publications

2025

1. 

   An Explainable Ensemble-based Intrusion Detection System for Software-Defined Vehicle Ad-hoc Networks

   Shakil Ibne Ahsan, Phil Legg, and S M Iftekharul Alam

   Cyber Security and Applications, 2025

   DOI HTML PDF

2. 

   Leveraging activation and optimisation layers as dynamic strategies in the multi-task fuzzing scheme

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and 1 more author

   Computer Standards & Interfaces, 2025

   DOI HTML PDF

3. 

   TRIST: Towards a Container-Based ICS Testbed for Cyber Threat Simulation and Anomaly Detection

   C. Lo, J. Christie, T.Y. Win, and 3 more authors

   In Proceedings of the International Conference on Cybersecurity, Situational Awareness and Social Media (Cyber Science 2024), 2025

   DOI HTML PDF

4. 

   Machine Learning and Data Analytics for Cyber Security

   Phil Legg and Giorgio Giacinto

   2025

   HTML PDF
5. gh0stEdit: Exploiting Layer-Based Access Vulnerability Within Docker Container Images

   Alan Mills, Jonathan White, and Phil Legg

   arXiv, 2025

   HTML PDF

2024

1. Privacy-preserving intrusion detection in software-defined VANET using federated learning with BERT

   Shakil Ibne Ahsan, Phil Legg, and SM Alam

   arXiv preprint arXiv:2401.07343, 2024

   HTML

2. 

   Cyber Funfair: Creating Immersive and Educational Experiences for Teaching Cyber Physical Systems Security

   Alan Mills, Jonathan White, and Phil Legg

   In SIGCSE 2024: Proceedings of the 55th ACM Technical Symposium on Computer Science Education, 2024

   HTML

3. 

   Vulnerability detection through machine learning-based fuzzing: A systematic review

   Sadegh Bamohabbat Chafjiri, Phil Legg, Jun Hong, and 1 more author

   Computers & Security, 2024

   HTML

4. 

   Improving Search Space Analysis of Fuzzing Mutators Using Cryptographic Structures

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and 1 more author

   In Proceedings of Ninth International Conference on Cyber Security, Privacy in Communication Networks (ICCS 2023), 2024

   HTML

5. 

   GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range

   Alan Mills, Jonathan White, and Phil Legg

   Journal of Cybersecurity and Privacy, 2024

   HTML PDF

6. 

   Digital twins of cyber physical systems in smart manufacturing for threat simulation and detection with deep learning for time series classification

   Carol Lo, Thu Yein Win, Zeinab Rezaeifar, and 2 more authors

   In 29th International Conference on Automation and Computing (ICAC2024), University of Sunderland, UK, 2024

   HTML

7. 

   Analyst-driven XAI for time series forecasting: Analytics for telecoms maintenance

   James Barrett, Phil Legg, Jim Smith, and 1 more author

   In ACM 9th International Conference on Machine Learning Technologies (ICMLT) 2024, 2024

   HTML

8. 

   Evaluating data distribution strategies in federated learning: A trade-off analysis between privacy and performance for IoT security

   Jonathan White and Phil Legg

   In Proceedings of Ninth International Conference on Cyber Security, Privacy in Communication Networks (ICCS 2023), 2024

   HTML
9. Cyber security unplugged: Teaching security management through immersive gameplay

   Alan Mills, Ian Caple, Phil Legg, and 2 more authors

   In Advances in Teaching and Learning for Cyber Security Education, 2024

   HTML
10. Trends and Challenges in Data Analytics and Machine Learning Using Call Detail Records in Telecom Systems

    James Barrett, Phil Legg, Jim Smith, and 2 more authors

    Preprints, 2024

    HTML PDF

11. 

    Advances in Teaching and Learning for Cyber Security Education

    Phil Legg, Natalie Coull, and Charles Clarke

    2024

    DOI HTML PDF
12. Privacy-Based Triage of Suspicious Activity Reports Using Offline Large Language Models

    Phil Legg, Nicholas Ryder, Samantha Bourton, and 2 more authors

    In Advancements in Cyber Crime Investigations and Modern Data Analytics, 2024

    HTML

2023

1. Federated Learning: Data Privacy and Cyber Security in Edge-Based Machine Learning

   Jonathan White and Phil Legg

   In Data Protection in a Post-Pandemic Society, 2023

   HTML

2. 

   Longitudinal Risk-based Security Assessment of Docker Software Container Images

   Alan Mills, Jonathan White, and Phil Legg

   Computers and Security, 2023

   HTML

3. 

   Improving Search Space Analysis of Fuzzing Mutators Using Cryptographic Structures

   Sadegh Bamohabbat Chafjiri, Phil Legg, Michail-Antisthenis Tsompanas, and 1 more author

   In International Conference on Cyber Security, Privacy in Communication Networks, 2023

   DOI HTML PDF

2022

1. 

   Investigating Malware Propagation and Behaviour Using System and Network Pixel-Based Visualisation

   Jacob Williams and Phil Legg

   SN Computer Science, 2022

   HTML

2. 

   Functionality-preserving adversarial machine learning for robust classification in cybersecurity and intrusion detection domains: A survey

   Andrew McCarthy, Essam Ghadafi, Panagiotis Andriotis, and 1 more author

   Journal of Cybersecurity and Privacy, 2022

   HTML PDF

3. 

   OGMA: visualisation for software container security analysis and automated remediation

   Alan Mills, Jonathan White, and Phil Legg

   In 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022

   HTML

4. 

   Teaching Offensive and Defensive Cyber Security in Schools using a Raspberry Pi Cyber Range

   Phil Legg, Alan Mills, and Ian Johnson

   In Colloquium on Information Systems Security Education (CISSE), 2022

   HTML

5. 

   Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification

   Andrew McCarthy, Essam Ghadafi, Panagiotis Andriotis, and 1 more author

   Journal of Information Security and Applications, 2022

   HTML

6. 

   Interactive cyber-physical system hacking: Engaging students early using Scalextric

   Jonathan White, Phil Legg, and Alan Mills

   In Colloquium on Information Systems Security Education (CISSE), 2022

   HTML

2021

1. 

   Deep Learning-Based Security Behaviour Analysis in IoT Environments: A Survey

   Yawei Yue, Shancang Li, Phil Legg, and 1 more author

   Security and communication Networks, 2021

   HTML

2. 

   Feature vulnerability and robustness assessment against adversarial machine learning attacks

   Andrew McCarthy, Panagiotis Andriotis, Essam Ghadafi, and 1 more author

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

3. 

   “Hacking an IoT Home”: New opportunities for cyber security education combining remote learning with cyber-physical systems

   Phil Legg, Thomas Higgs, Pennie Spruhan, and 2 more authors

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

4. 

   Unsupervised one-class learning for anomaly detection on home IoT network devices

   Jonathan White and Phil Legg

   In 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2021

   HTML

2020

1. The visual design of network data to enhance cyber security awareness of the everyday internet user

   Fiona Carroll, Phil Legg, and Bastian Bønkel

   In 2020 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2020

   HTML
2. Shouting Through Letterboxes: A study on attack susceptibility of voice assistants

   Andrew McCarthy, Benedict R Gaster, and Phil Legg

   In 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020

   HTML
3. “What did you say?”: Extracting unintentional secrets from predictive text learning systems

   Gwyn Wilkinson and Phil Legg

   In 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020

   HTML

4. 

   Investigating anti-evasion malware triggers using automated sandbox reconfiguration techniques

   Alan Mills and Phil Legg

   Journal of Cybersecurity and Privacy, 2020

   HTML PDF

2019

1. What makes for effective visualisation in cyber situational awareness for non-expert users?

   Fiona Carroll, Phil Legg, and Adam Chakof

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   HTML
2. Venue2vec: An efficient embedding model for fine-grained user location prediction in geo-social networks

   Shuai Xu, Jiuxin Cao, Phil Legg, and 2 more authors

   IEEE Systems Journal, 2019

   HTML
3. Tools and techniques for improving cyber situational awareness of targeted phishing attacks

   Phil Legg and Tim Blackman

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   HTML
4. Efficient and interpretable real-time malware detection using random-forest

   Alan Mills, Theodoros Spyridopoulos, and Phil Legg

   In International conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA), 2019

   HTML
5. Visual analytics for collaborative human-machine confidence in human-centric active learning tasks

   Phil Legg, Jim Smith, and Alexander Downing

   Human-centric computing and information sciences, 2019

   HTML PDF

2018

1. Predicting the occurrence of world news events using recurrent neural networks and auto-regressive moving average models

   Emmanuel M Smith, Jim Smith, Phil Legg, and 1 more author

   In Advances in Computational Intelligence Systems: Contributions Presented at the 17th UK Workshop on Computational Intelligence, September 6-8, 2017, Cardiff, UK, 2018

   HTML
2. Visualising state space representations of LSTM networks

   Emmanuel M Smith, Jim Smith, Phil Legg, and 1 more author

   In Workshop on Visualization for AI Explainability (VISxAI), 2018

   HTML
3. Predicting user confidence during visual decision making

   Jim Smith, Phil Legg, Milos Matovic, and 1 more author

   ACM Transactions on Interactive Intelligent Systems (TiiS), 2018

   HTML

2017

1. Human-machine decision support systems for insider threat detection

   Philip A Legg

   Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications, 2017

   HTML
2. RicherPicture: Semi-automated cyber defence using context-aware data analytics

   Arnau Erola, Ioannis Agrafiotis, Jassim Happa, and 3 more authors

   In 2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), 2017

   HTML

2016

1. Automated registration of multimodal optic disc images: clinical assessment of alignment accuracy

   Wai Siene Ng, Phil Legg, Venkat Avadhanam, and 6 more authors

   Journal of Glaucoma, 2016

   HTML
2. Enhancing cyber situation awareness for non-expert users using visual analytics

   Philip A Legg

   In 2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA), 2016

   HTML
3. Glyph visualization: A fail-safe design scheme based on quasi-hamming distances

   Philip A Legg, Eamonn Maguire, Simon Walton, and 1 more author

   IEEE computer graphics and applications, 2016

   HTML
4. Visual Analytics for Non-Expert Users in Cyber Situation Awareness

   Philip A Legg

   Int. J. Cyber Situational Aware., 2016

   HTML

2015

1. Glyph sorting: Interactive visualization for multi-dimensional data

   David HS Chung, Philip A Legg, Matthew L Parry, and 4 more authors

   Information Visualization, 2015

   HTML
2. Identifying attack patterns for insider threat detection

   Ioannis Agrafiotis, Jason RC Nurse, Oliver Buckley, and 3 more authors

   Computer Fraud & Security, 2015

   HTML
3. Knowledge-assisted ranking: A visual analytic application for sports event data

   David HS Chung, Matthew L Parry, Iwan W Griffiths, and 4 more authors

   IEEE Computer Graphics and Applications, 2015

   HTML
4. Using internet activity profiling for insider-threat detection

   Bushra A Alahmadi, Philip A Legg, and Jason RC Nurse

   In Special Session on Security in Information Systems, 2015

   HTML PDF
5. Visualizing the insider threat: challenges and tools for identifying malicious user activity

   Philip A Legg

   In 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), 2015

   HTML
6. Quasi-Hamming distances: An overarching concept for measuring glyph similarity

   Philip A Legg, Eamonn Maguire, Simon Walton, and 1 more author

   Computer Graphics and Visual Computing: Extended Abstract, 2015

   HTML PDF
7. Caught in the act of an insider attack: detection and assessment of insider threat

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and 1 more author

   In 2015 IEEE International Symposium on Technologies for Homeland Security (HST), 2015

   HTML
8. Feature neighbourhood mutual information for multi-modal image registration: an application to eye fundus imaging

   Philip A Legg, Paul L Rosin, Dave Marshall, and 1 more author

   Pattern Recognition, 2015

   HTML
9. Automated insider threat detection system using user and role-based profile assessment

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and 1 more author

   IEEE Systems Journal, 2015

   HTML

2014

1. Systematic snooker skills test to analyze player performance

   David HS Chung, Iwan W Griffiths, Phil A Legg, and 5 more authors

   International Journal of Sports Science & Coaching, 2014

   HTML
2. Reflecting on the ability of enterprise security policy to address accidental insider threat

   Oliver Buckley, Jason RC Nurse, Philip A Legg, and 2 more authors

   In 2014 Workshop on Socio-Technical Aspects in Security and Trust, 2014

   HTML
3. Guest Editorial: Emerging Trends in Research for Insider Threat Detection.

   William R Claycomb, Philip A Legg, and Dieter Gollmann

   J. Wirel. Mob. Networks Ubiquitous Comput. Dependable Appl., 2014

   HTML PDF
4. Understanding insider threat: A framework for characterising attacks

   Jason RC Nurse, Oliver Buckley, Philip A Legg, and 4 more authors

   In 2014 IEEE security and privacy workshops, 2014

   HTML
5. Towards a User and Role-based Sequential Behavioural Analysis Tool for Insider Threat Detection.

   Ioannis Agrafiotis, Philip A Legg, Michael Goldsmith, and 1 more author

   J. Internet Serv. Inf. Secur., 2014

   HTML PDF
6. A critical reflection on the threat from human insiders–its nature, industry perceptions, and detection approaches

   Jason RC Nurse, Philip A Legg, Oliver Buckley, and 6 more authors

   In Human Aspects of Information Security, Privacy, and Trust: Second International Conference, HAS 2014, Held as Part of HCI International 2014, Heraklion, Crete, Greece, June 22-27, 2014. Proceedings 2, 2014

   HTML
7. Deep Focus: Increasing User" Depth of Field" to Improve Threat Detection (Oxford workshop poster)

   William R Claycomb, Roy Maxion, Jason Clark, and 7 more authors

   2014

   HTML
8. Visual analytics of e-mail sociolinguistics for user behavioural analysis

   Philip A Legg, Oliver Buckley, Michael Goldsmith, and 1 more author

   J. Internet Serv. Inf. Secur., 2014

   HTML PDF

2013

1. Force-directed parallel coordinates

   Rick Walker, Philip A Legg, Serban Pop, and 3 more authors

   In 2013 17th International Conference on Information Visualisation, 2013

   HTML
2. Transformation of an uncertain video search pipeline to a sketch-based visual analytics loop

   Philip A Legg, David HS Chung, Matthew L Parry, and 4 more authors

   IEEE transactions on Visualization and Computer Graphics, 2013

   HTML
3. Visual analytics for multivariate sorting of sport event data

   D Chung, P Legg, M Parry, and 4 more authors

   In Workshop on sports data visualization, 2013

   HTML PDF
4. Improving accuracy and efficiency of mutual information for multi-modal retinal image registration using adaptive probability density estimation

   Philip A Legg, Paul L Rosin, David Marshall, and 1 more author

   Computerized Medical Imaging and Graphics, 2013

   HTML
5. Turn costs change the value of animal search paths

   RP Wilson, IW Griffiths, PA Legg, and 5 more authors

   Ecology letters, 2013

   HTML
6. Towards a conceptual model and reasoning structure for insider threat detection

   Philip A Legg, Nick Moffat, Jason RC Nurse, and 4 more authors

   Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, 2013

   HTML PDF
7. Video Visualization

   Rita Borgo, Min Chen, Markus Höferlin, and 4 more authors

   2013

2012

1. Visualizing multiple error-sensitivity fields for single camera positioning

   David HS Chung, Matthew L Parry, Philip A Legg, and 3 more authors

   Computing and Visualization in Science, 2012

   HTML
2. MatchPad: interactive glyph-based visualization for real-time sports performance analysis

   Philip A Legg, David HS Chung, Matthew L Parry, and 4 more authors

   In Computer graphics forum, 2012

   HTML

2011

1. From Video to Animated 3D Reconstruction: A Computer Graphics Application for Snooker Skills Training.

   Philip A Legg, Matthew L Parry, David HS Chung, and 5 more authors

   In Eurographics (Posters), 2011

   HTML
2. Intelligent filtering by semantic importance for single-view 3D reconstruction from Snooker video

   Philip A Legg, Matthew L Parry, David HS Chung, and 5 more authors

   In 2011 18th IEEE international conference on image processing, 2011

   HTML
3. Hierarchical event selection for video storyboards with a case study on snooker video visualization

   Matthew L Parry, Philip A Legg, David HS Chung, and 2 more authors

   IEEE Transactions on Visualization and Computer Graphics, 2011

   HTML

2010

1. Multimodal retinal imaging: Improving accuracy and efficiency of image registration using Mutual Information

   Philip A Legg

   Cardiff University (United Kingdom), 2010

   HTML

2009

1. A robust solution to multi-modal image registration by combining mutual information with multi-scale derivatives

   Philip A Legg, Paul L Rosin, David Marshall, and 1 more author

   In Medical Image Computing and Computer-Assisted Intervention–MICCAI 2009: 12th International Conference, London, UK, September 20-24, 2009, Proceedings, Part I 12, 2009

   HTML
2. Non-rigid elastic registration of retinal images using local window mutual information

   Philip A Legg, Paul L Rosin, David Marshall, and 1 more author

   Proc. Med. Image Understand. Anal. (MIUA 2009), 2009

   HTML

2008

1. Incorporating neighbourhood feature derivatives with mutual information to improve accuracy of multi-modal image registration

   Philip A Legg, Paul L Rosin, David Marshall, and 1 more author

   Proc. Med. Image Understand. Anal. (MIUA 2008), 2008

   HTML PDF

2007

1. Improving accuracy and efficiency of registration by mutual information using Sturges’ histogram rule

   Philip A Legg, Paul L Rosin, David Marshall, and 1 more author

   Proc. Med. Image Understand. Anal. (MIUA 2007), 2007

   HTML