Malware Analysis and Detection with Explainable Machine Learning

Malware detection is one of the areas where machine learning is successfully employed due to its high discriminating power and the capability of identifying novel variants of malware samples. Typically, the problem formulation is strictly correlated to the use of a wide variety of features covering several characteristics of the entities to classify. Apparently, this practice allows achieving considerable detection performance. However, it hardly permits us to gain insights into the knowledge extracted by the learning algorithm, causing two main issues. First, detectors might learn spurious patterns; thus, undermining their effectiveness in real environments. Second, they might be particularly vulnerable to adversarial attacks; thus, weakening their security. These concerns give rise to the necessity to develop systems that are tailored to the specific peculiarities of the attacks to detect. Within malware detection, Android ransomware represents a challenging yet illustrative domain for assessing the relevance of this issue. Ransomware represents a serious threat that acts by locking the compromised device or encrypting its data, then forcing the device owner to pay a ransom in order to restore the device functionality. Attackers typically develop such dangerous apps so that normally-legitimate components and functionalities perform malicious behaviour; thus, making them harder to be distinguished from genuine applications. In this sense, adopting a well-defined variety of features and relying on some kind of explanations about the logic behind such detectors could improve their design process since it could reveal truly characterising features; hence, guiding the human expert towards the understanding of the most relevant attack patterns. Given this context, the goal of the thesis is to explore strategies that may improve the design process of malware detectors. In particular, the thesis proposes to evaluate and integrate approaches based on rising research on Explainable Machine Learning. To this end, the work follows two pathways. The first and main one focuses on identifying the main traits that result to be characterising and effective for Android ransomware detection. Then, explainability techniques are used to propose methods to assess the validity of the considered features. The second pathway broadens the view by exploring the relationship between explainable machine learning and adversarial attacks. In this regard, the contribution consists of pointing out metrics extracted from explainability techniques that can reveal models' robustness to adversarial attacks, together with an assessment of the practical feasibility for attackers to alter the features that affect models' output the most. Ultimately, this work highlights the necessity to adopt a design process that is aware of the weaknesses and attacks against machine learning-based detectors, and proposes explainability techniques as one of the tools to counteract them

Innovation and new venture creation

[SPA] Crear lo "nuevo" para resolver problemas es una hazaña incierta. Aun así, el ser humano ha innovado y aplicado el ingenio durante milenios, llegando a crear nuevas herramientas, puentes y empresas, a pesar de la falta de recursos o de claridad en los objetivos. En este sentido, el problema de la asimetría de información (cómo se desplegará el futuro) y de la asimetría de recursos (de qué medios se dispondrá) motivó esta tesis. En particular, el problema de cómo los emprendedores crean nuevos emprendimientos e innovan bajo la incertidumbre y sin objetivos iniciales claros. Esta tesis pretende contribuir a la comprensión de la innovación y la creación de nuevos emprendimientos utilizando una lógica no predictiva (effectuation) y métodos ágiles (utilizados por las aceleradoras de startups) como principios orientadores de esta discusión. Effectuation es una lógica común aplicada por los emprendedores expertos para resolver los problemas típicos de la innovación y creación de nuevas empresas. Se trata de una heurística de control no predictiva que los emprendedores ponen en práctica a través de cinco principios de acción effectual al abordar las incertidumbres y sorpresas en la creación de nuevos productos, servicios o mercados: 1) Principio de "pájaro en mano": construyen un nuevo emprendimiento no necesariamente con un objetivo en mente, sino partiendo de sus propios medios y recursos (quiénes son, qué saben, a quienes conocen), 2) Principio de "pérdida asequible": no hacen grandes apuestas con la expectativa de obtener grandes beneficios, sino que evalúan las oportunidades en función de las desventajas aceptables, 3) Principio de "colcha loca": reducen la incertidumbre formando asociaciones y obteniendo compromisos iniciales en las primeras fases de sus nuevas empresas, 4) Principio de la “limonada”: aprovechan las contingencias en lugar de rechazarlas, permaneciendo flexibles y adaptando sus proyectos según sea necesario, 5) Principio del “piloto en el avión”: se centran en controlar lo que sea controlable en su entorno, entendiendo que el futuro no se encuentra ni se predice, sino que se hace a través de la acción humana. Las aceleradoras y los métodos ágiles activan los principios effectual a través de herramientas y prescripciones que reducen sistemáticamente las inversiones mientras se crea un nuevo emprendimiento. Las aceleradoras promueven ampliamente los métodos ágiles (por ejemplo, el modelo de desarrollo de clientes, los sprints de diseño, el ciclo de innovación rápida) para construir prototipos y primeras versiones de productos y servicios mientras se descubren los clientes y partners iniciales. Además, reduce el riesgo para los inversores en todas las fases de crecimiento de las startups al validar la idea del emprendimiento y aclarar qué recursos serán necesarios. En este sentido, esta tesis examinó si, y en qué medida, los emprendedores construyen nuevas empresas utilizando effectuation y métodos ágiles mediante la creación de tres innovaciones reales con aplicaciones en el mundo real. Los tres casos eran pruebas de concepto implementadas en contextos del mundo real con el objetivo explícito de lanzar Productos Mínimos Viables (Minimum Viable Products, MVP) pero bajo incertidumbre y con ambigüedad de objetivos sobre su funcionalidad. Las tres aplicaciones eran soluciones tecnológicas a problemas de congestión del tráfico, pandemias y confianza en las transacciones digitales. La aplicación 1, "Lemur", es una aplicación edge para el control del tráfico; la aplicación 2, "Dolphin", un sistema de geolocalización basado en sensores e Internet de las Cosas (Internet of Things, IoT) aplicado para el control de pandemias y la aplicación 3, "Crypto Degrees", una solución basada en blockchain para verificar títulos universitarios. En todas las etapas del desarrollo de cada aplicación, los equipos implicados la abordaron de forma emprendedora/eficaz, afrontando las incertidumbres y emprendiendo acciones para comprometerse con múltiples partes interesadas al tiempo que apalancaban las contingencias. Tras implementar las tres soluciones y analizar sus resultados e impacto, los tres casos validaron las predicciones teóricas de que, aplicando principios effectual de forma ágil, se pueden crear nuevos emprendimientos de forma emprendedora e innovadora. [ENG] Creating the "new" to solve problems is an uncertain feat. Still, humans have innovated and applied Ingenium for millennia, eventually creating new tools, bridges, and ventures, despite a lack of resources or clarity of objectives. In this sense, the problem of information asymmetry (how the future will deploy) and resource asymmetry (what means will be available) motivated this thesis. In particular, the problem of how entrepreneurs create new ventures and innovate under uncertainty and without clear initial goals. This thesis aims to contribute to understanding innovation and the creation of new ventures using a non-predictive logic (effectuation) and agile methods (used by startup accelerators) as guiding principles of this discussion. Effectuation is a common logic applied by expert entrepreneurs to solve the typical problems of starting new ventures and innovating. It is a non-predictive control heuristics entrepreneurs operationalize through five principles of effectual action while addressing the uncertainties and contingencies in creating new products, services or markets: 1) Bird-in-hand principle: they build a new venture not necessarily with a goal in mind, but starting with their own means and resources (who they are, what they know, who they know), 2) Affordable loss principle: they do not place large bets with the expectation of high returns, but rather assess opportunities based on acceptable downsides, 3) Crazy quilt principle: they reduce uncertainty by forming partnerships and gaining initial commitments early in their new ventures, 4) Lemonade principle: they leverage contingencies instead of rejecting them, remaining flexible and adapting their projects as required, 5) Pilot in the plane principle: they focus on controlling whatever is controllable in their environment, understanding that the future is not found or predicted, but it is made through human action. Accelerators and agile methods activate the effectual principles through tools and prescriptions that systematically reduce investments while creating a new venture. Accelerators extensively promote "agile" methods (e.g., customer development model, design sprints, rapid innovation cycle) to build prototypes and early versions Effectuation is a common logic applied by expert entrepreneurs to solve the typical problems of starting new ventures and innovating. It is a non-predictive control heuristics entrepreneurs operationalize through five principles of effectual action while addressing the uncertainties and contingencies in creating new products, services or markets: 1) Bird-in-hand principle: they build a new venture not necessarily with a goal in mind, but starting with their own means and resources (who they are, what they know, who they know), 2) Affordable loss principle: they do not place large bets with the expectation of high returns, but rather assess opportunities based on acceptable downsides, 3) Crazy quilt principle: they reduce uncertainty by forming partnerships and gaining initial commitments early in their new ventures, 4) Lemonade principle: they leverage contingencies instead of rejecting them, remaining flexible and adapting their projects as required, 5) Pilot in the plane principle: they focus on controlling whatever is controllable in their environment, understanding that the future is not found or predicted, but it is made through human action. Accelerators and agile methods activate the effectual principles through tools and prescriptions that systematically reduce investments while creating a new venture. Accelerators extensively promote "agile" methods (e.g., customer development model, design sprints, rapid innovation cycle) to build prototypes and early versions of products and services while discovering the initial customers and partners. Additionally, it reduces the risk for investors across all startup growth phases by validating the venture idea and clarifying what resources will be required. In this sense, this thesis examined whether and to what extent entrepreneurs build new ventures using effectuation and agile methods by creating three actual innovations with real-world applications. The three cases were proofs of concept implemented in real-world contexts with the explicit goal of launching Minimum Viable Products (MVPs) but under uncertainty and with ambiguity of objectives about its functionality. The three applications were technological solutions to problems of traffic congestion, pandemics, and trust in digital transactions. Application 1, "Lemur," is an edge application for traffic control; application 2, "Dolphin," an Internet of Things (IoT)-based geolocation system applied for pandemic control and application 3, "Crypto Degrees," a blockchainbased solution to verify university degrees. In all stages of each application development, the teams involved approached it in an entrepreneurial/effectual way, facing uncertainties and engaging in actions to engage with multiple stakeholders while leveraging contingencies. After implementing the three solutions and analyzing their results and impact, the three cases validated the theoretical predictions that by applying effectual principles in an agile form, new ventures can be created in an entrepreneurial, innovative way.Escuela Internacional de Doctorado de la Universidad Politécnica de CartagenaUniversidad Politécnica de CartagenaPrograma Doctorado en Tecnologías de la Información y las Comunicacione

Digitale Transformation aus unternehmensübergreifender Perspektive: Management der Koevolution von Plattformbesitzern und Komplementoren in Plattformökosystemen

Digital platforms have the potential to transform how organizations are doing business in their respective ecosystems. Motivated by this transformation, the purpose of this thesis is to increase the understanding of digital transformation from an inter-organizational perspective. Therefore, this thesis clarifies the phenomenon of digital transformation, and models and analyzes multiple digital platform ecosystems. Building upon that, this dissertation reflects on multiple case studies on how platform owners can manage the co-evolution of their complementors in digital transformations in digital platform ecosystems.Digitale Plattformen haben das Potential, die Art und Weise, wie Unternehmen in ihren jeweiligen Ökosystemen Geschäfte machen, zu verändern. Motiviert durch diese Transformation, ist das Ziel dieser Arbeit, das Verständnis von digitaler Transformation aus einer inter-organisatorischen Perspektive zu erhöhen. Daher erläutert diese Arbeit das Phänomen der digitalen Transformation, und modelliert und analysiert mehrere digitale Plattformökosysteme. Darauf aufbauend reflektiert diese Dissertation in mehreren Fallstudien darüber, wie Plattformbesitzer die Koevolution ihrer Komplementoren in digitalen Transformationen in digitalen Plattformökosystemen steuern können

Community-Oriented Policing and Technological Innovations

Community-Oriented Policing; Police Studies; Policing and Technology; Predictive Policing; Policing Innovations; Crime Prevention and Intervention; Crime Detection; Fear of Crime; Urban Securit

Project report : Requirements specification

The SAMRISK project “Sharing incident and threat information for common situational understanding“ (INSITU) commenced in May 2019. The INSITU project develops solutions for establishing a common situational understanding in complex operations requiring collaboration between several agencies. This involves systematic analysis of existing information sources and defining the information elements that are critical to share in different phases of a crisis situation. In addition, the project will develop procedures and related tool support for efficient collection and integration of information. As part of this work, the project contributes to harmonisation of terminology across agencies to secure effective communication. A map-based interface for display of information from different digital map resources will be developed, as a basis for a common operational picture (COP). This solution will also support evaluation and learning from incidents and emergency exercises. Based on a review of related research, the report briefly summarises the state of the art for the areas focused in the project. Through interviews and discussions with emergency stakeholders, field observation during an exercise, and field visits at operations centres, current practice for information sharing and establishing a COP is analysed. Based on the expressed needs from the emergency stakeholders and our analysis of current practice, the report specifies a set of requirements for information sharing, harmonisation of terminology, use of common map resources, and technology support for evaluation and learning from incidents.publishedVersio

Mechanisms Driving Digital New Venture Creation & Performance: An Insider Action Research Study of Pure Digital Entrepreneurship in EdTech

Digitisation has ushered in a new era of value creation where cross border data flows generate more economic value than traditional flows of goods. The powerful new combination of digital and traditional forms of innovation has seen several new industries branded with a ‘tech’ suffix. In the education technology sector (EdTech), which is the industry context of this research, digitisation is driving double-digit growth into a projected $240 billion industry by 2021. Yet, despite its contemporary significance, the field of entrepreneurship has paid little attention to the phenomenon of digital entrepreneurship. As several scholars observe, digitisation challenges core organising axioms of entrepreneurship, with significant implications for the new venture creation process in new sectors such as EdTech. New venture creation no longer appears to follow discrete and linear models of innovation, as spatial and temporal boundaries get compressed. Given the paradigmatic shift, this study investigates three interrelated themes. Firstly, it seeks to determine how a Pure Digital Entrepreneurship (PDE) process develops over time; and more importantly, how the journey challenges extant assumptions of the entrepreneurial process. Secondly, it strives to identify and theorise the deep structures which underlie the PDE process through mechanism-based explanations. Consequently, the study also seeks to determine the causal pathways and enablers which overtly or covertly interrelate to power new venture emergence and performance. Thirdly, it aims to offer practical guidelines for nurturing the growth of PDE ventures, and for the development of supportive ecosystems. To meet the stated objectives, this study utilises an Insider Action Research (IAR) approach to inquiry, which incorporates reflective practice, collaborative inquiry and design research for third-person knowledge production. This three-pronged approach to inquiry allows for the enactment of a PDE journey in real-time, while acquiring a holistic narrative in the ‘swampy lowlands’ of new venture creation. The findings indicate that the PDE process is differentiated by the centrality of digital artifacts in new venture ideas, which in turn result in less-bounded processes that deliver temporal efficiencies – hence, the shorter new venture creation processes than in traditional forms of entrepreneurship. Further, PDE action is defined by two interrelated events – digital product development and digital growth marketing. These events are characterised by the constant forking, merging and termination of diverse activities. Secondly, concurrent enactment and piecemeal co-creation were found to be consequential mechanisms driving temporal efficiencies in digital product development. Meanwhile, data-driven operation and flexibility combine in digital growth marketing, to form higher order mechanisms which considerably reduce the levels of task-specific and outcome uncertainties. Finally, the study finds that digital growth marketing is differentiated from traditional marketing by the critical role of algorithmic agencies in their capacity as gatekeepers. Thus, unlike traditional marketing, which emphasises customer sovereignty, digital growth marketing involves a dual focus on the needs of human and algorithmic stakeholders. Based on the findings, this research develops a pragmatic model of pure digital new venture creation and suggests critical policy guidelines for nurturing the growth of PDE ventures and ecosystems

Ecosystem synergies, change and orchestration

This thesis investigates ecosystem synergies, change, and orchestration. The research topics are motivated by my curiosity, a fragmented research landscape, theoretical gaps, and new phenomena that challenge extant theories. To address these motivators, I conduct literature reviews to organise existing studies and identify their limited assumptions in light of new phenomena. Empirically, I adopt a case study method with abductive reasoning for a longitudinal analysis of the Alibaba ecosystem from 1999 to 2020. My findings provide an integrated and updated conceptualisation of ecosystem synergies that comprises three distinctive but interrelated components: 1) stack and integrate generic resources for efficiency and optimisation, 2) empower generative changes for variety and evolvability, and 3) govern tensions for sustainable growth. Theoretically grounded and empirically refined, this new conceptualisation helps us better understand the unique synergies of ecosystems that differ from those of alternative collective organisations and explain the forces that drive voluntary participation for value co-creation. Regarding ecosystem change, I find a duality relationship between intentionality and emergence and develop a phasic model of ecosystem sustainable growth with internal and external drivers. This new understanding challenges and extends prior discussions on their dominant dualism view, focus on partial drivers, and taken-for-granted lifecycle model. I propose that ecosystem orchestration involves systematic coordination of technological, adoption, internal, and institutional activities and is driven by long-term visions and adjusted by re-visioning. My analysis reveals internal orchestration's important role (re-envisioning, piloting, and organisation architectural reconfiguring), the synergy and system principles in designing adoption activities, and the expanding arena of institutional activities. Finally, building on the above findings, I reconceptualise ecosystems and ecosystem sustainable growth to highlight multi-stakeholder value creation, inclusivity, long-term orientation and interpretative approach. The thesis ends with discussing the implications for practice, policy, and future research.Open Acces

Safety and Reliability - Safe Societies in a Changing World

The contributions cover a wide range of methodologies and application areas for safety and reliability that contribute to safe societies in a changing world. These methodologies and applications include: - foundations of risk and reliability assessment and management - mathematical methods in reliability and safety - risk assessment - risk management - system reliability - uncertainty analysis - digitalization and big data - prognostics and system health management - occupational safety - accident and incident modeling - maintenance modeling and applications - simulation for safety and reliability analysis - dynamic risk and barrier management - organizational factors and safety culture - human factors and human reliability - resilience engineering - structural reliability - natural hazards - security - economic analysis in risk managemen

Strategizing in the new normal : implications of digitalization for strategizing and uncertainty : philosophical and managerial considerations

Something fundamental is changing – or is it? The firms are preoccupied by transformations and disruptions, the scholars are reassessing the validity of old theories, the politicians are wondering where the power is, and the individuals are struggling to understand how to go about making a living tomorrow. Has this always been the normal, or are we evidencing an era that can rightfully be called a New Normal? This research is an attempt to synthetize knowledge from several rich sources in order to understand the drivers of the changes emerging from the phenomenon labelled digitalization. The research quandary of this conceptual monograph is the impact of digitalization – as a sociotechnical trinity of digital technological systems, humans and perceptions – on strategizing, the individual level actions and decisions tackling the fundamental uncertainty of anything future-oriented, subsequently coalescing into collective level outcomes. This research explores the constitutions of strategizing, uncertainty and digitalization in order to understand the impact of the drivers of digitalization on the constitution of uncertainty dealt with in strategizing, and the subsequent changes therefore reflected on strategizing. Tracing these ripples requires reconceptualizing uncertainty as consisting of three dimensions: lack of knowledge, difficulty of choosing between diverse standards of desirability, and the infathomability of the meaning making mechanisms that underpin the creation of those standards of desirability. As findings, this dissertation presents three theses: first, digitalization obliterates one type of uncertainty, while changing and enforcing other types; secondly, digitalization erodes the boundaries of extant entities and creates new boundary forming mechanisms; and thirdly, digitalization changes the shape and impact of what we take for granted, consider normal – the doxa. These findings have implications for both the theorists and the practitioners. As scholars, we need to redefine such units of analysis, as heretofore captured by concepts like the firm, market or nation. As practitioners, we need to cherish such rationalities that do not compete with the algorithmic intelligence, to emphasize such creative thinking a machine cannot do. As individuals, we need to understand how many of our actions are grounded on the unreflective acceptance of what we take for granted, and how susceptible our notion of normal is to manipulation. Together, we need to understand that the digital representation of reality, being constructed today to give the shape for our tomorrow, reflects not only the physical entities datafied and digitized, but also our values and preferences – whether we reflectively acknowledge them or not.Elämme perustavanlaatuisen muutoksen aikaa – vai elämmekö? Yritykset keskittyvät disruptioihin ja muutoksiin, tutkijat arvioivat vanhojen teorioiden kykyä selittää uusia ilmiöitä, poliitikot pohtivat vallan uusia muotoja ja yksilöt taistelevat huomisen toimeentulon kanssa. Onko tämä ollut aina yhtä normaalia, vai elämmekö aikaa, jota voimme rehellisesti kutsua uudeksi normaaliksi? Tämä tutkimus pyrkii yhdistämään rikasta, olemassaolevaa tietoa monista lähteistä luodakseen ymmärrystä digitalisaatioksi kutsutun ilmiön synnyttämien muutosten ajureista. Tämän teoreettisen monografian tutkimusalue on digitalisaation – digitaalisten teknologisten systeemien, ihmisten ja oletusten muodostaman sosioteknisen kolmiyhteyden – vaikutus strategiointiin, eli tulevaisuuteen elimellisesti liittyvän epävarmuuden käsittelyyn sellaisella yksilötason toiminnalla ja päätöksenteolla, joka yhdistyy kollektiivisen tason lopputuloksiksi. Tämä tutkimus perehtyy strategioinnin, epävarmuuden ja digitalisaation luonteeseen selvittääkseen digitalisaation ajurien vaikutusta strategioinnissa käsiteltävään epävarmuuteen, ja siitä syntyviin muutoksiin strategioinnissa. Tämän vaikutusketjun ymmärtäminen vaatii epävarmuuden uutta konseptualisointia: epävarmuus muodostuu kolmesta ulottuvuudesta, jotka ovat tiedon puute, eri arvoskaalojen välillä valitsemisen vaikeus, sekä niiden merkityksen muodostamismekanismien hahmottomuus, joista arvoskaalamme kumpuavat. Tämän kirjan tulokset muodostavat kolme väitöstä: ensinnäkin, digitalisaatio tuhoaa yhden epävarmuuden tyypin ja muuttaa sekä vahvistaa muita; toiseksi, digitalisaatio haurastuttaa olemassa olevien entiteettien rajoja ja synnyttää uusia rajanmuodostusmekanismeja; ja kolmanneksi, digitalisaatio muuttaa itsestäänselvänä ja normaalina pitämiemme asioiden muotoa ja vaikutusta. Näillä tuloksilla on niin teoreettisia kuin käytännönkin vaikutuksia. Tutkijoina meidän on uudelleen määriteltävä sellaisia analyysin yksiköitä kuten yritys, markkina tai valtio. Yritystoiminnan harjoittajina meidän on vaalittava sellaista rationaalisuutta, mihin algoritminen äly ei kykene, painotettava luovaa ajattelua. Yksilöinä meidän on ymmärrettävä miten iso osa toiminnastamme perustuu itsestäänselvyyksinä pitämiimme asioihin ja miten helposti käsitystämme normaalista voidaan manipuloida. Yhdessä, meidän on ymmärrettävä, että tänään muodostumassa oleva, huomistamme muovaava digitaalinen todellisuuden representaatio heijastelee, paitsi fyysisen maailman digitaaliseksi dataksi muunnettuja entiteettejä, myös arvojamme ja preferenssejämme – riippumatta siitä, tiedostammeko ja tunnistammeko ne vai emme