Requirements and Procedure for an External Master Thesis
This page is for:
- Students who want to do their master thesis on computer security at a company rather than at the TU/e, with a member of the Security Cluster as TU/e supervisor.
- Companies that want students to carry out a master thesis on security at their premises, with a member of the Security Cluster as TU/e supervisor.
Both the student and the company supervisor must commit to the procedure described here before the preparation phase starts.
Why these requirements
Doing the master thesis at a company rather than at the TU/e can benefit the student, the company and the relationship between the university and the company.
However, external master theses run into difficulties much more often than internal ones: the student risks not finishing in time, or delivering work that is not as good as it should be. The main cause is that companies often do not realize what a student has to accomplish to finish a master thesis, while the TU/e supervisor has little control over the work done at the company.
This page gives the minimum information that the student and the company should know, to make life easier for the student, for the company hosting them, and for the TU/e supervisor. It complements the TU/e rules for graduating in the master Computer Science and Engineering, described in the education guide.
What a master thesis consists of
Graduation consists of two consecutive parts:
The preparation phase (10 credits, normally one quarter, about 2.5 months) turns the topic into a well-defined and feasible project. It ends with a project proposal, presented to the TU/e supervisor, that contains:
- a precisely defined scientific question;
- the state of the art, based on a thorough literature study;
- the expected result and the research approach, including how the solution will be validated;
- a feasibility study: for instance initial experiments, a small case study, and evidence that the data, tools and facilities needed for the validation are available;
- a project plan with milestones and deliverables.
The preparation phase is assessed as pass or fail. A student who fails has to do a new preparation phase with a different supervisor.
The master project (about 6 months) carries out the plan:
- a (possibly partial) solution to the question, typically an artefact such as a computer program;
- a validation of the solution. This part is often “forgotten”, but it is crucial: the student must show that the solution actually solves the problem at hand, for instance with experiments or a theoretical proof. Often this requires a comparison with other systems in the literature, showing that the student’s solution is “better” than existing ones;
- a high-quality thesis, with a proper introduction, literature study, description of the solution, validation, conclusions and future work, defended in a public final presentation.
Supervision
There is little time, therefore: by taking a master student, a company takes the responsibility of providing proper supervision and guidance to the student, from the start of the preparation phase.
A student doing an external master thesis has two supervisors:
- The company supervisor, a company employee, is the main supervisor of the day-to-day work.
- The TU/e supervisor, a member of the Security Cluster, checks the quality of the work and assesses the preparation phase.
Since most of the work is done at the company, the company supervisor takes the responsibility of providing appropriate supervision to the student. The company supervisor:
- monitors the student’s progress at least weekly and makes sure that the timeline below is met;
- has enough domain knowledge to guide the student towards a suitable methodology and to point out the current state of the art (literature);
- can guarantee the availability of the data, instruments or facilities (if any) needed to validate the solution;
- knows what supervising a master thesis involves, holding an MSc or a PhD degree.
Timeline
The student and the company supervisor together commit to the following timeline. The thesis only continues past a go/no-go check if the milestone is met.
Preparation phase
| When | Milestone |
|---|---|
| Before the start | The student goes through the initial checklist with the company supervisor and discusses it with the TU/e supervisor. Go/no-go check. |
| Within 1 month | A draft of the introduction is presented to the TU/e supervisor: the topic and a proper description of the (scientific) question at hand. |
| Within 2 months | A draft of the literature study is presented to the TU/e supervisor. |
| End of the quarter | The project proposal, including the feasibility study, is presented to the TU/e supervisor. Go/no-go check: the preparation phase is assessed as pass or fail. |
Master project
| When | Milestone |
|---|---|
| Months 1 to 3 | The solution is developed, and is ready and presented to the TU/e supervisor by month 3. |
| Around month 3 | Mid-term presentation at the TU/e, illustrating the progress. |
| Around month 4 | The solution is validated. |
| Last 2 months | Writing of the thesis, ending with the public final presentation and defence. |
Initial checklist
Before the preparation phase starts, the student, together with the company supervisor, should have a clear idea of the answers to the questions below. They do not need to be final: the preparation phase works them out, together with the methodology, into the project proposal.
- What is the topic of the thesis?
- What is the scientific question?
- What are you going to deliver (which kind of results)?
- How are you going to validate your results?
- Which data, tools or instruments do you need to validate the results?
- Are the data, tools or instruments already available?
- Who is in charge of them at the company?
- If you need data:
- How much data do you need?
- How much data is available?
- Who is responsible for the data at the company? Have they already committed to making the data available?
- How do we deal with privacy regulations?
- Who is the company supervisor?
- How often is the company supervisor going to meet the student?
Have a good idea of how you are going to validate your solution, and make sure that the data, instruments and facilities required for the validation are available by the end of the preparation phase, with the appropriate permissions in place. The feasibility study must show this; a project that cannot be validated does not pass.
For instance, a thesis on intrusion detection needs lots of data to check the false positive rate, enough realistic attack samples to check the detection rate, and access to other intrusion detection systems from the literature (which you may have to build from their algorithms). Where it often goes wrong is that (a) the company provides no data because of confidentiality or privacy, or (b) there are no attack samples, often because the company does not really know what it is looking for, so there is no threat model.
Agreements with the company
Companies often require an agreement covering liability, confidentiality and intellectual property, and the thesis itself can be kept confidential for a limited period. Arrange this a couple of months before the preparation phase starts, through the Academic Advisor, as described on the TU/e page on graduation in a company.
Recipes for disaster
- Company to student: “Come here and do whatever you want”, which is just as dangerous as “Define your own project”. If this is the starting point, there is no added value in doing the thesis at the company, and most likely nobody at the company is able to supervise the student properly. The unguided student usually wastes too much time not really knowing what they want, let alone how to achieve it.
- Company to student: “Find anomalies in this dataset”. The obvious follow-up question is “What are you looking for?”. If the answer is “anything” or “I don’t know”, the thesis is not going to work.
Based on the document “Requirements and procedure for doing an external master thesis” by Sandro Etalle, with input from Boris Škorić, Nicola Zannone and Jerry den Hartog (2016), updated for the preparation phase.