Project code



School of Computing

Start dates

October, February and April

Application deadline

Applications accepted all year round

Applications are invited for a self-funded 3-year PhD.

The PhD will be based in the Faculty of Technology, and will be supervised by Dr Fudong Li and Dr Stavros Shiaeles.

The work on this project will:

  • Conduct a comprehensive literature view on the topic of user profiling through network activities
  • Collect a dataset which contains users’ network activities via both encrypted and non encrypted channels
  • Undertake an experimental study on the collected dataset with the aim of network profiling individual users by utilising deep learning techniques
  • Develop and evaluate a novel user identification framework via their network activities profiles that will utilise the Blockchain technology  

Due to the prevalence usage of the Internet, the amount of cybercrimes (such as email phishing, enterprise trade secret data theft, and password trafficking) has increased significantly over the last 10 years; it affects thousands of businesses around the world, costing them $13million per incident on average (Accenture, 2019). Forensic investigators are called to identify the source of attack and track down the offender by examining the network traffic log and computer systems.

However, due to the widely use of encrypted traffic, especially from Cyber criminals, this makes the forensic investigator’s job challenging if not impossible. Early research shows that it is possible to use the biometric technique (i.e. behaviour profiling) to identify individual via the metadata of their network traffic to a reasonable level of performance (Alotibi et al., 2016; Clarke et al., 2017); nonetheless, the features being used in their works are somewhat basic; also there is still plenty of room for improvement in the areas of classifiers and results.

This project aims to identify and extract a specific user’s activities from the wider organisation’s traffic logs over a prolonged period by studying novel user’s network behaviour features and identify them by using deep learning method. The user’s activities identified will be converted to unique signatures and will be stored in the Blockchain technology (Kolokotronis et al., 2019; Brotsis et al., 2019), allowing forensic examiners, companies, and law enforcement agencies to detect malicious activities and track down individual offenders without violating GDPR and preserving user’s privacy (Gkotsopoulou et al., 2019).


Accenture (2019) “Ninth Annual Cost of Cybercrime Study”, available at:    

Clarke, N., Li, F., Furnell, S. (2017) “A novel privacy preserving user identification approach for network traffic”,  Computers and Security, volume 70, page 315–350 DOI: 10.1016/j.cose.2017.06.012

Alotibi, G., Clarke, N., Li, F., & Furnell, S. (2016). User profiling from network traffic via novel application-level interactions. In 2016 11th International Conference for Internet Technology and Secured Transactions (ICITST) (pp. 279–285). IEEE. DOI: 10.1109/ICITST.2016.7856712

Kolokotronis, N., Limniotis, K., Shiaeles, S., & Griffiths, R. (2019). Secured by Blockchain: Safeguarding Internet of Things Devices. IEEE Consumer Electronics Magazine, 8(3), 28–34. DOI: 10.1109/MCE.2019.2892221

Brotsis, S., Kolokotronis, N., Limniotis, K., Shiaeles, S., Kavallieros, D., Bellini, E., & Pavue, C. (2019). Blockchain solutions for forensic evidence preservation in IoT environments. 2019 IEEE Conference on Network Softwarization (NetSoft) DOI: 10.1109/NETSOFT.2019.8806675

Gkotsopoulou, O., Charalambous, E., Limniotis, K., Quinn, P., Kavallieros, D., Sargsyan, G., & Kolokotronis, N. (2019). Data Protection by Design for Cybersecurity Systems in a Smart Home Environment. In 2019 IEEE Conference on Network Softwarization (NetSoft) DOI: 10.1109/NETSOFT.2019.8806694

Fees and funding

Visit the research subject area page for fees and funding information for this project.

Funding availability: Self-funded PhD students only. 

PhD full-time and part-time courses are eligible for the UK Government Doctoral Loan (UK and EU students only).

Entry requirements

You'll need an upper second class honours degree from an internationally recognised university or a Master’s degree in an appropriate subject. In exceptional cases, we may consider equivalent professional experience and/or qualifications.  English language proficiency at a minimum of IELTS band 6.5 with no component score below 6.0.

You should have knowledge of programming (ideally python),  deep learning/machine learning, Blockchain, networking protocols such as TCP/IP or UDP, Linux OS and biometrics. 

How to apply

We’d encourage you to contact Dr Fudong Li at to discuss your interest before you apply, quoting the project code.

How to apply

When you are ready to apply, please follow the 'Apply now' link on the Computing PhD subject area page and select the link for the relevant intake. Make sure you submit a personal statement, proof of your degrees and grades, details of two referees, proof of your English language proficiency and an up-to-date CV. Our ‘How to Apply’ page offers further guidance on the PhD application process. 

October start

Apply now

February start

Apply now

If you want to be considered for this self-funded PhD opportunity you must quote project code COMP4520220 when applying.