   Insider threat is recognised to be a significant problem and of great concern to both corporations and governments alike. Traditional intrusion detection systems are known to be ineffective due to the extensive knowledge and capability that insiders typically have regarding the organisational setup. Instead, more sophisticated measures are required to analyse the actions performed by those within the organisation, to assess whether their actions suggest that they pose a threat. In this paper, we propose a proof-of-concept that focuses on the use of activity trees to establish sequential-based analysis of employee behaviour. This concept combines the notions of previously-proposed techniques such as attack trees and behaviour trees. For a given employee, we define a tree that can represent all sequences of their observed behaviours. Over time, branches are either appended or created to reflect the new observations that are made on how the employee acts. We also incorporate a similarity measure to establish how different branches compare against each other. Attacks can be defined as where the similarity measure between a newly-observed branch and all existing branches is below a given acceptance criteria. The approach would allow an analyst to observe chains of events that result in low probability activities that could be deemed as unusual and therefore may be malicious. We demonstrate our proof-of-concept using third-party synthetic employee activity logs, to illustrate the practicalities of delivering this form of protective monitoring.

6. A critical reflection on the threat from human insiders–its nature, industry perceptions, and detection approaches

   Jason RC Nurse, Philip A Legg, Oliver Buckley, Ioannis Agrafiotis, Gordon Wright, Monica Whitty, David Upton, Michael Goldsmith, and Sadie Creese

   In Human Aspects of Information Security, Privacy, and Trust: Second International Conference, HAS 2014, Held as Part of HCI International 2014, Heraklion, Crete, Greece, June 22-27, 2014. Proceedings 2, 2014

   HTML
7. Deep Focus: Increasing User" Depth of Field" to Improve Threat Detection (Oxford workshop poster)

   William R Claycomb, Roy Maxion, Jason Clark, Bronwyn Woods, Brian Lindauer, David Jensen, Joshua Neil, Alex Kent, Sadie Creese, and Phil Legg

   2014

   HTML
8. Visual analytics of e-mail sociolinguistics for user behavioural analysis

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and Sadie Creese

   J. Internet Serv. Inf. Secur., 2014

   HTML PDF

2013

1. Force-directed parallel coordinates

   Rick Walker, Philip A Legg, Serban Pop, Zhao Geng, Robert S Laramee, and Jonathan C Roberts

   In 2013 17th International Conference on Information Visualisation, 2013

   Abs HTML

   Parallel coordinates are a well-known and valuable technique for the analysis and visualization of high dimensional data sets. However, while Inselberg emphasizes that the strength of parallel coordinates as a methodology is rooted in exploration and interactivity, the set of interaction techniques is currently limited. Axes can be re-ordered and brushing (simple, angular or multi-dimensional) can be performed. In this paper, we propose a force-directed algorithm and related interaction techniques to support the exploration of parallel coordinate plots through a physical metaphor. Our parallel-coordinates visualization offers novel user interaction beyond the standard techniques by allowing the user to rotate the axis according to forcedirected polylines. The new interaction provides the user with a more immersive experience for data exploration that results in greater intuition of the data, especially in cases where many polylines overlap. We demonstrate our approach, then present the results of a qualitative evaluation of the system.

2. Transformation of an uncertain video search pipeline to a sketch-based visual analytics loop

   Philip A Legg, David HS Chung, Matthew L Parry, Rhodri Bown, Mark W Jones, Iwan W Griffiths, and Min Chen

   IEEE transactions on Visualization and Computer Graphics, 2013

   Abs HTML

   Traditional sketch-based image or video search systems rely on machine learning concepts as their core technology. However, in many applications, machine learning alone is impractical since videos may not be semantically annotated sufficiently, there may be a lack of suitable training data, and the search requirements of the user may frequently change for different tasks. In this work, we develop a visual analytics systems that overcomes the shortcomings of the traditional approach. We make use of a sketch-based interface to enable users to specify search requirement in a flexible manner without depending on semantic annotation. We employ active machine learning to train different analytical models for different types of search requirements. We use visualization to facilitate knowledge discovery at the different stages of visual analytics. This includes visualizing the parameter space of the trained model, visualizing the search space to support interactive browsing, visualizing candidature search results to support rapid interaction for active learning while minimizing watching videos, and visualizing aggregated information of the search results. We demonstrate the system for searching spatiotemporal attributes from sports video to identify key instances of the team and player performance.

3. Visual analytics for multivariate sorting of sport event data

   D Chung, P Legg, M Parry, I Griffiths, R Brown, R Laramee, and M Chen

   In Workshop on sports data visualization, 2013

   HTML PDF
4. Improving accuracy and efficiency of mutual information for multi-modal retinal image registration using adaptive probability density estimation

   Philip A Legg, Paul L Rosin, David Marshall, and James E Morgan

   Computerized Medical Imaging and Graphics, 2013

   HTML
5. Turn costs change the value of animal search paths

   RP Wilson, IW Griffiths, PA Legg, MI Friswell, OR Bidder, LG Halsey, Sergio Agustin Lambertucci, and ELC Shepard

   Ecology letters, 2013

   HTML
6. Towards a conceptual model and reasoning structure for insider threat detection

   Philip A Legg, Nick Moffat, Jason RC Nurse, Jassim Happa, Ioannis Agrafiotis, Michael Goldsmith, and Sadie Creese

   Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, 2013

   HTML PDF
7. Video Visualization

   Rita Borgo, Min Chen, Markus Höferlin, Kuno Kurzhals, Phil Legg, Simon Walton, and Daniel Weiskopf

   2013

2012

1. Visualizing multiple error-sensitivity fields for single camera positioning

   David HS Chung, Matthew L Parry, Philip A Legg, Iwan W Griffiths, Robert S Laramee, and Min Chen

   Computing and Visualization in Science, 2012

   Abs HTML

   In many data acquisition tasks, the placement of a real camera can vary significantly in complexity from one scene to another. Optimal camera positioning should be governed not only by least error sensitivity, but in addition to real-world practicalities given by various physical, financial and other types of constraints. It would be a laborious and costly task to model all these constraints if one were to rely solely on fully automatic algorithms to make the decision. In this work, we present a study using 2D and 3D visualization methods to assist in single camera positioning based on error sensitivity of reconstruction and other physical and financial constraints. We develop a collection of visual mappings that depict the composition of multiple error sensitivity fields that occur for a given camera position. Each camera position is then mapped to a 3D visualization that enables visual assessment of the camera configuration. We find that the combined 2D and 3D visualization effectively aids the estimation of camera placement without the need for extensive manual configuration through trial and error. Importantly, it still provides the user with sufficient flexibility to make dynamic decisions based on physical and financial constraints that can not be encoded easily in an algorithm. We demonstrate the utility of our system on two real-world applications namely snooker analysis and camera surveillance.

2. MatchPad: interactive glyph-based visualization for real-time sports performance analysis

   Philip A Legg, David HS Chung, Matthew L Parry, Mark W Jones, Rhys Long, Iwan W Griffiths, and Min Chen

   In Computer graphics forum, 2012

   Abs HTML

   Today real-time sports performance analysis is a crucial aspect of matches in many major sports. For example, in soccer and rugby, team analysts may annotate videos during the matches by tagging specific actions and events, which typically result in some summary statistics and a large spreadsheet of recorded actions and events. To a coach, the summary statistics (e.g., the percentage of ball possession) lacks sufficient details, while reading the spreadsheet is time-consuming and making decisions based on the spreadsheet in real-time is thereby impossible. In this paper, we present a visualization solution to the current problem in real-time sports performance analysis. We adopt a glyph-based visual design to enable coaching staff and analysts to visualize actions and events “at a glance”. We discuss the relative merits of metaphoric glyphs in comparison with other types of glyph designs in this particular application. We describe an algorithm for managing the glyph layout at different spatial scales in interactive visualization. We demonstrate the use of this technical approach through its application in rugby, for which we delivered the visualization software, MatchPad, on a tablet computer. The MatchPad was used by the Welsh Rugby Union during the Rugby World Cup 2011. It successfully helped coaching staff and team analysts to examine actions and events in detail whilst maintaining a clear overview of the match, and assisted in their decision making during the matches. It also allows coaches to convey crucial information back to the players in a visually-engaging manner to help improve their performance.

2011

1. From Video to Animated 3D Reconstruction: A Computer Graphics Application for Snooker Skills Training.

   Philip A Legg, Matthew L Parry, David HS Chung, Richard M Jiang, Adrian Morris, Iwan W Griffiths, A David Marshall, and Min Chen

   In Eurographics (Posters), 2011

   Abs HTML

   This poster will present a computer graphics application for improving snooker skills training. We developed an automated modelling and rendering pipeline that converts video input data to a time-varying 3D graphical model that can be animated from arbitrary viewing positions. In addition, we introduced illustrative rendering capability that provides coaches and players with various annotated graphics as training aids. The reconstruction of 3D models relies only on a single camera view.

2. Intelligent filtering by semantic importance for single-view 3D reconstruction from Snooker video

   Philip A Legg, Matthew L Parry, David HS Chung, Richard M Jiang, Adrian Morris, Iwan W Griffiths, David Marshall, and Min Chen

   In 2011 18th IEEE international conference on image processing, 2011

   HTML
3. Hierarchical event selection for video storyboards with a case study on snooker video visualization

   Matthew L Parry, Philip A Legg, David HS Chung, Iwan W Griffiths, and Min Chen

   IEEE Transactions on Visualization and Computer Graphics, 2011

   HTML

2010

1. Multimodal retinal imaging: Improving accuracy and efficiency of image registration using Mutual Information

   Philip A Legg

   Cardiff University (United Kingdom), 2010

   Abs HTML

   This thesis addresses the challenging task of multi-modal image registration. Registration is often required in a number of applications, whereby two images are aligned to give matching correspondence between the features in each image. Such techniques have become popular in many different fields, especially in medical imaging. Multi-modal registration would allow for anatomical structure to be studied concurrently in both modalities, providing the clinician with a greater insight of the patient’s condition. Glaucoma is a serious condition that damages the optic nerve progressively, leading to irreversible blindness. The disease can be treated so to prevent any further infection, however it can not be reversed. Therefore it is paramount that the disease is detected in the early stages so to minimise the affect of the condition. The work in this thesis focuses on two particular imaging modalities: colour fundus photographs and scanning laser ophthalmoscope images. Both images are captured from the human eye and show the appearance and reflectivity of the retina respectively. Registration of these two modalities would significantly improve demarcation and monitoring of the optic nerve head, a crucial stage for glaucoma diagnosis. In recent years, Mutual Information has become a popular technique used to perform multi-modal registration. This thesis provides a comprehensive overview of the algorithm. Firstly, an investigation is performed that shows how probability estimation can improve the algorithm performance. Secondly, the weaknesses of the current technique are revealed and so a novel solution is proposed that overcomes these problems. Finally, the proposed solution is incorporated in a non-rigid registration scheme that provides excellent registration accuracy for our intended application.

2009

1. A robust solution to multi-modal image registration by combining mutual information with multi-scale derivatives

   Philip A Legg, Paul L Rosin, David Marshall, and James E Morgan

   In Medical Image Computing and Computer-Assisted Intervention–MICCAI 2009: 12th International Conference, London, UK, September 20-24, 2009, Proceedings, Part I 12, 2009

   Abs HTML

   In this paper we present a novel method for performing image registration of different modalities. Mutual Information (MI) is an established method for performing such registration. However, it is recognised that standard MI is not without some problems, in particular it does not utilise spatial information within the images. Various modifications have been proposed to resolve this, however these only offer slight improvement to the accuracy of registration. We present Feature Neighbourhood Mutual Information (FNMI) that combines both image structure and spatial neighbourhood information which is efficiently incorporated into Mutual Information by approximating the joint distribution with a covariance matrix (c.f. Russakoff’s Regional Mutual Information). Results show that our approach offers a very high level of accuracy that improves greatly on previous methods. In comparison to Regional MI, our method also improves runtime for more demanding registration problems where a higher neighbourhood radius is required. We demonstrate our method using retinal fundus photographs and scanning laser ophthalmoscopy images, two modalities that have received little attention in registration literature. Registration of these images would improve accuracy when performing demarcation of the optic nerve head for detecting such diseases as glaucoma.

2. Non-rigid elastic registration of retinal images using local window mutual information

   Philip A Legg, Paul L Rosin, David Marshall, and James E Morgan

   Proc. Med. Image Understand. Anal. (MIUA 2009), 2009

   HTML

2008

1. Incorporating neighbourhood feature derivatives with mutual information to improve accuracy of multi-modal image registration

   Philip A Legg, Paul L Rosin, David Marshall, and James E Morgan

   Proc. Med. Image Understand. Anal. (MIUA 2008), 2008

   Abs HTML PDF

   In this paper we present an improved method for performing image registration of different modalities. Russakoff proposed the method of Regional Mutual Information (RMI) which allows neighbourhood information to be considered in the Mutual Information (MI) algorithm. We extend this method by taking local multi-scale feature derivatives in a gauge coordinate frame to represent the structural information of the images. By incorporatingthese images into RMI, we can combine aspects of both structural and neighbourhood information together, which provides a high level of registration accuracy that is essential in application to the medical domain. Our images to be registered are retinal fundus photographs and SLO (Scanning Laser Ophthalmoscopy) images. The combination of these two modalities has received little attention in image registration, yet could provide much useful information to an Ophthalmic clinician. One application is the detection of glaucoma in its early stages, where prevention of further infection is possible before irreversible damage occurs. Results indicate that our method offers a vast improvement to Regional MI, with 25 of our 26 test images being registered to a high standard.

2007

1. Improving accuracy and efficiency of registration by mutual information using Sturges’ histogram rule

   Philip A Legg, Paul L Rosin, David Marshall, and James E Morgan

   Proc. Med. Image Understand. Anal. (MIUA 2007), 2007

   Abs HTML

   Mutual Information is a common technique for image registration in the medical domain, in particular where images of different modalities are to be registered. In this paper, we wish to demonstrate the benefits of applying a common method known in statistics as Sturges’ Rule for selecting histogram bin size when computing Entropy as a part of the existing Mutual Information algorithm. Although Sturges’ Rule is well known in the field of statistics it has received little attention in the Computer Vision community. By augmenting Mutual Information with Sturges’ Rule, we show that this offers an improvement to both the runtime of the algorithm and also the accuracy of the registration. Our results are demonstrated on images of the eye, in particular, Fundus images and SLO (Scanning Laser Ophthalmoscopy) images.