In Portugal, in the year 2022, there were 32.788 reported road accidents. Among the identified causes, driver fatigue emerged as the second major contributor to these incidents. Efforts to address this issue have resulted in the development of legislation over the years. Concurrently, aligning with initiatives in the European Union, the Fédération Internationale de l'Automobile (FIA) has actively promoted collaboration with the automotive industry to integrate safety-enhancing systems in vehicles, aiming to alleviate challenges such as driver fatigue. The proposed strategy represents an intermediary solution, bridging the gap between the security provided by in-vehicle systems and the accessibility offered by mobile systems. The project's overarching goal is to ensure cost-effectiveness, efficiency, and widespread applicability. Leveraging Microsoft's Face API technology, the project seeks to capitalize on artificial intelligence to unlock a range of features, thereby achieving tasks that were previously deemed impractical or financially burdensome.

At present there are many intermediaries for the acquisition of tourist plans, which in some situations represent a risk, because they promise great offers and when the client is going to enjoy what they have acquired, they get unwanted surprises. For this reason, the platform described in this work for the reservation of tourist plans allows companies to offer different activities so that travelers can put together their vacation packages, considering that each of the parties will ensure compliance with the service, using smart contracts and blockchain technology.

The police have accompanied humanity throughout history: no city can exist without policing — it is a fundamental good. The police guarantee citizenship by ensuring security, the foremost of freedoms and the foundation of the social contract; without security, freedom evaporates. Today, policing is expressed in the singular but materializes in the plural — it is glocal. Although the idea of policing is global, police models vary from country to country: Portugal adopts a dual model — a Napoleonic legacy reflected in its security forces. As part of the Public Administration, the Portuguese police carry out the coercive control of delinquency.

The world is witnessing the emerging role of Internet of Things (IoT) as a technology that is transforming different industries, global community and its economy. Currently, a plethora of interconnected smart devices have been deployed for diverse pervasive applications and services, and billions more are expected to be connected to the Internet in the near future. The potential benefits of IoT include improved quality of life, convenience, enhanced energy efficiency, and more productivity. Alongside these potential benefits, however, come increased security risks and potential for abuse. Arguably, this is partly because many IoT start-ups and electronics hobbyists lack security expertise, and some established companies do not make security a priority in their designs, and hence they produce IoT devices that are often ill-equipped in terms of security. In this paper, we discuss different IoT application areas, and identify security threats in IoT architecture. We consider security requirements and present typical security threats for each of the application domains. Finally, we present several possible security countermeasures, and introduce the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework, which is still under development. IoT-HarPSecA is aimed at facilitating the design and prototyping of secure IoT devices.

Nowadays, the variety of technology to perform daily tasks is abundant and different business and people benefit from this diversity. The more technology evolves, more useful it gets and in contrast, they also become target for malicious users. Cloud Computing is one of the technologies that is being adopted by different companies worldwide throughout the years. Its popularity is essentially due to its characteristics and the way it delivers its services. This Cloud expansion also means that malicious users may try to exploit it, as the research studies presented throughout this work revealed. According to these studies, Denial of Service attack is a type of threat that is always trying to take advantage of Cloud Computing Services. Several companies moved or are moving their services to hosted environments provided by Cloud Service Providers and are using several applications based on those services. The literature on the subject, bring to attention that because of this Cloud adoption expansion, the use of applications increased. Therefore, DoS threats are aiming the Application Layer more and additionally, advanced variations are being used such as Low-Rate Distributed Denial of Service attacks. Some researches are being conducted specifically for the detection and mitigation of this kind of threat and the significant problem found within this DDoS variant, is the difficulty to differentiate malicious traffic from legitimate user traffic. The main goal of this attack is to exploit the communication aspect of the HTTP protocol, sending legitimate traffic with small changes to fill the requests of a server slowly, resulting in almost stopping the access of real users to the server resources during the attack. This kind of attack usually has a small time window duration but in order to be more efficient, it is used within infected computers creating a network of attackers, transforming into a Distributed attack. For this work, the idea to battle Low-Rate Distributed Denial of Service attacks, is to integrate different technologies inside an Hybrid Application where the main goal is to identify and separate malicious traffic from legitimate traffic. First, a study is done to observe the behavior of each type of Low-Rate attack in order to gather specific information related to their characteristics when the attack is executing in real-time. Then, using the Tshark filters, the collection of those packet information is done. The next step is to develop combinations of specific information obtained from the packet filtering and compare them. Finally, each packet is analyzed based on these combinations patterns. A log file is created to store the data gathered after the Entropy calculation in a friendly format. In order to test the efficiency of the application, a Cloud virtual infrastructure was built using OpenNebula Sandbox and Apache Web Server. Two tests were done against the infrastructure, the first test had the objective to verify the effectiveness of the tool proportionally against the Cloud environment created. Based on the results of this test, a second test was proposed to demonstrate how the Hybrid Application works against the attacks performed. The conclusion of the tests presented how the types of Slow-Rate DDoS can be disruptive and also exhibited promising results of the Hybrid Application performance against Low-Rate Distributed Denial of Service attacks. The Hybrid Application was successful in identify each type of Low-Rate DDoS, separate the traffic and generate few false positives in the process. The results are displayed in the form of parameters and graphs.

Este relatório apresenta e discute o meu projeto de investigação sobre a segurança, eficácia e aceitabilidade de produtos veterinários com água termal Monfortinho para animais de companhia, bem como o estágio em Farmácia Comunitária. O primeiro capítulo centra-se na investigação que desenvolvi a partir de um estudo in vivo com vinte e quatro utilizadores finais (doze cães e doze gatos) de dois produtos para uso veterinário com água termal Monfortinho. O estudo envolveu um produto de higiene auricular e um champô de espuma seca perfumada, já autorizados para comercialização, de forma a verificar a segurança, eficácia e aceitabilidade. O estudo também abordou as desvantagens, como estas afetam a adesão ao produto e identificou preferências gerais através de classificações dos utilizadores (tutores) para este tipo de produto. Os produtos estudados foram bem aceites pelos utilizadores (tutores) quanto à avaliação sensorial (cheiro, toque, consistência e cor) e desempenho. Em relação à segurança e eficácia, tanto o champô de espuma seca perfumada, quanto o produto de higiene auricular foram classificados como produtos seguros e eficazes. Quanto às características relevantes na escolha de produtos veterinários para animais de companhia, as mais valorizadas foram eficácia/resultados positivos, cheiro, preço e origem dos excipientes. Relativamente ao local de compra de produtos veterinários para animais de companhia, a maioria dos inquiridos refere que o faz na clínica veterinária ou farmácia. A avaliação das características mais valorizadas pelos inquiridos apoia o desenvolvimento de produtos que se adequam às necessidades dos consumidores, o que irá aumentar a adesão a estes produtos. O segundo capítulo contém a descrição dos conhecimentos que adquiri e atividades que desenvolvi durante o estágio curricular em Farmácia Comunitária, que se realizou entre 7 de fevereiro e 13 de novembro de 2023, na Farmácia Taborda, no Fundão, com a orientação da Dr.ª Cristina Almiro.

Atualmente existem diferentes formas de produzir uma aplicação World Wide Web (WEB). Várias linguagens de programação dão suporte direto ou indireto a este tipo de desenvolvimento e sobre estas existem inúmeras frameworks já desenvolvidas. Com a fragmentação do desenvolvimento WEB distribuído por várias tecnologias, uma simples aplicação WEB, na grande maioria dos casos contém código PHP, HTML e JavaScript. Esta situação pode dar azo a erros sintáticos e semânticos durante o processo de produção, que vão ser refletidos no cliente. De forma a resolver grande parte destes problemas foi criada a framework Ocsigen. O seu slogan é ”develop once, safely deploy everywhere” e tem como mais valia, a possibilidade de construir uma aplicação WEB completa, tanto parte cliente como parte servidor, exatamente com a mesma linguagem de programação, nomeadamente a linguagem Objective Categorical Abstract Machine Language (OCaml). Esta é também, a linguagem utilizada na construção da framework Ocsigen. O OCaml é uma linguagem de base funcional, multiparadigma de alto nível e fortemente tipificada. Tem por base, um poderoso compilador capaz de tornar o código produzido em algo extremamente determinístico a nível de segurança de tipos. Apesar da framework Ocsigen herdar características subjacentes à linguagem OCaml esta apresenta algumas limitações relativas à curva de aprendizagem, utilização devido à falta de documentação atualizada e instalação em diferentes sistemas operativos, como é o caso do Windows. A presente dissertação tem como objetivo encontrar soluções para as limitações mencionadas. Para conseguir o objetivo proposto é então delineado um plano, que passa numa primeira fase, pelo estudo aprofundado da framework Ocsigen. Para que com base nos resultados obtidos seja possível compreender o seu funcionamento e contexto, como também as suas limitações, de forma mais detalhada, assim como os respetivos pontos críticos, nomeadamente a sua utilização e o suporte a diferentes sistemas operativos. Posteriormente, com base nestes dados é então projetada uma solução, que irá concretizar-se na forma de uma nova framework, a framework Ocsi_Simple. Esta nova framework irá agora permitir o uso da tecnologia Ocsigen, de forma mais amigável, simples e mais apetecível para a indústria do desenvolvimento WEB. É importante frisar que esta solução pretende completar a framework Ocsigen.

This thesis addresses the gap between security engineering and software engineering in the cloud and mobile ecosystem. It proposes a virtual assistant to be integrated into every phase of the Software Development Lifecycle (SDLC) of such an ecosystem, ensuring that security and privacy are prioritized from the initial phases until the application or system is operational (guaranteeing security and privacy by default). The underlying work lies at the intersection of software engineering, systems engineering, and computer security, and was primarily motivated by the rise of mobile applications with security vulnerabilities that rely on cloud support. The main argument is that not all development teams have computer security experts. To improve security in mobile app development (and in the underlying systems), it is essential to use guided processes that include security engineering. These processes should create system and attack models, identify security requirements, and develop documentation such as security practice guidelines and attack models. Additionally, it is essential to integrate security mechanisms to eliminate coding and design vulnerabilities, as well as implement specific security tests and tools to ensure the system meets its Non-Functional Requirements (NFR). To achieve the main objective, several intermediate steps were needed, some of which comprise additional contributions from this work. First, a detailed survey of existing architectures and modeling tools for cloud and mobile devices was conducted in order to identify the challenges involved in developing secure mobile applications. Next, a model for a cloud and mobile ecosystem that encompasses various components, including the Internet, cloud, and mobile, with a focus on security, was proposed. Within each component, the attack surfaces and key targets for potential attackers were identified. In addition, a taxonomy of common attacks, mechanisms, and countermeasures was developed for the cloud and mobile ecosystem, pinpointing where attacks are likely to occur. This task was complemented by the analysis of security tests and their tools, linking each test to specific threats or attacks they aim to mitigate. Finally, it was necessary to clarify the processes, transpose them into prototyped software tools, and test them. This resulted in the creation of the Security by Design for the Cloud and Mobile Ecosystem (secD4CloudMobile) framework, which consists of five tools: Cloud Mobile Security Requirements Elicitation (CMSRE), Cloud Mobile Security Best Practices Guidelines (CMSBPG), Cloud Mobile Security Mechanism Elicitation (CMSME), Cloud Mobile Attack Modeling Elicitation (CMAME), and Cloud Mobile Security Tests Specification and Automation Tools (CM2ST). The framework aims to provide developers of cloud-based mobile applications with useful and easily applicable information and guidelines. Its goal is to bridge the gap between software engineering and security engineering, making the latter more accessible and automated, thereby incorporating security from the very beginning of the development process. These tools are practical contributions of this work. Given the impact of Artifical Intelligence (AI) on technology and security, several experiments were conducted to explore the possibility of replacing the aforementioned framework tools with AI models. These experiments involved applying Machine Learning (ML) classification techniques to datasets generated by automating responses to questionnaires related with generating security requirements, best practices, security mechanisms, attack models, and security test specifications, as well as tools for automating these processes. The thesis discusses some of the results of these experiments, demonstrating the potential benefits of incorporating this approach into security engineering. The main findings reflect the successful creation of various tools and mechanisms to support the secure development of cloud-based mobile applications for inexperienced programmers. Usability tests conducted for the prototyped tools have shown that the target audience is interested in utilizing the framework tools with System Usability Scale (SUS) score above 72 points. Furthermore, AI and ML can help maintain these security measures over time, addressing the ongoing challenge of keeping them relevant in rapidly changing environments.

The current vision of the Internet of Things (IoT) is to ensure that everything from everywhere is connected to the Internet at all times using Internet Protocol (IP). This idea has the potential of making homes, cities, electric grids, among others, safer, more efficient, and easier to manage. Nevertheless, a number of obstacles still remain to fully realize the IoT vision, with security and privacy among the most critical. Ensuring security and privacy in the IoT is particularly complicated, especially for the resource-constrained devices due to finite energy supply and low computing power. These factors are typically at odds with most of the existing security protocols and schemes proposed for the IoT because of the intensive computational nature of the cryptographic algorithms involved. This paper performs an extensive comparison of previous surveys on the subject, and shows its novelty with respect to the previous work. It describes 9 application domains and presents, in detail, security requirements, system models, threat models along with protocols and technologies for those 9 application areas. The survey also performs an exhaustive examination of some existing mechanisms and approaches proposed in the literature for ensuring security and privacy of IoT devices. Finally, it outlines some open research issues associated with IoT security.

Será elaborado nesta dissertação de mestrado o projeto de criação de uma secção de hidráulicos num hangar de manutenção de aeronaves, tendo em vista a diminuição de tempo de chão dos aviões da companhia no que a componentes hidráulicos diz respeito. Este projeto foi desenvolvimento com base num estágio realizado na empresa SATA Air Açores, pelo que, o estudo que será aqui apresentando teve como princípios as próprias necessidades da empresa e o espaço real onde será projetada esta secção de componentes hidráulicos, seguindo os protocolos em vigor. Deste modo, ao longo deste trabalho de estudo, serão abordados primeiramente aspetos mais técnicos que se devem ter em conta antes da criação da própria secção, mas também uma avaliação das necessidades técnicas da empresa e posteriormente aspetos mais práticos que se baseiam na escolha do banco de hidráulicos e nos componentes físicos necessários para que a secção esteja operacional, tendo por base as unidades hidráulicas rotáveis e reparáveis da aeronave Bombardier Q400 Nextgen, presente na frota da SATA Air Açores.