Graduate School of Informatics

This thesis proposes a cyber resilience orchestration framework that extends security orchestration beyond conventional detection and response. The framework integrates Large Language Model (LLM) agents, expert-validated playbooks, automation readiness controls, and API recommendation mechanisms to support automated and human-controlled resilience operations. Experimental evaluations demonstrate the feasibility of the proposed approach under controlled conditions.

Date: 03.09.2026 / 15:00 Place: A-108

This thesis develops grounded, explainable scene understanding for sensitive-content moderation. It introduces SenBen, a benchmark of 13,999 movie frames annotated with scene graphs and sensitivity tags, and SenBen-Score, a recall-oriented metric. A vocabulary-aware distillation framework transfers Gemini annotations to a compact 241-million-parameter Florence-2 model using suffix-based object identity, Vocabulary-Aware Recall loss, and a separate sensitivity-tag head. The resulting model outperforms evaluated vision-language models except Gemini and all tested commercial safety APIs on the composite benchmark, while running 7.6 times faster and using 16 times less GPU memory than the strongest competing local model.

Date: 01.09.2026 / 11:00 Place: A-212

This thesis compares generative and encoder-based language models for multilingual phishing email detection on local, resource-constrained environments. Utilizing the synthetic Turkish OLTA-TR dataset built on Cialdini's persuasion principles, we train models to identify psychological manipulation rather than static keywords. Experimental results on MeAJOR and OLTA-TR demonstrate that while generative models exhibit latency issues and formatting instability due to a helpful AI bias, fine-tuned classification models achieve superior accuracy, highlighted by mmBERT's 99.49% Macro F1-Score. A dual-layer interpretability framework is also introduced to explain model decisions, concluding that classification models provide more secure real-time defense.

Date: 02.09.2026 / 10:00 Place: A-212

This thesis introduces a complexity measure for four UML diagram types, so that model performance can be analysed by difficulty level. It also builds an evaluation framework that scores a generated diagram against its reference automatically. Six locally deployable models and a 70B frontier model were run on class, sequence, state, and activity diagrams. The best local model was then improved through complexity-aware few-shot in-context learning. Each request was paired with an example matched to the complexity level of the target diagram. This lifted the model above the 70B model on three of the four types.

Date: 26.08.2026 / 10:00 Place: A-108

This thesis examines the operational performance of incident investigations in home health care, using routinely collected records from a US home healthcare provider (July 2023–December 2025; 493 mandatory investigations). Prolonged investigations were defined through an empirical 80th-percentile threshold (≥15 days), classifying 20.1% of cases. The prolonged rate remained statistically stable over the 29-month period. Nested logistic regression showed that incident category did not explain prolongation, whereas the organizational unit significantly improved model fit; county-level rates ranged from 0% to 58.3%. The study offers a transferable, data-driven approach for monitoring investigation performance without additional data collection.

Date: 03.09.2026 / 10:30 Place: A-212