The persistence of phishing is driven by the industrialization of the cybercriminal ecosystem.
Current reactive defenses, such as URL blacklisting, are increasingly insufficient due to the extreme speed of modern campaigns and the widespread use of cloaking techniques.
To address these challenges, this thesis proposes a proactive methodology for phishing kit attribution, shifting the analytical focus from ephemeral webpages to the underlying software infrastructure.

We design a system in which we approach kit attribution as an incremental supervised binary classification problem using separate Random Forest models for each phishing kit family.
Our approach prioritizes the "attacker's view" by modeling phishing kits as hierarchical directory trees and extracting stable filesystem artifacts like the presence of files in particular locations.
Through systematic optimization using the \textit{uAdmin} phishing kit family, we demonstrate that this structural fingerprinting provides near-perfect discriminative power for the data-rich \textit{uAdmin} family.

Stress tests reveal that the system is resilient against some levels of obfuscation and that the model's ranking capability remains intact, even at higher levels of perturbation.
Furthermore, learning curve analysis confirms the system's few-shot capability.

When there are not many discovered samples from a phishing kit family, our results show that appending artificially generated samples of phishing kits to the original samples could contribute to a model's performance.

The practical utility of this methodology was validated through an incremental attribution workflow that has generated 23 models for different phishing kit families, which cover over 2000 phishing kits from our database.
A critical real-world application involving a forensic data dump from a German server seizure allowed us to test this incremental attribution workflow on real operational data.

We practically demonstrate two ways to map live phishing pages to known phishing kits, an approach that is based on the most important paths in phishing kit families and an approach that is based on the network activity of a phishing website.

The primary limitations of this thesis are that the client-side artifacts are not taken into consideration, and that live phishing pages do not always correlate well to paths in a phishing kit.

By registering phishing kits and models for phishing kit families alongside with actionable metadata, this thesis provides a scalable phishing kit intelligence system that could help LEAs toward the structural detection and dismantling of industrialized phishing. ... Read more

Large datasets can today be created with single-cell RNA sequencing (scRNA-seq), allowing researchers to measure RNA expression per cell. In 2026, a new model, Latent Interaction Variational Inference (LIVI), was proposed to analyze these data. LIVI is novel in capturing both cell- and donor-specific variation in the latent space with a Variational Autoencoder (VAE). The research by Vagiaki et al. was primarily focused on discovering expression quantitative trait loci (eQTLs). It is interesting to see how well the cell and donor latent space captures other characteristics, such as treatment success/failure. This research investigates whether the latent spaces of the LIVI model capture major cell types, sub-cell types, and treatment response. A simple classifier (MLP/SVM/Random Forest) was added on top of the latent spaces to evaluate this. Major cell types are clearly distinguishable from the cell latent space C, sub-cell types with a relatively larger class size can be well distinguished in the cell latent space C, and treatment response is partially captured in the DxC space, but not fully separable by a simple classifier. SVM and MLP outperform Random Forest in classifying treatment response. These findings indicate that biologically and clinically relevant information is preserved within the LIVI latent representations. ... Read more

Rheumatoid arthritis (RA) is a heterogeneous autoimmune disease: patients who share the same diagnosis respond differently to the same therapy. Zhang et al. stratified the RA synovium into six cell-type abundance phenotypes (CTAPs) by clustering counted, pre-annotated cell-type abundances. The LIVI model, built on a variational autoencoder developed to map trans-eQTLs in non-diagnosed donors, instead learns donor structure directly from gene expression, separating donor-level variation from cell-state variation. The developers of the model left two questions open: whether LIVI can also capture disease status in a diagnosed cohort, and what the optimal number of donor-level embeddings is for a given dataset. We address these by applying LIVI to a CITE-seq dataset of 314,011 cells from 70 RA and 9 OA donors across four different numbers of donor embeddings. In this research, we show that although LIVI is given no cell-type or diagnostic labels, its donor space recovers the underlying cell-type relationships between the six cell types defining CTAPs: a lymphoid (T, B, NK) versus non-lymphoid (myeloid, endothelial, fibroblast) block, which is consistent across all four dimensions. The CTAPs themselves do not form discretely separable groups in the donor space, but at lower dimensionalities, individual donor factors begin to distinguish them along the same axis. Reading the genes behind these factors was limited. We hypothesize this is due to LIVI's sparsity penalty, which was tuned for detecting trans-eQTLs on a much larger cohort, leaving ribosomal pathways dominating the loadings. Therefore, LIVI's donor space captures disease state information, but on a broader scale compared to Zhang et al.'s discretely defined CTAPs. For this particular dataset, the signal becomes stronger at lower dimensionalities, but the interpretability of the signal is limited. ... Read more

Rheumatoid arthritis (RA) is a highly heritable disease, yet how its genetic risk translates into cell-type-specific mechanisms remains poorly understood. LIVI is a model that decomposes single-cell expression into donor and cell-state latent spaces, allowing for the reconstruction of the original data, but additionally leaving room for analysis of the retained latent information. The model has been shown to recover polygenic risk signals in healthy cohorts, but whether that is transferable to cohorts with active disease has not been tested. In this work, we apply LIVI to a predominantly RA cohort, with osteoarthritis (OA) patients as control, and ask whether the latent factors carry information about polygenic risk. After first confirming that the clinical cohort cell-state space recovers known immune cell populations, we test each of the 700 donor factors against the polygenic risk scores (PRSs) for 21 diseases, under different testing conditions, and find that one significant factor (D462) is recovered between the latent space and RA PRS. This association survives ancestry correction, and changes in cohort. The factor localises to NK and T cells and drives antigen presentation program whose expression seems to be inversely related to RA risk. ... Read more

Single-cell RNA sequencing enables the study of biological processes at high resolution, but the high dimensionality and sparsity of its measurements make downstream analyses, such as expression quantitative trait locus (eQTL) mapping, a difficult task. The Latent Interaction Variational Inference (LIVI) model addresses this challenge by learning low-dimensional interpretable embeddings for the cell-state, donor, and donor-cell-state interaction that can be used as phenotypes for association testing. However, LIVI models only gene-expression measurements and does not exploit information from other modalities, such as surface-protein counts that are included in widely used data collection methods such as CITE-seq. In this work, we investigate how LIVI can be extended to jointly model paired RNA and protein data and whether such an extension improves the biological interpretability of its latent representations. We introduce two architectures. Multimodal Shared-space Latent Interaction Variational Inference (MultiSLIVI) is a conservative extension in which RNA and protein measurements share the original cell-state latent space while being reconstructed through modality-specific decoders. Disentangled Multimodal Latent Interaction Variational Inference (DMLIVI) instead separates the cell-state representation into shared and modality-specific components, incorporating disentanglement principles from multimodal variational autoencoders. The models are evaluated using reconstruction performance, cell-type and donor predictability, latent-space structure, and downstream analysis. Most notably, both MultiSLIVI and DMLIVI recover fewer SNP-factor associations than the original LIVI model, indicating that the current multimodal extensions do not improve the donor-factor phenotypes used for eQTL mapping. Nevertheless, the proposed models provide a first step toward multimodal extensions of LIVI and highlight the importance of separating shared and modality-specific variation in future model designs. ... Read more

Multi-label node classification on graphs occurs in domains where entities can have several labels, such as biological, social, and recommendation networks. Most Graph Neural Networks (GNN) research focuses on multi-class graphs, so it remains unclear how dataset properties affect model performance in multi-label settings. This thesis studies how structural, feature, and label properties influence Graph Convolutional Network (GCN) and Heterophilic Graph Convolutional Network (H2GCN). These models were chosen because they are widely used and represent homophilous and heterophilous graph learning, respectively. Synthetic graphs are used to vary their properties in a controlled way, with real-world datasets used as validation points, and a pooled Ridge regression then tests how well each property predicts model performance in a joint setting. The results show that no single property explains performance solely by itself. Label imbalance reduces both models similarly, structural noise harms GCN more, unlabeled nodes degrade the performance of H2GCN more quickly, and cross-class neighbourhood similarity adds information beyond homophily. All code, seeds, and trained-graph properties are released publicly. ... Read more

Many real-world tasks involve data that is naturally structured as a graph, such as proteins linked by interactions, papers linked by citations, or people connected in a social network. A common goal is to predict properties of each entity based on how it is connected to the rest. The models used for this, called graph neural networks, work by allowing each node to aggregate information from its neighbours, then from its neighbours’ neighbours, and so on.

However, looking too far can blur distant nodes together. A common remedy is to train the model on a random subset of the links and discard the rest, in the hope of preventing it from over-relying on any single part of the graph. This idea was proposed and tested only on the simpler problem in which each entity carries exactly one label. Many real-world problems are not like this. A single protein may participate in multiple biological processes simultaneously, so an effective predictor must assign several labels at once. Whether dropping links still helps in this more realistic multi-label setting has not been studied.

This work addresses that question using synthetic graphs with precisely controlled structure, ranging from strongly clustered to nearly random, as well as three real biological and bibliographic datasets spanning the same range. In almost every case, dropping links harms performance rather than improving it, and the damage increases with the fraction of removed links, with a single weak exception on the most strongly multi-label, lowest-homophily real graph.

The cause is not a flaw in the technique but a property of the multi-label task itself. When multiple labels must be predicted from the same node representation, each label receives only a fraction of the learning signal it would obtain in a single-label setting. Discarding links reduces this already limited signal even further. ... Read more

Automatic test case generation for dynamically typed languages such as JavaScript is significantly hindered by the absence of explicit type information, which expands the search space for search-based testing and reduces its effectiveness. While prior probabilistic and neural type inference methods address this, they struggle with complex user-defined types, higher-order functions, and external package dependencies. This paper presents and evaluates three LLM-based approaches for type inference in JavaScript. The primary contribution is a Retrieval-Augmented Generation (RAG) approach that constructs a vector database of semantically rich code embeddings. These embeddings include ASTs, program slices, and code annotations. This enables efficient, project-wide context retrieval paired with Chain-of-Thought prompting. In a large-scale empirical evaluation against the SynTest framework, the RAG approach achieves a 29% average accuracy improvement over non-RAG LLM approaches, an 85% reduction in computation time, and a 63% accuracy improvement over probabilistic inference for deep, user-defined types. For primitive types, probabilistic methods remain competitive. These findings motivate future hybrid strategies combining probabilistic and LLM-based inference.

https://doi.org/10.5281/zenodo.19496755 Repository link
Replication package of "Retrieval First: LLM- Assisted Type Inference for Automatic Test Case Generation in JavaScript" ... Read more

Grounding Large Language Models (LLMs) in chemical knowledge graphs (KGs) offers a promising way to support synthesis planning, but reliably retrieving information from these complex structures remains a challenge. Therefore, this work addresses that gap by constructing a bipartite KG and evaluating Text2Cypher query generation across both single- and multi-step retrieval tasks. Different prompting strategies were tested, including zero-shot, one-shot with static, random, or embedding-based example selection, and a checklist-driven self-correction pipeline. Results indicate that one-shot prompting is most effective when the exemplar aligns with the query both structurally and logically. When such an exemplar is provided as context to the Cypher generation prompt, self-correction does not yield significant performance gains. Overall, this study introduces a reproducible setup for Text2Cypher experimentation and evaluation. ... Read more

Applying Large Language Models (LLMs) to high-stakes classification tasks like systematic review screening is challenged by prompt sensitivity and a lack of transparency. We introduce IMAPR (Iterative Multi-signal Adaptive Prompt Refinement), a novel framework where a single LLM uses its own internal signals to iteratively refine its prompts, improving classification robustness and reliability. Unlike black-box optimizers that tune the prompts using only external scores, IMAPR is a white-box approach that diagnoses why a prediction failed using three internal signals: model confidence, a rationale, and a knowledge alignment score that checks whether the evidence cited in the rationale actually covers the user-defined inclusion criteria. We evaluate IMAPR on a real-world biomedical screening task, comparing it against strong baselines including GPO and StraGo. IMAPR outperforms the best baseline (GPO) by 8.8% in Macro-F1 while maintaining high, stable recall across runs. Across seven LLMs, IMAPR yields an average 9.2% improvement in Macro-F1 An ablation shows that knowledge-alignment acts as a recall safeguard: removing it leaves Macro-F1 similar but degrades recall, reducing reliability for screening. These results suggest that diagnostic, signal-driven prompt refinement is a practical alternative to black-box optimization for transparent, dependable LLM screening systems. ... Read more

Apache Spark is a popular batch processing framework that is integrated into the ASML data analytics platform. However, having multiple users share the same resources creates fairness and efficiency problems in the scheduler, where some users may receive more resources than others, or the scheduler slows down all jobs equally. Apache Spark provides a built-in fair scheduler that attempts to mitigate these issues, but cannot account for changing user environments and has been shown to slow down overall job execution. Previous literature has already proposed improvements to the Spark fair scheduler, however, it does not account for user contexts to ensure fair resource distribution among users, and does not account for task skews that are present in the Spark ecosystem.


In this work, we present User Weighted Fair Queuing (UWFQ) scheduler that can minimize the response time of jobs in Apache Spark, while ensuring that users are allocated a fair share of resources that they equally distribute among their jobs. This is done by simulating a virtual fair scheduler, and assigning the highest priority to jobs that complete the earliest in the virtual scheduler. The algorithm is an extension to Cluster Fair Queuing designed by C. Chen et al., with an added fairness layer to ensure that each user is entitled to a fair share of resources. To address the problem of task skew present in Spark, we introduce runtime partitioning that can more effectively avoid task skew by splitting them into more partitions. We implement our scheduler in the Apache Spark framework and show that UWFQ with runtime partitioning can decrease the average response time of small jobs by up to 70% in certain workloads, while still providing fair resource allocation in critical scenarios.
... Read more

This thesis presents a comprehensive, heuristic cost-driven framework for optimizing database table configuration in Amazon Redshift focusing on distribution styles, sort keys and column encodings. Unlike existing approaches that treat optimization parameters independently, this research develops a sequential optimization methodology that captures complex interdependencies between configuration choices and their performance impacts across different data scales.

The study addresses four research questions examining individual parameter optimization strategies and their integrated effects on system performance. The experimental evaluation employs two datasets: a primary table containing 300 million data records across 23 columns where optimization is performed, and a secondary join table with 117.5 million data records across 12 columns that remains unchanged. Scale-dependent analysis is conducted using subsets of 10 million and 100 million data records selected from the primary dataset to enable controlled comparison across different data volumes.

Key findings demonstrate that table configuration optimization in Amazon Redshift exhibits pronounced scale-dependent performance characteristics across the experimental datasets, with three distinct performance regimes identified: a small-scale regime (10M data records) characterized by query-type dependent optimization effectiveness, a medium-scale regime (100M data records) showing optimization trade-off transitions, and a large-scale regime (300M data records) dominated by I/O and storage optimizations. The research reveals mixed optimization outcomes, with performance improvements ranging from 21 percent CPU reduction at small scales to 62 percent I/O improvement at large scales, while demonstrating that optimization strategies effective at one scale can become counterproductive at another. Overall, the framework shows variable success in parameter selection for distribution style, sort key and encoding selection.

The research identifies fundamental challenges in optimizing Amazon Redshift table configurations where internal algorithms remain opaque and optimization benefits exhibit non-linear scaling patterns across the tested different data volumes. While the framework provides valuable insights into scale-dependent optimization patterns, the mixed results highlight the complexity of achieving consistent performance improvements across different scales and query types. These findings challenge assumptions about uniform optimization benefits and emphasize the need for empirical validation approaches in cloud database optimization, providing practical insights for database administrators and theoretical foundations for developing adaptive optimization systems. ... Read more

The human gut microbiome has emerged as a key player in health and disease, yet machine learning on microbiome data remains challenging due to its high dimensionality, sparsity, compositionality, and inter-study heterogeneity. Although classical and deep learning methods have demonstrated promise, they often require extensive labeled data, which is rarely available in microbiome research. In this thesis, we investigate whether meta-learning can address these challenges by enabling better generalization from small, heterogeneous microbiome datasets. Specifically, we benchmark Prototypical networks (Protonets), a metric-based, few-shot meta-learning algorithm, against strong classical baselines (Random Forests, XGBoost, and Multi-layer Perceptrons) for disease classification tasks across a selected number of gut microbiome studies. We introduce a unified benchmarking pipeline that standardizes preprocessing, dimensionality reduction, task construction, and evaluation across studies. A leave-one-study-out cross-validation strategy simulates realistic deployment scenarios where only a few labeled samples are available from a new cohort. Our experiments explore the impact of support set size and dimensionality reduction via principal component analysis. Results show that although Protonets offer a conceptually appealing approach for few-shot learning, they consistently underperform compared to Random Forests in classification accuracy. Statistical analyses confirm the significance of this performance gap, and embedding visualizations reveal limited class separation in the learned feature space. These findings suggest that, under the evaluated conditions, classical models like Random Forests remain the more robust choice for microbiome classification in low-data regimes. By offering a rigorous and reproducible evaluation, this work lays the foundation for further exploration of meta-learning in microbiome research and highlights both the potential and current limitations of learning to learn in this complex domain. ... Read more

Data sharing for research and industrial applications faces significant challenges due to privacy constraints and regulatory requirements, driving the need for high-quality synthetic alternatives.
Recent advances in synthetic data generation have demonstrated considerable success for single-table datasets, with emerging research extending these capabilities to multi-table relational scenarios.
While transformer and diffusion architectures achieve state-of-the-art performance in single-table generation, a notable performance gap emerges when applied to relational data, where diffusion approaches consistently outperform transformer-based methods.

This thesis examines the factors contributing to this performance difference, conducting an evaluation using multiple baselines across both single and relational tabular datasets, with REaLTabformer and ClavaDDPM as state-of-the-art transformer- and diffusion-based approaches, respectively.

Our investigation reveals that the performance can mainly be attributed to the inadequate processing of contextual relationships and suboptimal strategies for representing inter-table dependencies in transformer-based models.
To close this gap, we introduce two changes for transformer-based models: layer sharing to enhance parameter utilization and contextual encoding to better preserve the relational structure.
These changes provide insight into the key design principles behind effective synthetic relational data generation using transformer-based models, particularly the need for architectures that account for context and facilitate practical knowledge transfer.
The proposed methods result in substantial performance improvements, with a 1.52-fold improvement in Logistic Detection and a 1.94-fold reduction in the Discriminator Measure metric.
... Read more

Modern data analysis often involves working with large multidimensional datasets. Visualizing this kind of data helps leverage human intuition and pattern recognition to reveal hidden relationships. t-SNE is a widely used tool for creating such visualizations. Despite its popularity, it suffers drawbacks in the form of hard-to-tune parameters with no heuristic for guaranteed best results. Due to the size of the data researchers have to work with, the algorithm can often exceed the available memory and lead to slowdowns and crashes. This paper investigates the behaviour of memory usage with respect to the tunable parameter perplexity and the size of the data. It provides a reliable way for researchers to predict the memory consumption before running the algorithm for the popular openTSNE implementation of t-SNE. In addition, a modification to reduce the peak memory usage of the implementation is presented. Together, these contributions improve the reliability and efficiency of t-SNE pipelines in memory-constrained environments. ... Read more

Data visualisation is an important area of research: as the amount of data keeps increasing, we have to find ways of showcasing this data to provide an intuition for trends and patterns within it. This can be a particular challenge for high-dimensional data, since we cannot perceive it as is. A common approach is to use dimensionality-reduction techniques to bring the high-dimensional data into lower dimensions, which can then be visualised. One such technique is t-distributed Stochastic Neighbour Embedding (t-SNE), which produces good visualisations but struggles with long runtimes. This paper explores the effect of using sampled data instead of the full dataset to produce t-SNE embeddings, reducing the runtime of the algorithm and hence providing visualisations faster. We show that both visually and numerically, uniform random sampling and Poisson disk sampling can result in much faster runtimes while producing similar, or even more meaningful embeddings than the embedding of the entire dataset. ... Read more

Dimensionality reduction techniques, such as t-SNE, are widely used to visualize high-dimensional data and have a crucial role in practical tasks such as biological data exploration, anomaly detection, or clustering large datasets. However, they are highly dependent on hyperparameters or sampling strategies. This paper investigates whether the structural similarity between sampled and full embeddings can be measured using Procrustes analysis by comparing the structural similarity of the embeddings. This work provides a reproducible framework that quantifies the difference between visualizations produced by sampling t-SNE. These insights provide users a medium to create visualizations with t-SNE without exhaustive experimentation (for example, creating all visualizations), making t-SNE more accessible and reliable. ... Read more

Visualizing high-dimensional data is a key challenge in modern data analysis. T-distributed Stochastic Neighbor Embedding (t-SNE) is a popular nonlinear dimensionality reduction technique that maps such data into a low-dimensional embedding while preserving local relationships. A critical hyperparameter in t-SNE is perplexity. Choosing an appropriate value of perplexity for a particular use-case is non-trivial, especially for large datasets, where repeated t-SNE computations become computationally prohibitive. To mitigate this, the sample-based approach runs t-SNE twice: first on a downsampled subset of the data and then on the full dataset. This introduces two perplexity parameters: sample perplexity for the first run and full perplexity for the second run.

In this work, we systematically investigate the impact of varying combinations of sample perplexity and full perplexity on the quality of the final t-SNE embedding. Our findings show that sample perplexity predominantly determines the global layout of the embedding, while full perplexity influences local refinement. We also compare our approach with different strategies for choosing perplexity values, and find that while some offer better preservation of structural details, they provide less flexibility. ... Read more

T-SNE is widely used for visualising high-dimensional data in lower dimensions.
To reduce the costs of parameter optimisation, t-SNE is performed on a sample of the original data. After sampling the points, the distances between them need to be calculated, which is expensive due to the high dimensionality of the data. We apply Dijkstra's algorithm to approximate the distances and similarities between the sampled points. This reduces the algorithm's execution time by up to 40% without degrading the quality of the projections. ... Read more

This project investigates the design process of a straightforward, user-friendly interface that enables cooperative storytelling between a person with dementia and a family member, through the mediation of a social robot. Due to ethical constraints, evaluation was conducted only with a medical specialist and HCI students. Low cognitive load, sequential navigation, and multimodal visuals are given top priority in the final prototype. Working without direct user input and striking a balance between functionality and simplicity were two major obstacles. The project contributes to the development of supportive, dementia-friendly human-robot interfaces and provides a basis for future testing with individuals who have dementia. ... Read more