The schedule below is preliminary and subject to change. We will also announce the poster presentation groups soon.
Monday, June 29, 2026
Ph.D. School Day 1
08:30 – 09:00Registration and Badge Collection (Echo Foyer)
09:00 – 09:05Welcome Address
09:05 – 10:30A Haystack Full of Needles: Detecting and Understanding Botnets in the Wild
Speaker: Georgios Smaragdakis, TU Delft
Abstract: Botnets and associated malware are not new, but they consistently rank among the top cybersecurity threats. In this talk, I will provide an overview of our ongoing efforts to detect compromised devices early, identifying those ready to be weaponized as bots. I will present our method to identify compromised SSH servers at scale. For this, we utilize SSH’s behavior to send a challenge only during public key authentication, checking if the key is present on the system. Our technique neither allows us to access compromised systems (unlike, e.g., testing known attacker passwords), nor does it require access for auditing purposes. I will share our experience on enabling targeted clean-up efforts. I will also present how the research network infrastructures we operate enable the detection of botnet campaigns at an early stage, shed light on the evolution and firepower of botnets, and contribute to reverse engineering, attribution, and the takedown of botnets.
Bio
Georgios Smaragdakis is a Professor of Cybersecurity at Delft University of Technology, currently appointed as a visiting Professor of Computer Science at Stanford University. He is also a researcher with the Max Planck Institute for Informatics and the Berlin Institute for the Foundations of Learning and Data. In the past, he held research positions at the MIT Computer Science and Artificial Intelligence Laboratory, the MIT Internet Policy Research Initiative, TU Berlin, Boston University, and at research labs, including Akamai, Deutsche Telekom Labs, and Telefonica Research. His research was awarded a European Research Council Starting Grant, a Marie Skłodowska-Curie International Outgoing Fellowship, Best Paper Awards at USENIX Security, ACM SIGCOMM, ACM IMC, ACM CoNEXT, IEEE INFOCOM, and several prizes, including the 2025 USENIX Internet Defense Prize, IETF/IRTF Applied Networking Research Prizes, “Best of Computer Communication Review”, and Communications of the ACM Research Highlights.
10:30 – 11:00Coffee Break
11:00 – 12:305 Lessons from 5 Years of Internet Measurements at Cloudflare
Speaker: Vasileios Giotsas, Cloudflare
Abstract: In this talk I share five lessons from five years of internet measurement research at Cloudflare, and how that work overlaps with engineering, product, and policy. I will look at what it takes to turn academic research into production systems, including why some reproductions succeed under real-world constraints and others fail. I will also discuss the reverse direction: the challenges and sensitivities involved in publishing corporate research in academic venues. I will also address the paradox of how operating a massive global network can make Internet measurement harder rather than easier. Finally, I will give a look at managing long-term research projects within a fast-moving industry environment, and explain how we try to balance rigorous research with production-focused delivery.
Bio
Vasileios Giotsas is a Research Engineer at Cloudflare, where he focuses on network measurements and telemetry, the risk assessment and mitigation of topological vulnerabilities of critical Internet infrastructures, and the analysis of Internet routing policies and performance. He also holds a position as Lecturer at the Computer and Communications department of Lancaster University, and has previously worked as a research scientist at the Internet Measurement and Analysis group of TU Berlin and as a postdoctoral researcher at CAIDA, University of California San Diego. His work has been distinguished with the CoNEXT 2015 Best Paper Award and the IETF Applied Networking Research Prize 2016.
12:30 – 13:30Lunch Break
13:30 – 15:00Leveraging latency measurements to validate IP geolocation Part 1
Speaker: Oliver Gasser, IPinfo
Oliver’s tutorial will introduce students to the foundations of IP geolocation validation using latency measurements – covering speed-of-light constraints, multilateration, and ProbeNet – and guide them through hands-on sessions detecting mislocated RIPE Atlas probes and VPN exit nodes using real-world measurement datasets.
Bio
Oliver Gasser is Head of Research at IPinfo, having previously led the Internet Security Measurements research group at the Max Planck Institute for Informatics, where he received his Ph.D. from the Technical University of Munich in 2019. His research interests span Internet measurements, network security, IPv6, and DNS, and he has received the ACM IMC 2017 Community Contribution Award and the IRTF Applied Networking Research Prize, among other distinctions.
15:00 – 16:00Coffee Break and PhD School Poster Session [Group A]
16:00 – 17:00Tutorial A – Oliver Gasser Part 2
17:00 – 17:30End of Day 1
17:30 – 20:00Social Event (Cafe X, on TU Delft campus)
See the Social Events page for more details.
Tuesday, June 30, 2026
Ph.D. School Day 2
09:00 – 10:30Kathará network digital twin Part 1
Speaker: Mariano Scazzariello, RISE
Mariano’s tutorial will introduce students to Kathará as a network digital twin, demonstrating how to design, deploy, and experiment with complex Internet topologies – including routing protocols and network functions – in a lightweight, modular, and reproducible environment.
Bio
Mariano Scazzariello is a Senior Researcher at RISE Research Institutes of Sweden and a maintainer of the Kathará Framework. His research mainly focuses on high-speed networking and programmable networks. He received his PhD in Computer Networks from Roma Tre University, where he co-developed Kathará, an open-source container-based network emulation system that has become a widely adopted tool for research, education, and operational testing.
10:30 – 11:00Coffee Break
11:00 – 12:30Tutorial B – Mariano Scazzariello Part 2
12:30 – 13:30Lunch Break
13:30 – 15:00Measuring the Internet: From BGP Routing Tables to Real Packet Paths Part 1
Speaker: Gerardo Viviers & Ondřej Caletka, RIPE NCC
Gerardo’s and Ondřej’s tutorial will introduce students to the world-class measurement infrastructure operated by the RIPE NCC, used daily by network researchers, operators, and policymakers worldwide. The session is structured as a hybrid tutorial and hackathon, designed to build genuine research skills rather than simply demonstrate tools. Students will learn about RIPE Atlas, RIPEstat, and RIPE RIS, and they will compete to produce a result about one research challenge track.
Bio
Gerardo Viviers is a Senior Learning & Development Officer at the RIPE NCC. He delivers training courses and webinars for RIPE NCC members, as well as LEAs and governmental organizations. Before joining the RIPE NCC in 2009 as an IP Resource Analyst (IPRA), Gerardo worked at several Internet companies in Argentina and the Netherlands providing technical support and training.
Ondřej Caletka is a Senior System Engineer at the RIPE NCC, where he is a technical expert in the Learning and Development team. His main responsibility includes developing and operating the lab environment for training courses and online learning. Ondřej graduated from Czech Technical University in Prague and worked as network services administrator and developer for the Czech national research and education network CESNET before joining the RIPE NCC. He is also active in local IT communities around open source/free software, and acts as an IPv6 and DNSSEC ambassador, delivering talks and trainings at various events.
15:00 – 16:00Coffee Break and PhD School Poster Session [Group B]
16:00 – 17:00Tutorial C – Gerardo Viviers + Ondřej Caletka Part 2
17:00 – 17:30Closing Remarks and Poster Awards
19:30 – 21:30Social Event (dinner at Heinde)
See the Social Events page for more details.