Universiteit Twente vacancy search engine

PhD Position on Modeling IoT Device Behavior for Threat Detection and Response

Vacancy details

General information


The faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS) uses mathematics, electronics and computer technology to contribute to the development of Information and Communication Technology (ICT). With ICT present in almost every device and product we use nowadays, we embrace our role as contributors to a broad range of societal activities and as pioneers of tomorrow's digital society. As part of a people-first tech university that aims to shape society, individuals and connections, our faculty works together intensively with industrial partners and researchers in the Netherlands and abroad, and conducts extensive research for external commissioning parties and funders. Our research has a high profile both in the Netherlands and internationally. It has been accommodated in three multidisciplinary UT research institutes: Mesa+ Institute, TechMed Centre and Digital Society Institute.

As an employer, the EEMCS Faculty offers jobs that matter. We equip you as a staff member to shape new opportunities both for yourself and for our society. With our Faculty, you will be part of a leading tech university that is changing our world for the better. We offer an open, inclusive and entrepreneurial climate, in which we encourage you to make healthy choices, for example, with our flexible, customizable conditions.   



Publication start date


Publication date


Publication end date


Vacancy category


Minimum contract hours


Maximum contract hours


Position description


Academic staff - PhD

Job title

PhD Position on Modeling IoT Device Behavior for Threat Detection and Response

Minimum salary


Maximum salary


Job description

The Services and Cybersecurity (SCS) group at the University of Twente invites applications for a 4-year PhD position on the topic of “Security of the Internet of Things (IoT)”.

In this PhD project, we will investigate different ways to model the behavior of IoT devices, mostly from the network perspective, in order to fingerprint the IoT device activity and detect anomalies regarding both the devices themselves (e.g., botnet infections) as well as the environment they interact with (e.g., compromised Cloud backend). Once an anomaly is detected, appropriate post-processing approaches will be explored to identify malicious activity and to deliver adequate courses of action to respond to the threats. Given the constantly evolving nature of attacks and discovery of new vulnerabilities, the robustness and the updatability of the designed models will pose a particular challenge. Furthermore, we will study manners to ease the interaction between human analysts and our to-be-developed detection tools to facilitate a fast response to attacks. This PhD position is part of a joint research project, INTERSECT, in collaboration with several Dutch universities and companies. In particular, during this project we will collaborate with TU Delft and SIDN Labs.

The prospective PhD candidate is expected to perform high quality and internationally visible research that gets published at some of the top security conferences and journals. You will be supervised by Prof. Dr. Andreas Peter and Dr. Andrea Continella from the SCS group (www.utwente.nl/scs) of the UT. The candidate will be appointed for a period of four years, at the end of which she/he delivers a PhD thesis. During this period, the PhD student has the opportunity to broaden his/her knowledge by joining international exchange programs, to participate in national and international conferences and workshops, and to visit other research institutes and universities worldwide.


  • You are a highly motivated and enthusiastic researcher, aspiring to do world-class research and have real-world impact;
  • You have a MSc degree with excellent grades in computer science, or similar; applications from students who are about to finish their MSc degree studies will be considered as well;
  • You are interested in the domain of cybersecurity and particularly have a solid background in network and systems security; some good background in machine learning and prior experience with writing scientific papers are of additional advantage;
  • You are curious and interested in learning how things work and how to make them better;
  • You are an independent and original thinker with a creative mindset;
  • You have good analytical and communication skills;
  • You have a good team spirit and like to work in an internationally oriented environment;
  • You are fluent in English.

We offer

This position is in the context of the INTERSECT project funded by the Netherlands Organization for Scientific Research (NWO) in collaboration with several academic and industrial partners in the Netherlands. The terms of employment are in accordance with the Dutch Collective Labour Agreement for Universities (CAO) and include:

  • A fulltime PhD position for four years, with a qualifier in the first year;
  • Full status as an employee at the UT, including pension and health care benefits;
  • The salary will range from € 2.395 (1st year) to € 3.061,- (4th year) per month, plus a holiday allowance of 8% and a year-end bonus of 8.3%;
  • Excellent facilities for professional and personal development;
  • We encourage a high degree of responsibility and independence, while collaborating with close colleagues, researchers and other university staff.

Information and application

Please send your application before 24 April 2021 via the 'Apply now' button, and include:

  • a motivation letter, emphasizing your specific interest and motivation to apply for this position;
  • a detailed CV (resume);
  • an academic transcript of B.Sc. and M.Sc. education, including grades.

For further questions, please contact Dr. Andrea Continella at a.continella@utwente.nl.

Position localisation

Job location

Nederland, Enschede, Drienerlolaan 5, 7522 NB


Drienerlolaan 5 7522 NB Enschede

Candidate criteria

Minimum level of education required

4. Master

Scientific area