Bachelor and Master Theses

Background

AI-assisted threat modeling is often evaluated by comparing generated threats with a reference threat model. Such evaluations depend on the quality of the reference: relevant threats may be missing, some entries may lack support in the system description, and different formulations may describe the same issue. This thesis examines how evidence from system descriptions can be used to assess the quality of reference threat models and make evaluations of AI-generated threats more reliable.

Research questions

RQ1: What kinds of quality issues can be found when reference threat statements are checked against system descriptions?

RQ2: How might these issues affect the interpretation of differences between AI-generated threats and the reference?

Methodology

1. Review relevant literature on threat modeling, evaluation references, and source evidence.

2. Prepare a manageable selection of public or research-accessible cyber-physical or smart-system descriptions and document evidence related to threat statements.

3. Support a controlled AI-assisted analysis and compare generated statements with reference statements using an approach developed and justified during the thesis.

4. Discuss disputed cases and uncertainty with the supervisor. Final reference decisions and interpretation of the overall EVI-REF study remain with the project researcher.

Expected outcomes

-A documented collection of selected cases and source-linked threat records, subject to source permissions.

-A transparent comparison of AI-generated and reference threats, including an account of reference quality issues and uncertain cases.

-A thesis report explaining the chosen method, findings, limitations, and implications for evaluating AI-assisted threat modeling.

Interest in cybersecurity and empirical evaluation;
Familiarity with threat modeling or STRIDE and basic data handling is helpful.