Theses and Dissertations (Computer Science)

Permanent URI for this collectionhttp://hdl.handle.net/2263/32356

Browse

Now showing 1 - 20 of 239

Continuous authentication on android mobile devices
Njaravani, Christopher (University of Pretoria, 2025-12-23)
Initial authentication methods, such as passwords and PINs, secure access to an Android mobile device only at login, leaving active sessions vulnerable to unauthorised access. With over 3.9 billion Android mobile users worldwide and the widespread use of ultra-short messages in applications like WhatsApp, Telegram, and email, this security gap poses a significant risk to the confidentiality, integrity, and availability of sensitive information. Recent breaches, including the 2025 ByHeist and Microsoft Exchange compromises, highlight how attackers exploit active sessions through token theft and session hijacking to access ultra-short message conversations after bypassing initial authentication.This study investigates whether ultra-short messages of 30 characters or fewer can provide sufficient behavioural data for reliable continuous authentication on Android mobile devices. A continuous authentication system (CAS) combining typing speed measurements and stylometric analysis was developed and evaluated through five systematic experiments. Data was collected from a total of 41 participants (with 34 left after cleaning) using a custom-made React Native mobile application. The application simultaneously captured typing speed and text content as participants responded to chat questions.This research addressed four sub-questions evaluating: (1) typing speed discriminative power, (2) stylometry discriminative power, (3) the benefits of combining typing speed and stylometry, and (4) the optimal window size and user group configurations. Results demonstrated that typing speed alone achieved a strong discriminative power with F-statistic = 4.26, but with high within-user variability, with a coefficient of variation (CV) between 54.5% and 74.8%. At the same time, stylometry showed moderate discriminative power with F-statistic = 3.64 but with enhanced stability, with CV between 24.8% to 34.8%. The combined approach using adaptive weighting achieved F-statistic = 4.08, successfully balancing discriminative power strength with behavioural consistency.Optimal configurations with five and ten participants and 25-character windows achieved a True Authentication Rate (TAR) of 80% and a True Negative Rate (TNR) ranging from 57.8% to 65%. However, scaling to 34 participants revealed a security-usability trade-off, with TAR degrading by 19.1% while TNR degraded by 2.5%.This research contributes to mobile security by demonstrating that ultra-short messages of 25 to 30 characters can serve as a viable data source for continuous authentication, providing a supplementary layer of protection that complements rather than replace initial authentication methods. The findings reveal that continuous authentication is feasible for small user groups in instant messaging contexts. However, the 35% False Positive Rate (FPR) indicates that the approach proposed in this study should be deployed as part of a multi-factor continuous authentication strategy, rather than as a standalone security measure.
Anonymisation algorithm for balancing data utility and privacy in electronic health digital forensic investigations
Mautjane, Augustin Thabang (University of Pretoria, 2025-10-02)
The growing dependence on data-driven methods in digital forensic investigations, particularly in sensitive sectors like healthcare, underscores the critical need to balance individual privacy with data utility. Traditional anonymisation techniques often degrade data quality, hampering effective forensic analysis. This research introduces the Extended Anonymisation Privacy Model (e-ANOP), a novel hybrid framework integrating generalization and suppression techniques to optimize the privacy-utility trade-off. Unlike conventional k-anonymity approaches, e-ANOP prioritizes the protection of sensitive attributes while preserving essential data patterns. Evaluated through a healthcare-based forensic investigation case study, e-ANOP demonstrated superior analytical integrity, maintaining high data utility without compromising privacy. These results highlight e-ANOP’s potential as a scalable, practical solution for privacy-preserving data analysis in digital forensics, offering significant advancements in safeguarding sensitive information while supporting robust investigative outcomes. The e-ANOP model addresses the limitations of existing anonymisation methods by introducing a dynamic, context-aware approach tailored to the complexities of digital forensic investigations. By leveraging adaptive generalization hierarchies and selective suppression, e-ANOP ensures that sensitive attributes—such as patient identifiers in healthcare datasets—are effectively anonymized while retaining critical patterns necessary for forensic analysis, such as temporal or behavioral trends. The model’s flexibility allows it to adapt to varying data structures and privacy requirements, making it applicable across diverse forensic scenarios. Furthermore, e-ANOP incorporates metrics to quantify both privacy preservation and data utility, enabling investigators to fine-tune the model based on specific case needs. Through rigorous testing on real-world healthcare datasets, e-ANOP achieved a significant reduction in re-identification risk while maintaining over 90% of the original data’s analytical value, positioning it as a robust tool for privacy-conscious digital forensics in high-stakes environments.
Digital forensic readiness to mitigate insider threats in the SaaS cloud environment
Shoderu, Gabriel Olanrewaju Olumayowa (University of Pretoria, 2025-12-09)
Cloud environments are now central to modern organizational operations, hosting sensitive information and critical business processes that rely on trusted user access. However, insider threats remain one of the most persistent security challenges, particularly in cloud-based environments where multi-tenancy and decentralized control limit direct evidence acquisition. Traditional mitigation strategies are often reactive, relying on postincident investigation and delayed evidence collection, which can result in incomplete forensic traces, late detection, and weakened legal defensibility. As cloud adoption accelerates, there is a growing need for proactive mechanisms that support both intelligent threat detection and forensic readiness. Digital Forensic Readiness refers to the strategic preparation of an organization to identify, collect, preserve, and manage potential digital evidence prior to incidents. This research addresses the absence of a clearly defined DFR framework tailored to insider threat mitigation in Software-as-a-Service environments. It proposes DFR-BUST,astandards-aligned, evidence-centric framework that integrates forensic-by-design principles with intelligent behavioral analytics to proactively detect suspicious activity while preserving admissible digital traces. The study is grounded in a systematic review of peer-reviewed literature to identify gaps in cloud forensic readiness and insider threat research. The framework is demonstrated through a contextual case scenario involving the investigation of suspected insider activity within a cloud-based Employee Management System, illustrating end-to-end readiness and evidential handling aligned with ISO/IEC 27043. In addition, the research defines a structured mechanism for extracting and preparing behavioral data to support timely detection while maintaining forensic soundness. Overall, this work contributes a unified and scalable approach that bridges proactive insider detection with digital forensic readiness requirements in SaaS environments.
IoT-based ransomware detection using reinforcement learning feature selection
Nchabeleng, Mohlale Anthony (University of Pretoria, 2026-02-18)
The rapid expansion of the Internet of Things (IoT) has transformed modern digital infrastructure by connecting billions of resource constrained devices across homes, industries, healthcare systems and national critical infrastructure. While this pervasive connectivity enables automation and real time intelligence, it also exposes IoT ecosystems to a growing spectrum of cyber threats. Ransomware represents one of the most critical and potentially disruptive forms of malicious activity in this domain, largely by exploiting inherent vulnerabilities such as weak configurations, limited computing capability and the absence of robust defence mechanisms on many IoT devices. Traditional detection methods rely heavily on manually engineered features and signature-based techniques that require expert knowledge and struggle to keep pace with the fast evolution of modern ransomware. These limitations create an urgent need for adaptive security approaches that can operate efficiently within the strict resource boundaries of IoT environments. This study presents a novel IoT Ransomware Detection Framework (IRDF) to automatically select features instead of relying on manual feature selection. The framework leverages the Deep Reinforcement Learning (DRL) method Soft Actor Critic (SAC) together with a shaped reward function and a Prioritized Experience Replay (PER) buffer to learn a small number of highly discriminative feature subsets. This automated process eliminates the manual feature selection step and reduces feature dimensionality, which in turn reduces computational cost while maintaining a high level of detection accuracy. The EdgeIIoT dataset is used to train and evaluate the framework across several traditional supervised Machine Learning (ML) classifiers such as Decision Tree (DT), Random Forest (RF), Linear Regression (LR), Support Vector Machine (SVM) and K Nearest Neighbour (KNN). The framework achieves an impressive average accuracy of 99.27% and an F1-score of 99.28% while selecting only one or two features out of the original 61 features. The optimized feature subsets are then utilized to derive a lightweight classification model for deployment. Runtime evaluation of this inference model, implemented as a DT classifier and utilizing a single selected feature in a constrained virtual IoT environment, demonstrates exceptional operational efficiency. The key efficiency metrics include a fast 1.81 ms latency and minimal resource consumption, such as 0.50% CPU utilization, 81.92 MB RAM utilization, a deployment model size of only 1.7 KB and an energy consumption of 0.0017 joules per inference. These quantitative results confirm the superior performance of the framework compared with both alternative models and the baseline DT model trained on the full high dimensional feature set. Furthermore, they show that the proposed IRDF, when paired with a resource efficient inference classification model, provides an efficient, scalable and adaptable ransomware detection solution suitable for vulnerable and resource constrained IoT environments such as smart city infrastructures, sensor network environments and a wide range of industrial IoT systems.
Automated machine learning for real-time algorithm configuration, composition and generation
Gerber, Mia (University of Pretoria, 2026-02-16)
Automated machine learning (AutoML) uses optimisation techniques to create designs that are used by machine learning (ML) algorithms, where the design can range from simple hyper-parameter values to an architectural specification for an ML algorithm. An AutoML application involves an automated design technique, creating a design, where the design consists of design options. The automated design technique searches for a value for each design option. Current state-of-the-art AutoML approaches create static designs, with the automated design technique searching a static space of values for each design option. This thesis is the first to use a hyper-heuristic and genetic algorithm to create dynamic designs (i.e. optimisation during ML model execution) and use dynamic design option values. The evaluation and comparison of the hyperheuristic and genetic algorithm approach is performed using six applications, spanning three areas within AutoML; namely: automated configuration, automated composition, and automated generation. The genetic algorithm approach is extended to create the first model-agnostic real-time AutoML approach that can be used for automated configuration, composition and generation. Real-time AutoML enables the design process to happen while the ML algorithm executes. Real-time AutoML is an emerging research area and existing real-time AutoML approaches can be improved with inasfar as runtime and the quality of designs. This thesis proposes the online meta-learning for AutoML in real-time (OnMAR) approach. Meta-learning gathers information about the optimisation process undertaken by the ML algorithm in the form of meta-features. The OnMAR approach uses the meta-features in conjunction with a meta-learner to predict the accuracy of an ML algorithm when it is using a particular design. If the accuracy predicted by the meta-learner is sufficient, the design is used, and if the predicted accuracy is low, a new design is created using a genetic algorithm as the automated design technique. The OnMAR approach is effective, matching or outperforming other real-time approaches, with the added benefit of a faster runtime.
Advancing digital forensics and cybersecurity : a novel model for the detection and analysis of Alternate Data Streams (ADS) and Mark-of-the-Web (MOTW) files
Mac Mahon-Maré, Chloé (University of Pretoria, 2026-02-02)
Alternate Data Streams (ADS) are files on Windows devices in which the files are covertly stored within the metadata fields of other files, rendering them difficult for end-users and default Windows Application Programming Interfaces (APIs) to detect or access. Among these, Mark-of-the-Web (MOTW) files represent a specialised form of ADS, automatically attached by Windows systems to record the origin of files downloaded from a network. The covert nature of ADS and MOTW files introduces a substantial cybersecurity risk, as threat actors may exploit them to conceal malicious payloads, bypass security controls, or persist within compromised systems. Despite this, the routine exclusion of the monitoring of ADS and MOTW files from digital forensic investigations creates a critical gap in the acquisition, analysis and interpretation of potential digital evidence. This research addresses these challenges by proposing a novel process model that integrates the detection, extraction, and analysis of ADS and MOTW files into standard digital forensic workflows. The model is complemented by corresponding cybersecurity tools, enabling the automated identification and mitigation of threats hidden within these files. By bridging this gap, the proposed approach not only enhances the comprehensiveness of forensic investigations but also strengthens defensive cybersecurity capabilities, providing investigators and security practitioners with structured methodologies for managing hidden files. Prototype implementations demonstrate the practicality, efficiency, and forensic soundness of the approach, confirming its potential for adoption in both research and operational environments.
Quality evaluation strategies for synthetic code-switched data in support of language learning applications
Kotzé, Michelle (University of Pretoria, 2025)
In a world where almost half of the population is bilingual and a significant proportion is multilingual, code-switching is a common linguistic phenomenon in both spoken and written communication. Increasingly recognised as an intentional and structured practice rather than a linguistic deficiency, code-switching research remains constrained by the lack of high-quality, annotated resources and appropriate evaluation methodologies. These limitations are particularly pronounced in educational natural language processing technologies, where code-switching plays an important role in language learning applications. This thesis addresses the issue of code-switched data scarcity and the challenge of evaluating its syntactic quality. Large language models (LLMs) were leveraged to generate synthetic Afrikaans--English code-switched data using carefully designed prompt templates. The generated data was assessed through human evaluation and LLM-as-a-judge. Findings show that GPT-4o produced more acceptable sentences compared to Gemini 2.0 Flash, while LLM-as-a-judge revealed notable inconsistencies regarding the ability of LLMs to serve as fair evaluators of quality. Word-level language identification and part-of-speech tagging were further introduced, with rule-based and joint tagger approaches outperforming LLM-based methods. To support evaluation of syntactic quality, two evaluation methodologies were explored: a heuristic model and BERT-based classifiers. The heuristic model, based on explicit grammar rules for Afrikaans--English code-switching, achieved strong baseline performance (90.5% F1 score). A multi-input XLM-R classifier using word embeddings, language identification and part-of-speech tags, achieved the highest performance with a 97.5% F1 score. Due to the black-box nature of XLM-R models, interpretability was further explored through gradient- and occlusion-based attribution analyses, which in some cases provided complementary insights into classifier behaviour. However, it remains unclear whether the model consistently relies on linguistically appropriate signals. The final proposed evaluation strategy is a hybrid framework that combines the heuristic rule-based model with the multi-input XLM-R classifier into a meta-classifier, and optimised to reduce false negatives (incorrect CS sentences misclassified as correct). This hybrid model achieved a 93.2% F1 score with 95.0% recall on the incorrect class, balancing rule-based precision with neural generalisation. The main contributions of this thesis include (i) a framework for synthetic code-switched text generation with LLMs, (ii) a curated Afrikaans--English code-switched data set, (iii) a comprehensive evaluation strategy integrating grammar rules, neural models and explainability techniques, and (iv) a proposed set of requirements for a data set tailored to first/second language learning applications. Collectively, these contributions advance both the generation and evaluation of code-switched data, while laying a foundation for future research into educational technologies for code-switching.
Digital forensic readiness for human-to-human communication interactions in software as a service (SaaS) cloud environment
Omeleze Baror, Stacey (University of Pretoria, 2025-11-01)
Human-to-human communication is now a primary attack surface in cloud Software-as-a-Service (SaaS) platforms, where phishing, impersonation, fraud, and coercion are executed through everyday text rather than technical exploits. While these attacks leave linguistic traces, most digital forensic readiness approaches remain reactive and telemetry-centered, with limited capability to capture, preserve, and explain text-based evidence at the moment it matters. This thesis addresses that gap by treating user communication data as a first-class forensic artifact and by embedding proactive readiness into text-based communication evidence. The study introduces a refined definition of Digital Forensic Readiness (DFR) as a proactive, human-centered capability for anticipating, capturing, and preserving communication-derived evidence in SaaS environments. Building on this definition, it proposes the Digital Forensic Readiness Human-to-Human Communication Interaction (DFR HCI) framework: an end-to-end, communication-driven readiness architecture that converts user-submitted and system-ingested text into governed digital forensic artifacts and actionable cybercrime triggers. The DFR HCI framework integrates Natural Language Processing (NLP) preprocessing, semantic modeling, ensemble Machine Learning (ML)/Deep Learning (DL) classification, and Explainable Artificial Intelligence (XAI) to produce measurable detection outputs and reviewable explanations, while using publicly available datasets to support consistent evaluation and repeatability of potential digital evidence generation. A working microservice prototype demonstrates end-to-end feasibility, from user reporting and text upload through classification, alerting, logging, and artifact preservation, enabling transparent audit trails and defensible analysis. Results show that communication-derived indicators can support earlier detection and faster triage, while XAI outputs make decisions inspectable for digital forensic investigators, law enforcement authorities, governance review, and other stakeholders. Overall, this thesis contributes to user-data-driven digital forensic readiness for communication-centric cloud environments, where users are not treated as weak links but as contributors of preserved text evidence that strengthens detection and facilitates continuous improvement. The DFR HCI framework’s lightweight, modular design supports accessible, cost-aware readiness for SMEs while remaining compatible with standards-oriented governance and digital forensic soundness expectations.
Digital forensic readiness of reward systems
Robertson, Shelley (University of Pretoria, 2025)
As hybrid and remote work environments become increasingly prevalent post-COVID-19, organizations face the challenge of maintaining employee motivation, engagement, and digital security. Traditional reward systems are often ill-suited for virtual settings, and while virtual currencies such as cryptocurrencies and NFTs (Non-Fungible Tokens) are emerging as potential alternatives, their effective implementation in the Metaverse remains unclear. In recent years, the digital workplace has evolved beyond simple remote connectivity into fully immersive environments, where interaction, collaboration, and productivity occur within shared virtual spaces. This shift has intensified the need for reward systems that not only motivate employees but also preserve accountability and trust in decentralized environments. This research explores the underexamined potential of virtual currencies as employee reward mechanisms within virtual environments, while also addressing the absence of integrated Digital Forensic Readiness (DFR) in these systems. Whereas existing studies often treat motivation and digital security as separate domains, this work bridges them by proposing a unified framework that embeds DFR principles directly into a virtual-currency-based reward mechanism. The approach ensures that incentive design and digital-evidence preservation reinforce one another, enhancing both engagement and resilience. This study investigates how virtual currencies can motivate employees in the Metaverse and how DFR can be embedded to ensure secure and accountable operations. The research pursues two overarching objectives: (1) to explore the motivational influence of virtual-currency-based incentives on employees in digital workplaces, and (2) to examine how integrating DFR principles can enhance the trustworthiness, accountability, and evidentiary resilience of such systems. The methodology involves a detailed literature review of virtual currencies, blockchain-based reward mechanisms, and DFR standards, followed by the design of a conceptual solution. This solution is evaluated through simulated case scenarios and a Proof-of-Concept (PoC), incorporating psychological insights such as social comparison and loss aversion. The investigation further situates the proposed framework within the broader research landscape by comparing it against contemporary enterprise gamification and blockchain-forensic models, thereby strengthening its theoretical grounding and practical relevance.The findings reveal that virtual currencies, when flexibly convertible into desirable rewards, can significantly enhance motivation and engagement. At the same time, the integration of DFR ensures system accountability and preserves digital evidence, offering a proactive approach to potential security incidents. This research contributes a novel framework for secure, motivation-driven reward systems in virtual work environments, making it relevant to organizations seeking innovative ways to retain talent, increase productivity, and uphold digital integrity. It offers strategic value to employers navigating modern workforce dynamics and provides employees with more engaging and flexible reward experiences. The study ultimately advances understanding of how virtual incentives can be securely implemented in the Metaverse and identifies future avenues for research in this evolving area.
Using grammar-based reduction to identify toolmarks in PDFs and determine creation tools
Sutherland-MacLeod, Tyrone (University of Pretoria, 2025-11-20)
In an increasingly digital world, millions of documents are created, shared, and modified daily, serving functions that range from routine communication to legally binding agreements and high-stakes business transactions. Unlike physical records, digital documents lack tangible features, requiring forensic examiners to adopt novel analytical methods to uncover information about their origins and modification histories. This study focuses on the forensic analysis of Portable Document Format (PDF) files, one of the most prevalent digital document types. Specifically, it investigates the classification of PDFs according to their producing software by identifying structural artefacts, or toolmarks, embedded during the file's creation. The research begins with a review of relevant literature, including PDF specifications, lexical analysis, formal language theory, and prior work in forensic digital document examination (FDDE). A pilot study involving 1000 PDF files tests the viability of a grammar-based reduction method, which applies grammar rules to match recurring character sequences in a document, replacing them with simplified tokens that preserve forensic artefacts while filtering out irrelevant content. This method is then refined and applied at scale to a dataset of 9000 PDF files, enabling the profiling of toolmarks associated with a wide range of PDF-generating tools. These profiles are then applied to documents that simulate editing scenarios as well as a blind attribution test, evaluating the method’s practical utility in forensic examinations. The results demonstrate that grammar-based reduction facilitates the identification of consistent, software-specific toolmarks and enhances the reliability of classifying PDFs by their origin. When sufficient exemplars are available, robust toolmark profiles can be compiled for different creation tools and used to distinguish among certain producers, supporting both attribution and classification of possible creators. In addition, these toolmarks can be used to detect discrepancies between a file’s metadata and the structural characteristics expected of a document produced by the purported tool. This allows for the identification of editing or manipulation by different software and can assist forensic examiners in reconstructing the possible creation history of a questioned file, ultimately enabling them to address broader forensic questions about authorship, authenticity, and the sequence of events leading up to a document’s present form.
Optimizing translation for low-resource languages : efficient fine-tuning with custom prompt engineering in large language models
Khoboko, Pitso Walter (University of Pretoria, 2025-10)
Training large language models (LLMs) can be prohibitively expensive. However, the emergence of new Parameter-Efficient Fine-Tuning (PEFT) strategies provides a cost-effective approach to unlocking the potential of LLMs across a variety of natural language processing (NLP) tasks. In this thesis, we selected the Mistral 7B LLM as our primary model due to its superior performance, which exceeds that of LLAMA 2 13B on multiple benchmarks. Using PEFT methods, we aim to significantly reduce the cost of fine-tuning while maintaining high levels of performance. Despite their advancements, LLMs often struggle with translation tasks for low-resource languages, particularly morphologically rich African languages. To address this, we employ customized prompt engineering techniques to enhance LLM translation capabilities for these languages. Our experimentation focused on fine tuning the Mistral 7B model to identify the best-performing ensemble using a custom prompt strategy. The results obtained from the fine-tuned Mistral 7B model were compared with several models: Serengeti, Gemma, Google Translate API, and No Language Left Behind (NLLB). Specifically, Serengeti and Gemma were fine-tuned using the same custom prompt strategy as the Mistral 7B model, while Google Translate API, NLLB and Gemma which are pre-trained to handle English-to-Zulu and English-to-Xhosa translations, were evaluated directly on the test data set. This comparative analysis allowed us to assess the efficacy of the main experimental model against both custom-tuned and pre-trained translation models. LLMs have traditionally struggled to produce high-quality translations, especially for morphologically rich low-resource languages. Our experiments revealed that the key to improving translation performance lies in using the correct prompt during fine-tuning. We developed a custom prompt that significantly improved translation quality for English-to-Zulu and English-to Xhosa language pairs. We fine-tuned the Mistral 7B model for 30 GPU days, we compared its performance to the NLLB model and Google Translate API on the same test dataset. Although NLLB achieved the highest scores across BLEU,G-Eval (cosinesimilarity), and Chrf++(F1score), our main model’s results still performed competitively against it. Furthermore, we showed that our custom prompt template can improve the translation accuracy of other models, such as Gemma and Serengeti, when applied to high-quality bilingual datasets. Thus, demonstrated that our custom prompt strategy is adaptable across different LLMs architectures, bilingual settings, and is highly effective in accelerating learning for low-resource language translation.
A robust intelligent readiness framework for ransomware forensics
Singh, Avinash (University of Pretoria, 2025-01)
Ransomware attacks have become a prominent and persistent threat in the modern digital ecosystem, targeting critical systems, disrupting business operations, and inflicting significant financial and reputational damage. As attackers develop increasingly sophisticated methods to evade detection, conventional forensic approaches struggle to keep pace. Key challenges include the inability of current digital forensic investigation techniques to efficiently identify and extract relevant digital artefacts, identify the presence of redundant and irrelevant data that hinders storage optimisation, and address the lack of robust categorisation mechanisms for digital evidence. Furthermore, attackers often exploit vulnerabilities in forensic readiness, tampering with or erasing critical evidence to cover their tracks. This situation is intensified by the dynamic nature of ransomware, which continuously evolves to bypass static detection mechanisms. This adaptive and sophisticated nature of ransomware has rendered many conventional detection and forensic approaches insufficient. This thesis introduces a robust Intelligent Ransomware Readiness Framework (IRRF), a proactive, intelligence-driven model designed to address the critical gaps in ransomware, namely detection, analysis, and forensic readiness. The proposed framework leverages Artificial Intelligence (AI) to address these challenges, offering a novel, scalable and adaptive solution. The framework can identify key ransomware functions, even in cases of zero-day or previously unseen ransomware variants. In addition to ransomware detection and analysis, the IRRF emphasises secure evidence storage to support digital forensic readiness. Recognising that attackers often attempt to alter or erase forensic artefacts, the proposed model incorporates robust security measures, including integrity checks, environment sandboxing, encryption, two-factor authentication, storage optimisation, lossless compression, and deduplication of data. These measures ensure proper handling of the chain of custody, preservation of evidence integrity, and safeguarding sensitive data from unauthorised access or tampering. The machine learning detection models created in this research were able to accurately detect ransomware with a 98.33% accuracy using an optimisable weighted algorithm, while providing meaningful insight into the execution capabilities of an executable. The secure storage mechanism developed in this research also minimized storage constraints by reducing the storage required by approximately 38% making it scalable and reducing costs. Furthermore, the framework was evaluated in compliance with the ISO/IEC 27043 international standard. The prototype was evaluated based on the NIST Computer Forensic Tool Testing (CFTT) program and several software engineering techniques such as static code analysis and vulnerability scanning. The IRRF also addresses the broader challenge of balancing forensic readiness with practical applicability. By adopting artificial intelligence as a foundational element, the framework ensures scalability and adaptability to the rapidly evolving tactics of ransomware attacks. By enhancing digital forensic readiness and securing critical digital evidence, this framework contributes to advancing the state of ransomware forensics, providing organisations and security practitioners with the tools necessary to fortify their defences, respond to incidents effectively, and secure their digital assets in an ever-evolving threat landscape.
Genetic algorithm with temporal logic for automated markers
Redelinghuys, Francois Jacobus (University of Pretoria, 2025-07)
Automated assessment is essential for large-scale programming courses, as it addresses the challenges of evaluating correctness and providing feedback efficiently. Traditional methods of automated assessment rely on hand-crafted test cases, which are time-intensive and lack scalability. Automated test generation methods, such as random input generation or genetic algorithms combined with code coverage metrics, offer alternatives, but often fail to capture the complexity required for educational assessments. To address this, a novel approach that integrates genetic algorithms with linear temporal logic (LTL) formulae is proposed. LTL properties, commonly used in model checking, formalise correctness criteria for programming assignments. The proposed method evolves test cases designed to maximise violations of the LTL properties in student submissions, determining correctness and generating personalised feedback by providing examples of failing test cases. Experiments \replaced{were}{are} conducted to evaluate the approach in terms of sensitivity to hyperparameter settings, and effectiveness relative to the established techniques, such as random input generation and code coverage-based genetic algorithms. Results demonstrate that combining genetic algorithms with LTL properties enhances automated assessment accuracy and feedback quality, offering a solution to the problems faced by automated assessment in large educational settings for both students and lecturers.
From text annotation to an auto-regressive language model for sentiment analysis in South African financial reviews
Mathebula, Miehleketo (University of Pretoria, 2024-11)
In contemporary society, social media enables rapid expression of public sentiment toward governmental policies and financial products. This immediacy and depth of sharing can serve as a virtual focus group for major financial decisions, offering a gold mine for understanding customer satisfaction and identifying new product features and services. Customer reviews are crucial for the profits and reputations of financial institutions. SA assesses customer feedback and media headlines to gauge sentiment but faces challenges with the brevity, abbreviations, and financial terminologies in social media content. Earlier studies used human-annotated text to create LBMs for training MLAs in SA. However, these models lacked robustness and failed to capture the full range of natural language semantics. Our research used advanced natural language processing to address this gap, gathering customer reviews from Hellopeter and financial data from the top five JSE-listed financial institutions in South Africa. We employed OpenAI's ChatGPT as a zero-shot learning model to produce human-like annotations for sentiment tasks. The feature vector from ChatGPT was input into BERT, BiLSTM, and a SoftMax function to measure and categorize sentiment. Oversampling methods addressed data imbalance, and visualization techniques were applied to review text and polarity. Our method performed as well as or better than recent cutting-edge methods, achieving an average score of 98.9%, an F1-measure of 97.7%, and an AUC of 91.90% with oversampling. Traditional LBMs, SVMs, and logistic regression achieved 86.68% accuracy and an AUC of 91.90%. The study demonstrates ChatGPT’s competence in annotating customer reviews with emotional tone or polarity, highlighting the benefits of integrating customer SA with financial analysis to prioritize customer preferences. To overcome LBMs' limitations and pre-defined sentiment lexicons, we developed LFEAR, which combines the RAG model with a conversational format for an ARFT. Fine-tuned on HelloPeter reviews, LFEAR demonstrated resilience and flexibility in analyzing sentiments across various domains. It achieved an average answer precision score of 98.45%, correctness of 93.85%, and context precision of 97.69% according to RAGAS metrics. The LFEAR model effectively conducted SA over multiple domains, demonstrating adaptability, proper sentiment annotation, and bias-free analysis. This approach is particularly beneficial for social media posts by financial sector stakeholders, including investors and institutions whose posts impact JSE-listed entities.
A structured-based genetic programming generation construction hyper-heuristic with transfer learning for combinatorial optimisation
Scheepers, Darius (University of Pretoria, 2024-12)
Genetic programming and variants of genetic programming such as grammar-based genetic program ming have predominately been used in generation construction hyper-heuristics (GC-HH). Previous work has also shown the effectiveness of transfer learning in genetic programming generation hyper heuristics. Structure-based genetic programming (SBGP) uses both the fitness of an individual and its structure to direct the search in a search space. This study investigates the use of a structure-based genetic programming hyper-heuristic (SBGP-HH) in generation construction hyper-heuristics. The use of SBGP-HH with transfer learning (SBGP-HH-TL) is also investigated. The proposed approaches were evaluated on the examination timetabling, one dimensional bin-packing and capacitated vehicle routing problems. SBGP-HH was found to outperform the canonical genetic programming hyper-heuristic (CGP-HH) for the selected problem domains. SBGP-HH-TL produced better results than SBGP-HH with statistical significance on most problem instances. These results were found to be statistically significant at the 90% level of confidence. SBGP-HH-TL was found to outperform CGP-HH with transfer learning (CGP-HH-TL) for the selected problem domains.
Assessing interpretability in machine translation models for low-resource languages
Gomba, Tsholofelo (University of Pretoria, 2024-12)
In recent years, we have seen an increase in the adoption of Large Language Models (LLM) usage across many different applications. A practical example is OpenAI’s ChatGPT, a tool based on InstructGPT that uses pre-training combined with questioning answering and guidance with reinforcement learning with human feedback. A gap that still exists, the need for better coverage of low resource languages, has led to a substantial amount of research focused on multilingual LLMs in the Natural Language Processing (NLP) domain bringing about models such as NLLB-200, Glot500-m, and BLOOM. However, most of these black box multilingual LLMs fail at representing low resource languages, especially when applied to translation tasks, as their internal logic remain hidden from the user. This leaves one unable to account for or explain reasons for failures in real-life translations tasks. This research investigates the performance and interpretability of two models, a LLM and a small-scale model, trained on low-resource language pairs Xhosa Zulu and Tswana-Zulu. Both models make use of the transformer architecture. The research aims to evaluate the differences in translation quality and interpretability between the models, examining the role of attention mechanisms in capturing context and ensuring correct translations. The research aims to evaluate the (1) differences in translation quality and interpretability between models of different scales, (2) the impact of training dataset sizes on translation quality, and (3) the effectiveness of post-model eXplainable AI (XAI) methods in evaluating generated translations and model efficiency in low-resource language settings. The post-model methods used are attention pattern analysis, BLEU scores, MMD scores and human evaluation methods. We conclude that larger models handle linguistic complexities better, training on larger datasets generally improves translation quality, and diverse post-hoc evaluation methods are essential for a comprehensive assessment. This analysis contributes to a better understanding of the strengths and weaknesses of different model scales in machine translation, guiding future developments in XAI for machine translation of languages such as Swati, Tshiluba, Yoruba and other low-resource languages.
Cybersecurity : the intelligent discovery of malicious bots
Mbona, Innocent (University of Pretoria, 2024-12-13)
This thesis proposes a methodological approach named CySecML, which provides a framework for developing intelligent ML-based cybersecurity solutions that can assist cyber threat intelligence (CTI) procedures to effectively discover cyber threats launched by bots on IAPs. The CySecML methodology is based on two components - data preparation and the InternetBotDetector model, as it aims to optimise existing techniques that include data quality checks, feature selection and ML on cybersecurity data sets. To provide proof-of-concept of this methodology, two different IAPs namely - online social networks (OSNs) and network intrusion detection systems (NIDSs) were chosen to discover bot cyberattacks.
Harnessing cross-lingual transfer learning techniques to facilitate interventions for low-resourced languages
Sindane, Thapelo Andrew (University of Pretoria, 2024-09-10)
The world continues to witness increasingly complex technological, economic, and societal advancements at an accelerated pace in the space of Natural Language Processing (NLP) and Artificial Intelligence (AI). The availability of massive digital data in various forms such as language data, image data, and numeric data plays a profound role in supporting this upward trend. For example, the availability of tremendous volumes of English data and other high internet prevalent languages unlocks the ability to develop high-quality language technologies such as Generative AI systems, Question Answering systems, Translation systems, and other societally impactful technologies we see today. This new era unfolds a simple yet efficacious equation that takes the form (increased datasets = increased performance) operating with proportionality mechanics. Despite the remarkable strides, a concerning consequence has emerged $ - $ a widening horizontal divide among globally spoken languages. A divide that highlights disparities of benefits from available language technologies across the 7000-plus spoken languages. Key impedes that emerge in addressing such disparities for the underserved languages include data availability, data benchmarking, scaling, internet prevalence, sustainable pipelines, coverage, and lack of expertise. In this work, we extensively scrutinize some of these concerns by first grounding our work in the context of South African languages. South Africa has 12 official languages with varying states of resource-prevalence which provided a perfect case to demonstrate our proposed remedial approaches. To address benchmarking we proposed standard datasets for all spoken languages; Scaling is addressed by showcasing the use of bilingual lexicons as a resource with much higher linguistic coverage to define various techniques that continuously improve our machine learning models; and Coverage is demonstrated by accounting for all South African languages in the development of technologies. The main objective of this thesis is to investigate cross-lingual embeddings as cheaper interventions to administer transfer capabilities of various machine learning models across various downstream tasks, in order to foster the development, and accessibility of local technologies for low-resourced languages. Cross-lingual embeddings are intra-semantic and inter-translation equivalent representations between high-resourced and low-resourced languages. For this work, these cross-lingual embeddings have demonstrated efficacy in tasks such as News Headlines Classification (NHC), Named Entity Recognition (NER), Part of Speech (POS) Tagging, Machine Translation (MT), and have shown great potential for the development of localized technologies. The investigations showed that training NLP models with cross-lingual embeddings enhances both transfer and learning-from-scratch capabilities compared to monolingual embedding training. This study also highlighted that increasing supervision signals such as bilingual lexicons for training cross-lingual embeddings also improves their performance. Furthermore, our investigations indicated that no single cross-lingual model works well across all languages. We were able to address 4 key performance point and we hope the interventions proposed in this study will have a positive impact on the socio-economic status of South Africa and can be scaled to other contexts to empower societies and businesses.
Multimodal misinformation detection in the South African social media environment
De Jager, Amica (University of Pretoria, 2024-10)
The prevalence of the computer information system, personal communication devices, and the globalisation of the Internet and social media such as Facebook, Twitter and many more have reshaped our lives. These online social media platforms have revolutionised communication and information processing. People use these online social media platforms conveniently to share perspectives or personal messages in text, images, and video. However, while people enjoy social media or online social networking sites with snippets of textual and visualised content, deceptive activities like misinformation, disinformation, fake news, rumours, and spam mislead users by providing false information. Therefore, the widespread dissemination of information on social media and the Internet poses serious potential hazards to critical infrastructures like national security, health, and supply chains, potentially leading to shortages of essential commodities. Misinformation during the 2020 United States presidential election led to widespread confusion and public distrust, highlighting the need for users to critically assess information before believing it. Misinformation detection (MD) on social media has garnered significant attention and is a growing area of research interest. Unfortunately, existing methods often do not utilise textual and visual content simultaneously to understand the related and unrelated information so as to quantify the reported information as real information or not, particularly in the South African social media context. Furthermore, these methods heavily depend on manually crafted features from data and find it challenging to detect subtle forms of false information. The current methods are time-consuming, inefficient, and need constant updates for new trends, limiting their adaptability. In this dissertation, we are seeking to investigate the efficacy of misinformation detection models within the context of the South African social media environment. As a result, we proposed MMiC, a multimodal misinformation detection (MD) model that draws on a variety of information sources, including textual and visual aspects. Firstly, we use a pre-trained BERT model as a transformer-based model as an encoder to learn the underlying psychological representation in the textual data in a natural language, then use a pre-trained ResNet model to decode the visual content. Secondly, we amalgamated both the encoding and decoding layers over a fully connected layer and a SoftMax function to make the prediction. Throughout the investigation, the MMiC model undergoes comparisons with other baseline models and optimizations across multiple design cycles. These cycles involve developing the base framework, selecting the optimal combination of textual and visual encoders, and comparing different methods of multimodal feature fusion. The MMiC model is assessed in both a general context and specifically in the local South African context. The experiment results show that the MMiC model performs as well as the best current MD models (88% of the time) on the benchmark dataset (Fakeddit); adding local samples to the training dataset improves model performance by an average of 29%; and the MMiC model can accurately spot false information on South African social media sites (89% of the time). The results show that cultural differences in the places where MD models work affect their performance and that utilising multiple forms of communication can enhance knowledge transfer across various settings. Incorporating local data into training misinformation detection models is crucial to enhancing their performance. Moreover, including data from the local context helps ensure that the models are effective and accurate in various settings. We firmly believe that MMiC has the potential to facilitate the development and implementation of a misinformation detection system to combat misinformation in South Africa. Limitations encountered in this research include: obtaining access to existing MD datasets and state-of-the-art pre-trained models. Recommendations for future research involve expanding the subset of the local dataset that was used in this research to include samples from all social media platforms. Another recommendation would be to investigate the use of more complex methods in which to fuse the multimodal feature vector.
Exploring cross-lingual learning techniques for advancing Tshivenda NLP coverage
Nemakhavhani, Ndamulelo (University of Pretoria, 2023-06)
The information age has been a critical driver in the impressive advancement of Natural Language Processing (NLP) applications in recent years. The benefits of these applications have been prominent in populations with relatively better access to technology and information. On the contrary, low-resourced regions such as South Africa have seen a lag in NLP advancement due to limited high-quality datasets required to build reliable NLP models. To address this challenge, recent studies on NLP research have emphasised advancing language-agnostic models to enable Cross-Lingual Language Understanding (XLU) through cross-lingual transfer learning. Several empirical results have shown that XLU models work well when applied to languages with sufficient morphological or lexical similarity. In this study, we sought to exploit this capability to improve Tshivenda NLP representation using Sepedi and other related Bantu languages with relatively more data resources. Current state-of-the-art cross-lingual language models such as XLM-RoBERTa are trained on hundreds of languages, with most being high-resourced languages from European origins. Although the cross-lingual performance of these models is impressive for popular African languages such as Swahili, there is still plenty of room left for improvement. As the size of such models continues to soar, questions have been raised on whether competitive performance can still be achieved using downsized training data to minimise the environmental impact yielded by ever-increasing computational requirements. Fortunately, practical results from AfriBERTa, a multilingual language model trained on a 1GB corpus from eleven African languages, showed that this could be a tenable approach to address the lack of representation for low-resourced languages in a sustainable way. Inspired by these recent triumphs in studies including XLM-RoBERTa and AfriBERTa, we present Zabantu-XLM-R, a novel fleet of small-scale, cross-lingual, pre-trained language models aimed at enhancing NLP coverage of Tshivenda. Although the study solely focused on Tshivenda, the presented methods can be easily adapted to other least-popular languages in South Africa, such as Xhitsonga and IsiNdebele. The language models have been trained on different sets of South African Bantu languages, with each set chosen heuristically based on the similarity to Tshivenda. We used a novel news headline dataset annotated following the International Press Telecommunications Council (IPTC) standards to conduct an extrinsic evaluation of the language models on a short text classification task. Our custom language models showed an impressive average weighted F1-score of 60% in few-shot settings with as little as 50 examples per class from the target language. We also found that open-source languages like AfriBERTa and AFroXLMR exhibited similar performance, although they had a minimal representation of Tshivenda and Sepedi in their pre-training corpora. These findings validated our hypothesis that we can leverage the relatedness among Bantu languages to develop state-of-the-art NLP models for Tshivenda. To our knowledge, no similar work has been carried out solely focusing on few-shot performance on Tshivenda.

Browse

Recent Submissions