I vincitori del Premio Tesi
21a Edizione - Tesi del 2025
Andrea Bissoli
tesi triennale
Università degli Studi di Trento
Dipartimento di Ingegneria e Scienza dell'Informazione
Titolo della tesi
“PILLAR: an LLM-based Privacy Threat Modeling tool”
Relatore
Silvio Ranise, Majid Mollaeefar
Abstract
Privacy threat modeling frameworks like LINDDUN offer structured methodologies to systematically identify and address privacy risks but require substantial manual effort, domain knowledge, and can be prone to error. To ease their adoption, in this thesis we introduce PILLAR (Privacy risk Identification with LINDDUN and LLM Analysis Report), a new tool which integrates Large Language Models (LLMs) with the LINDDUN methodology, in order to streamline and enhance privacy threat modeling by automating significant aspects such as Data Flow Diagram (DFD) generation, threat categorization, and risk prioritization. In particular, PILLAR GO, the tool’s implementation of LINDDUN GO, addresses the current lack of automated support for collaborative privacy threat modeling, emphasizing structured group-based analysis carried out by LLMs. This thesis first outlines the structure of the PILLAR tool, detailing its design and functionalities. Additionally, it presents the results of carried-out benchmarks on the effectiveness of PILLAR GO, examining how multi-agent conversational LLMs can replicate the dynamics of real-world collaborative sessions, while also addressing key challenges such as coordination between agents, consistency in reasoning, and contextual understanding. This evaluation highlights both the potential and current limitations of using multi-agent LLM systems to enhance the process of privacy threat elicitation. We evaluate both single-agent and multi-agent modes and compare the performance of a plethora of models, including both local and proprietary cloud-hosted ones. Our results demonstrate that multi-agent configurations, by simulating real-world collaborative threat modeling sessions, can enhance the accuracy and comprehensiveness of privacy threat elicitation provided by LLMs. Additionally, we observe that locally hosted models can achieve comparable results to their cloud-hosted counterparts, offering viable options for improved data sovereignty. This thesis not only presents an overview of PILLAR and its capabilities, but also shows the evaluation process performed, which highlights PILLAR’s potential in reducing manual workload and enhancing privacy- by-design practices and contributes a novel benchmark methodology to systematically evaluate and compare LLM capabilities in privacy threat modeling. This thesis is based on the work conducted during my internship at Fondazione Bruno Kessler (FBK). I was personally involved in PILLAR’s design and development, as well as devising the bench- marking methodology and performing the benchmark evaluation.
Giuseppe Nonni
tesi magistrale
Sapienza - Università di Roma
Cybersecurity
Titolo della tesi
“A Standardized Framework for Cyber Risk Assessment Across the Lifecycle of Space Projects: Methodology and Automated Tool Development”
Relatore
Marco Angelini
Abstract
Risk assessment is a fundamental component of space mission planning and operation, ensuring the identification, analysis, and mitigation of threats across all project phases. However, current risk assessment methodologies often lack standardization, leading to inefficiencies and inconsistencies, particularly when comparing risks across different projects. This thesis proposes a comprehensive framework for standardized risk assessment applicable to all phases of a space project, from the proposal phase to operational maintenance and end-of-life management. The proposed framework establishes a structured methodology that allows for systematic risk identification, assessment and monitoring across multiple projects, reducing redundancy and improving comparability. Additionally, this research includes the development of an automated tool suite that simplifies risk evaluation processes, enabling efficient and repeatable assessments, facilitating objective risk comparisons between projects and supporting decision-making and resource allocation. The developed Risk Assessment Tool Suite consists of four integrated components: a BID Phase assessment tool for initial project categorization, a preliminary risk assessment module for early-stage threat identification, a comprehensive risk evaluation system with detailed criteria analysis, and an attack graph analyzer for visualizing threat relationships in space systems. Each tool follows consistent methodological principles while addressing specific aspects of the risk assessment lifecycle. Through this approach, the thesis aims to enhance risk governance in the space sector, ensuring consistency, efficiency, and traceability in risk management activities. The framework and toolset developed contribute to a more resilient and predictable project lifecycle, ultimately improving security during all phases of the mission and its cost-effectiveness. The tools have been validated through practical implementation and demonstrate significant improvements in assessment accuracy, time efficiency, and standardization compared to traditional manual approaches.
Edoardo Allegrini
tesi magistrale
Sapienza - Università di Roma
Dipartimento di Informatica
Titolo della tesi
“DecompilerAI: From Raw Decompiler Output to Actionable Intelligence in Stripped Executable Analysis with LLMs”
Relatore
Angelo Spognardi
Abstract
Reverse engineering stripped binaries is a cornerstone of cybersecurity, crucial for malware analysis and vulnerability discovery. However, the decompilation process, while restoring program structure, results in a significant loss of semantic information. Modern decompilers like Ghidra and IDA Pro produce code with generic identifiers and incomplete type information, imposing a substantial cognitive burden on analysts. While recent advancements using Large Language Models (LLMs) have shown promise in recovering semantics, they predominantly operate at the level of individual functions, failing to capture the interprocedural context essential for understanding complex, real-world software. This thesis introduces DecompilerAI, an end-to-end framework that systematically reconstructs local and global semantic context to enhance decompiled code with LLMs. This work makes four primary contributions. First, it presents a novel method for interprocedural context reconstruction that analyzes function-call relationships and data flows across the entire program to provide LLMs with a holistic understanding. Second, it develops an integrated semantic recovery pipeline that unifies variable renaming, type inference, and function name prediction. This pipeline is orchestrated by a dependency-aware scheduling mechanism, enabling a 'Progressive Understanding' approach where enriched semantics from callee functions are propagated to their callers. Third, the framework is implemented as a practical, modular, and containerized tool designed for real-world analysis workflows. Fourth, its effectiveness is demonstrated through a comprehensive evaluation on a diverse dataset of real-world binaries. Experiments involving four different LLMs show that providing rich, program-wide context enables general-purpose models like Gemini 2.5 to significantly outperform specialized, fine-tuned state-of-the-art models such as ReSym in generating semantically faithful variable names (68% vs. 53% semantic similarity with the source code). Ablation studies further confirm that both interprocedural context and progressive understanding provide measurable improvements in semantic recovery accuracy. By shifting the focus from isolated functions to whole program analysis, DecompilerAI offers a robust and scalable solution to bridge the semantic gap in binary analysis, transforming raw decompiler output into actionable intelligence.
Francesco Balassone
tesi magistrale
Università degli Studi di Napoli Federico II
Dipartimento di Ingegneria Elettrica e Tecnologie dell'Informazione
Titolo della tesi
“Cybersecurity AI (CAI): Design and Evaluation of Agentic Cybersecurity in Attack/Defense CTFs”
Relatore
Simon Pietro Romano, Gaetano Perrone, Víctor Mayoral-Vilches
Abstract
The evolution of agentic artificial intelligence (AI) is transforming cybersecurity, yet the difference in effectiveness of AI between offensive versus defensive roles remains underexplored. This thesis evaluates AI agents in Attack/Defense Capture The Flag (CTF) scenarios, where teams of agents compete against each other in live adversarial environments. Using Hack The Box (HTB)’s Battlegrounds platform, we deployed Cybersecurity AI (CAI) agents to assess their performance. Initially, defensive agents demonstrated higher success rates in vulnerability detection and patching compared to offensive agents' initial access rate. However, when defensive success required maintaining service availability and preventing all enemy attacks, performance dropped significantly. This performance evaluation in Attack/Defense scenarios revealed that assessing the difference in offensive and defensive performance of agentic AI is not straightforward. We provide a MITRE ATT&CK, CWE and CAPEC correlation analysis that highlights strengths in input validation bypasses and command injection but weaknesses in database attacks. These results underline the importance of realistic and dynamic evaluations to advance AI-driven cybersecurity. This thesis analyzes the limitations of current AI systems in live, adversarial environments and provides insights into the development of balanced AI capabilities for real-world security operations.
Federico Bonafini
tesi magistrale
Università degli Studi di Padova
Dipartimento di Matematica
Titolo della tesi
“Cybersecurity Threats in Port Logistics Systems and Stowage Plans”
Relatore
Mauro Conti
Abstract
Container ports are strategic nodes in the global economy and military logistics, with approximately 80% of global trade transported via maritime routes, according to the United Nations Conference on Trade and Development (UNCTAD). Disruptions in port operations can have serious economic consequences, severely impacting supply chains and daily life. A remarkable example is the block of six days of the Suez Canal in 2021 by a Maersk vessel, which caused global logistical disruptions resulting in financial losses estimated between 15 and 17 thousand of millions of dollars. Additionally, the stability of cargo ships is highly dependent on container placement, and improper loading can result in cargo losses, evaluated around 28 thousand dollars per container, or in extreme cases capsizing, thereby endangering lives of onboard operators. Therefore, the maritime sector has adopted several technologies, such as ad-hoc software and Internet of Things (IoT) devices, to improve operational efficiency and safety. However, the widespread use of these tools has significantly expanded the attack surface for malicious actors and, for this reason, government authorities have raised serious concerns about potential cyber incidents. For example, over 80% of the cranes operating in American ports are manufactured by a Chinese military company that reduced cybersecurity funding in recent years, making the cranes highly vulnerable to cyber attacks. Despite the importance of security in logistics port operations, no prior studies have thoroughly investigated the implications of tampering with stowage plans and cargo details. The contribution of this thesis extends beyond the technical exposition of recent cyberattacks and incidents against ports, but we are the first to analyse this context and propose comprehensive threat models targeting the manipulation of stowage plans, along with the identification of potential attack vectors within port logistic workflows. In addition, we propose an implementation of malicious software that, starting from a legitimate stowage plan, can generate a dangerous permutation of container placements. This program is designed to alter only non-visible stability parameters, making detection via visual inspection extremely difficult. The resulting stowage plans significantly reduce the vessel's righting moment and increase the likelihood of maritime incidents. Using a commercial vessel stability simulator, we successfully violated 4 of 6 seaworthiness constraints mandated by the International Maritime Organization (IMO), drastically reducing the ability of the vessel to restore to its upright position during heeling caused by external forces. Finally, we propose advanced countermeasures based on recent studies on the authenticity and integrity of data, to avoid tampering with stowage plans and cargo details within the port ecosystem.
I premiati delle ultime 10 edizioni
Il Premio Tesi è realizzato in collaborazione e con il sostegno di:
