[{"content":" Deployment of software and AI to the cloud and to devices. ","externalUrl":null,"permalink":"/categories/cloud-edge-and-iot/","section":"Focus areas","summary":" Deployment of software and AI to the cloud and to devices. ","title":"Cloud, Edge \u0026 IoT","type":"categories"},{"content":"","externalUrl":null,"permalink":"/projects/funded/","section":"Our projects","summary":"","title":"Funded projects","type":"projects"},{"content":"Homelab is a fully furnished and functional house with extensive test facilities. Custom-built for testing smart home applications in a real living lab.\nVR/AR applications, digital assistants, and home robots. Learn more or contact us to see how Homelab can help you test your products.\n","externalUrl":null,"permalink":"/projects/homelab/","section":"Our projects","summary":"Homelab is a fully furnished and functional house with extensive test facilities. Custom-built for testing smart home applications in a real living lab.\n","title":"Homelab","type":"projects"},{"content":" Processing sensitive data with confidential algorithms. Limit the impact of breaches by encrypting data in-use. Process highly regulated data in clouds. Software supply-chain trust and transparency. Regulatory compliance of software and AI. ","date":"28 May 2025","externalUrl":null,"permalink":"/categories/trust/","section":"Focus areas","summary":" Processing sensitive data with confidential algorithms. Limit the impact of breaches by encrypting data in-use. Process highly regulated data in clouds. Software supply-chain trust and transparency. Regulatory compliance of software and AI. ","title":"Trustworthy Systems","type":"categories"},{"content":"Battle-tested platform for scalable data-driven applications.\nConnect data producers and consumers with powerful APIs for ingesting, querying and streaming large amounts of data. End-to-end granular authorization and authentication builtin.\nMore information See the code or a Live version ","externalUrl":null,"permalink":"/projects/obelisk/","section":"Our projects","summary":"Battle-tested platform for scalable data-driven applications.\n","title":"Obelisk","type":"projects"},{"content":"","externalUrl":null,"permalink":"/projects/testbeds/","section":"Our projects","summary":"","title":"Testbeds","type":"projects"},{"content":" End-to-end network intrusion detection systems (IDS). Technical enablers for realtime analysis on network traffic. Intrusion detection and prediction on real-world datasets. ","externalUrl":null,"permalink":"/categories/network-intrusion-detection/","section":"Focus areas","summary":" End-to-end network intrusion detection systems (IDS). Technical enablers for realtime analysis on network traffic. Intrusion detection and prediction on real-world datasets. ","title":"Cybersecurity","type":"categories"},{"content":"","externalUrl":null,"permalink":"/projects/platforms/","section":"Our projects","summary":"","title":"Platforms","type":"projects"},{"content":"High-performance feature extraction for network traffic.\nUses Rust and eBPF to process high volumes of traffic with remarkable speed and throughput.\nVery high throughput Versatile Feature Sets Pcap File Support See the code.\n","externalUrl":null,"permalink":"/projects/rustiflow/","section":"Our projects","summary":"High-performance feature extraction for network traffic.\n","title":"RustiFlow","type":"projects"},{"content":"Kubernetes for tiny edge devices.\nA lightweight Kubernetes-compatible container orchestrator supporting containers and MicroVMs.\nFor low-resource devices Supports MicroVMs Edge-native networking See the code.\n","externalUrl":null,"permalink":"/projects/feather/","section":"Our projects","summary":"Kubernetes for tiny edge devices.\n","title":"Feather","type":"projects"},{"content":"","externalUrl":null,"permalink":"/projects/other/","section":"Our projects","summary":"","title":"Other projects","type":"projects"},{"content":" Highly scalable data processing and AI pipelines. Data sharing and collaboration in environments with complex ownership and permissions. Technical enablers for linked data and Data Spaces in production environments. ","externalUrl":null,"permalink":"/categories/data/","section":"Focus areas","summary":" Highly scalable data processing and AI pipelines. Data sharing and collaboration in environments with complex ownership and permissions. Technical enablers for linked data and Data Spaces in production environments. ","title":"Scalable Data \u0026 AI","type":"categories"},{"content":" Low latency streaming for AR, VR and XR applications. User Experience of Multi-user and Multimodal extended reality. Volumetric Video Conferencing. ","externalUrl":null,"permalink":"/categories/ar-vr/","section":"Focus areas","summary":" Low latency streaming for AR, VR and XR applications. User Experience of Multi-user and Multimodal extended reality. Volumetric Video Conferencing. ","title":"AR / VR / XR","type":"categories"},{"content":"Lightweight containerization for IoT devices.\nStandardized WASI interfaces to drive USB and I2C hardware from WebAssembly.\nContainerized device drivers On tiny microcontrollers 2% latency \u0026amp; RAM overhead See the code.\n","externalUrl":null,"permalink":"/projects/cyber-physical-webassembly/","section":"Our projects","summary":"Lightweight containerization for IoT devices.\n","title":"Cyber-Physical WebAssembly","type":"projects"},{"content":" Applying game design principles to education and healthcare. Building games to improve learning and health outcomes. Personalized Serious Games and Gamification. ","externalUrl":null,"permalink":"/categories/serious-games/","section":"Focus areas","summary":" Applying game design principles to education and healthcare. Building games to improve learning and health outcomes. Personalized Serious Games and Gamification. ","title":"Game Thinking","type":"categories"},{"content":"Enabling Solid for healthcare.\nHealthcare ecosystems are siloed and data sharing is minimal. With Solid, we enable data sharing between healthcare applications to better support patients.\nPartners:\nFAQIR Institute \u0026amp; Foundation AContrario, moveUP, Byteflies IDLab - Ghent University - imec ","externalUrl":null,"permalink":"/projects/pacsoi/","section":"Our projects","summary":"Enabling Solid for healthcare.\n","title":"PACSOI","type":"projects"},{"content":"Network-aware Kubernetes scheduling\nThis project enables Kubernetes to take application topology and network topology into account when scheduling applications. This reduces the network latency of microservice applications running in Kubernetes.\nSee the code.\n","externalUrl":null,"permalink":"/projects/diktyo/","section":"Our projects","summary":"Network-aware Kubernetes scheduling\n","title":"Diktyo","type":"projects"},{"content":"Network Intrusion Detection datasets\nMore than 30 state-of-the-art network intrusion detection datasets with high quality. These include NSL-KDD, UNSW-NB15, the CIC-IDS collection (including the Distrinet updates) and the NF-IDS collection.\nGet the data.\n","externalUrl":null,"permalink":"/projects/improved-nids-datasets/","section":"Our projects","summary":"Network Intrusion Detection datasets\n","title":"Improved NIDS datasets","type":"projects"},{"content":"Simplifying cyber resilience compliance for European businesses.\nCRACY is an EU-backed initiative that helps SMEs meet the requirements of the EU Cyber Resilience Act (CRA), offering tools and resources to streamline compliance and support secure development for digital products.\nLearn more or read about the EU Cyber Resilience Act.\n","externalUrl":null,"permalink":"/projects/cracy/","section":"Our projects","summary":"Simplifying cyber resilience compliance for European businesses.\n","title":"CRACY","type":"projects"},{"content":"A testbed for experimenting with Kubernetes and cloud-native technologies.\nWith only a few clicks, you can spin up your own Kubernetes cluster in the IDLab (Ghent University - imec) data center. xNativeLab is federated through SLICES.\nFully managed Kubernetes clusters for experimenting Customizable number of nodes and machine size Full admin access Personal VPN Contact Sander Borny to check whether xNativeLab fits your needs, or read the docs to get started.\n","externalUrl":null,"permalink":"/projects/xnativelab/","section":"Our projects","summary":"A testbed for experimenting with Kubernetes and cloud-native technologies.\n","title":"xNativeLab","type":"projects"},{"content":"How can you protect your sensitive data and algorithms, even if they\u0026rsquo;re residing on untrusted devices? Encrypting the data on the disk is not sufficient. A hardware-based confidential computing environment, however, protects the data even in this case.\nNormally, all data and algorithms on a device are accessible to someone who has root access to the device. This can be a competitor trying to steal your algorithms or an adversary trying to steal your user\u0026rsquo;s data. Even if it would\u0026rsquo;ve been encrypted on the disk, the adversary still has access to the decryption keys. However, placing this sensitive information in a confidential computing environment addresses these challenges.\nIn a confidential computing solution, the Trusted Execution Environment (TEE) or enclave isolates and protects data from software and individuals not explicitly authorized to access the TEE [0]. In the case of an attack by a malicious agent, the data is entirely inaccessible.\nConfidential Computing on Arm Devices # Arm offers two kinds of confidential compute environments:\nArm TrustZone [1] Arm Confidential Compute Architecture (CCA) [2] TrustZone works well for platform security use cases which are limited in scope. CCA is better suited to protect your VM or application [3]. Only TrustZone, though, is currently readily available [4].\nTrustZone divides the compute into a Secure world and a Normal world, respectively also called the TEE and the Rich Execution Environment (REE). Secure world software, called a Trusted Application (TA), has access to the Secure physical address space, which cannot be accessed by the Normal world. Typically, this address space is delineated at boot time. The division into two worlds is thus performed at the hardware-level. For software running in the Normal world to call a function in a TA, it needs to pass through a Secure Monitor.\nAn Analysis of TrustZone # The easiest way to use Arm TrustZone is to use an off-the-shelf TEE solution which follows the cross-platform GlobalPlatform (GP) specification [5]. Of the available TEEs, the open-source Open Portable Trusted Execution Environment (OP-TEE) [6] is the best candidate. This off-the-shelf solution for Arm TrustZone supports a plethora of platforms.\nApplications executed inside the TEE solution are limited in their capabilities, e.g. only C is truly supported, C++ is supported up to GCC 11 [7] and Rust support is experimental [8]. This is mainly since if you would like to compile your application for OP-TEE, you have to use the libutils library [9] instead of libc [10]. This libutils library is rather limited in its capabilities. Additionally, OP-TEE also has no support for multithreading via libpthread [11].\nOnly C is truly supported, C++ is supported up to GCC 11 and Rust support is experimental.\nBesides these restrictions, OP-TEE also dictates a certain program layout [12], e.g. the entry points in the main.c are predefined, which practically leads to a full rewrite when modifying an existing application to run inside TrustZone.\nPerformance-wise, running inside the TEE results in a 12 to 17 times overhead against the REE. This is a significant overhead, mostly caused by time-consuming memory operations [13].\nTrustZone Use Cases # Organizations use confidential computing to unlock data silos, and meet global data privacy compliance requirements. In healthcare and pharmaceutical enterprises, the ability to engage in multiparty data collaboration safely and securely enables them to explore new treatments, develop new drugs, and improve patient outcomes more effectively than before. For financial services enterprises, confidential computing permits secure cross-industry collaboration to detect money laundering and other forms of financial crime.\nAll the following use cases provide examples of how Arm TrustZone can be leveraged to protect sensitive data and algorithms in organizations.\nHMAC-based One-Time Password Driver Protection Secure Storage Secure Over the Air Updates Samsung Knox Shield Neural Network Layers against Privacy Breaches These applications are simple enough that the overhead brought upon by TrustZone is negligible, and that the necessary effort to compile them is doable.\nHMAC-based One-Time Password # HMAC-based One-Time Passwords (HOTP) [14] are a popular choice for two-factor authentication. In this example [15] we have a client that wishes to get some resources on a server, for this they need to authenticate themselves. Here, Arm TrustZone is utilised to securely generate the OTP. When the user\u0026rsquo;s device is compromised, the adversary still has no access to the shared key. The Arm TrustZone TEE could also be leveraged as the validating service. Then, if the server is compromised, the shared key is still inaccessible.\nFirst, the client and server need to agree on a shared key, which is stored in TrustZone. For this, there must be a secure channel between both parties, ideally between the TEE and the server, but OP-TEE currently only has support for TCP/UDP and not for TLS. Additionally, both need to start from a counter which is initialized to the same value.\nTo perform the actual client authentication, both client and server calculate the same HOTP and then the server validates that they\u0026rsquo;re the same. If this is the case, the server can then grant access to the resources which the client requested.\nDriver Protection # The firmware provided by vendors can include valuable IP which needs to be protected from reverse engineering, IP theft or malicious attacks [16]. Using TrustZone chip vendors can put their firmware in a protected, secure memory space, while still allowing users to interact with their device via their APIs.\nSecure Storage # OP-TEE provides two secure storage implementations according to the GlobalPlatform TEE Internal Core API, this specification mandates confidentiality and data integrity [17].\nVia the REE file system: This is the default Using the Replay Protected Memory Block (RPMB) partition of an eMMC device: A memory area that stores data in an authenticated and replay protected manner [18] It is possible to use both implementations simultaneously.\nThis secure storage in TrustZone can be utilised for a secure key store. First, TrustZone encrypts the keys via a hardware unique key burned into the chip. Afterwards, the encrypted key is stored in the secure storage. Keys would only be decrypted and used within the TEE and never accessible to the Normal World [19]. This way, confidentiality and data integrity is guaranteed.\nSecure Over the Air Updates # To update the boot firmware, the system needs to get the authentic firmware image over a network. Furthermore, an attacker shouldn\u0026rsquo;t be able to roll the update back. For this, the OEM signs the image with its private key, and the public key is provisioned by the downloading device. A non-volatile counter is incremented when the firmware is updated. This way, the signature is verified, and any rollbacks are detected [20].\nHere, TrustZone ensures that the keys that are used to authenticate firmware images are protected and that firmware images cannot be rolled back.\nSamsung Knox # Samsung Knox is a proprietary security and management framework pre-installed on Samsung mobile devices. The framework consists of a multitude of system security mechanisms, heavily leveraging the security benefits of Arm TrustZone [21]. Inside this framework, there\u0026rsquo;s also Knox Vault [22], an extension upon the protection offered by TrustZone.\nIn Samsung Knox, the highly sensitive software runs inside the secure world. Thanks to Arm TrustZone components that are marked secure, e.g. a fingerprint reader, can only be accessed inside the secure world.\nKnox Vault is available on select devices and extends upon this by providing an independent, tamper-proof, secure subsystem with its own processor, memory, and an interface to dedicated non-volatile storage, wherein it stores the sensitive data such as cryptographic keys and authentication data. Even if the main application processor that runs Android is compromised, the Knox Vault protects secrets and guards against hardware attacks such as probing and fault injection.\nShield Neural Network Layers against Privacy Breaches # TrustZone shields critical deep neural-network layers against privacy breaches like membership inference attacks. In a membership inference attack, the attacker manipulates the model\u0026rsquo;s training data to cause it to behave in a way that exposes sensitive information [23].\nDarkneTZ [24] is an application that illustrates how OP-TEE can be leveraged to shield critical neural-network layers. It ports selective components of Darknet [25], a deep neural network framework, for secure world execution. Notably, to thwart inference attacks, it delegates deep layers to the secure world while the rest layers are operated in the normal world. Typically, the last layers are delegated, as these have a higher probability of leaking private information about training data.\nConclusion # Using a confidential compute solution is paramount to protect sensitive data and algorithms on untrusted devices. For Arm platforms, the only readily available solution is Arm TrustZone. TrustZone comes with hefty restrictions: the required code changes and the significant overhead. Therefore, it is best to keep the footprint of the secure application to a minimum.\nNevertheless, Arm TrustZone does have its use-cases:\nHMAC-based One-Time Password Driver Protection Secure Storage Secure Over the Air Updates Samsung Knox Shield Neural Network Layers against Privacy Breaches When Arm CCA becomes widely usable, the required code changes and the significant overhead should no longer be present.\n","date":"28 May 2025","externalUrl":null,"permalink":"/blog/arm-trustzone-for-tees-opportunities-and-challenges/","section":"Our blog","summary":"How can you protect your sensitive data and algorithms, even if they’re residing on untrusted devices? Encrypting the data on the disk is not sufficient. A hardware-based confidential computing environment, however, protects the data even in this case.\nNormally, all data and algorithms on a device are accessible to someone who has root access to the device. This can be a competitor trying to steal your algorithms or an adversary trying to steal your user’s data. Even if it would’ve been encrypted on the disk, the adversary still has access to the decryption keys. However, placing this sensitive information in a confidential computing environment addresses these challenges.\n","title":"ARM TrustZone for TEEs, opportunities and challenges","type":"blog"},{"content":"","date":"28 May 2025","externalUrl":null,"permalink":"/tags/confidential-computing/","section":"Tags","summary":"","title":"Confidential Computing","type":"tags"},{"content":"","date":"28 May 2025","externalUrl":null,"permalink":"/team/friedrich-vandenberghe/","section":"Our team","summary":"","title":"Friedrich Vandenberghe","type":"authors"},{"content":"","date":"28 May 2025","externalUrl":null,"permalink":"/","section":"IDLab's DISCOVER team","summary":"","title":"IDLab's DISCOVER team","type":"page"},{"content":" RSS feed ","date":"28 May 2025","externalUrl":null,"permalink":"/blog/","section":"Our blog","summary":" RSS feed","title":"Our blog","type":"blog"},{"content":" Alumni # Dr. Ankita Atrey - Scientific Communication Expert @ Aarhus University Anneleen Wytynck - Product analist at ESCbv and Dynavision Dr. Jeroen van der Hooft - Policy Officer @ Ghent University Dr. Joachim Nielandt - Software Engineer @ Digitaal Vlaanderen Dr. Joris Heyse - Software Engineer @ Luceda Photonics Koen Luyten - Software Engineer @ Isabel Group Dr. Laurens Van Hoye - Data Engineer @ e-BO Enterprises Dr. Leandro Ordóñez - Data Science Engineer @ Yazzoom, Founder @ BitBang Company Prof. Dr. Maria Torres Vega - Assistant Professor @ KU Leuven Dr. Maxim Claeys - Senior Software Engineer @ Robovision Dr. Miel Verkerken - Co-Founder @ Allseek Dr. Mohammad Javad Sameri - Postdoctoral Researcher @ KU Leuven Dr. Pieter-Jan Maenhaut - Docent @ HoGent Dr. Rafael Xavier - VP Application Security and Vulnerability Management @ iCapital Network Sarah Kerkhove - Data Engineer @ UCLL Research \u0026amp; Expertise Dr. Stefano Petrangeli - Senior Research Scientist @ Adobe Dr. Thomas Vanhove - CTO @ Ovinto, Founder @ Tengu ","date":"28 May 2025","externalUrl":null,"permalink":"/team/","section":"Our team","summary":"Alumni # Dr. Ankita Atrey - Scientific Communication Expert @ Aarhus University Anneleen Wytynck - Product analist at ESCbv and Dynavision Dr. Jeroen van der Hooft - Policy Officer @ Ghent University Dr. Joachim Nielandt - Software Engineer @ Digitaal Vlaanderen Dr. Joris Heyse - Software Engineer @ Luceda Photonics Koen Luyten - Software Engineer @ Isabel Group Dr. Laurens Van Hoye - Data Engineer @ e-BO Enterprises Dr. Leandro Ordóñez - Data Science Engineer @ Yazzoom, Founder @ BitBang Company Prof. Dr. Maria Torres Vega - Assistant Professor @ KU Leuven Dr. Maxim Claeys - Senior Software Engineer @ Robovision Dr. Miel Verkerken - Co-Founder @ Allseek Dr. Mohammad Javad Sameri - Postdoctoral Researcher @ KU Leuven Dr. Pieter-Jan Maenhaut - Docent @ HoGent Dr. Rafael Xavier - VP Application Security and Vulnerability Management @ iCapital Network Sarah Kerkhove - Data Engineer @ UCLL Research \u0026 Expertise Dr. Stefano Petrangeli - Senior Research Scientist @ Adobe Dr. Thomas Vanhove - CTO @ Ovinto, Founder @ Tengu ","title":"Our team","type":"authors"},{"content":"","date":"28 May 2025","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"25 October 2023","externalUrl":null,"permalink":"/tags/containers/","section":"Tags","summary":"","title":"Containers","type":"tags"},{"content":"","date":"25 October 2023","externalUrl":null,"permalink":"/team/michiel-van-kenhove/","section":"Our team","summary":"","title":"Michiel Van Kenhove","type":"authors"},{"content":"Have you ever wondered if you should blindly run that Docker container image you found in some tutorial or guide? Can you trust every container image you find on the internet? What if that image you just pulled contains some malicious code? In this post, I will be going over the risks of blindly running any container image you find on the internet and why you may want to think twice when running that container image you just found.\nHow do containers work? # Before we dive into the risks of running random container images, let\u0026rsquo;s first take a look at how containers work.\nBefore containers existed, the cloud was using Virtual Machines (VM) to run workloads in the cloud. A virtual machine can be looked at as a virtual computer on physical hardware, and the same physical machine (host) can run multiple virtual machines. This is accomplished by virtualizing hardware, and most of the times a complete operating system (OS) runs inside the VM. The software running inside the VM (guest) sees the virtual hardware and it behaves as if it were running on physical hardware. Because each VM has its own virtual hardware, a good isolation between different workloads is accomplished. A (major) downside of VMs is the significant amount of overhead: they have slow boot times and consume a lot of resources, like CPU and RAM.\nWhen the cloud became more popular, with higher and a more dynamic loads, it became clear that using VMs was not going to cut it anymore. When the load on an application suddenly increases, new VMs need to start. However, starting a VM can take a couple of minutes in the worst case. Due to the large overhead, a new solution needed to be found. This is the moment when containers were introduced!\nContainers offer a lot less overhead compared to VMs. The time to start a container can be as little as a couple of seconds, having almost native performance of the physical hardware. Compared to a VM, a container uses software based isolation techniques, instead of creating virtual hardware. Multiple containers share the same underlying kernel (and sometimes also libraries) of the host-OS.\nIn the figure below, you can see the architectural difference between VMs and containers. As you can see, each VM has its own complete operating system which adds overhead. Containers on the other hand, run directly on the host operating system and share its kernel using a container runtime. To run a container, you will first need a container image. A container image consists of all the software and dependencies needed to be able to run the bundled application. These bundles typically follow an industry standard, developed by the Open Container Initiative (OCI). This image is used to start a container and a container image can run on multiple OCI-compliant runtimes without the need to recompile. If a container runtime is OCI-compliant, it should be able to run OCI-compliant container images. A container runtime is responsible for everything needed to run containers.\nThe problem with traditional container runtimes # As mentioned above, traditional container runtimes share the underlying operating system kernel and hardware. There is no hardware isolation. If an application running inside a container has malicious behavior, it could escape the container through a vulnerability (e.g., CVE-2019-5736, CVE-2022-0185 and CVE-2022-0811) and access the underlying host operating system, other containers, confidential data, etc. This malicious behavior is shown in the figure below.\nWhen running a container image you downloaded from the internet, you don\u0026rsquo;t always know its internal behavior. The image may contain malicious code. Another possibility is that the image does not contain any malicious code at the time you first downloaded the image, but a future update may introduce malicious behavior without you realizing. Therefore, you should always double check if you trust the publisher of a container image as a first precaution. It is also possible that a container image itself does intend any malicious behavior, but a malicious actor may find a way to attack a publicly accessible container and use privilege escalation techniques to escape the container.\nSolution: secure containers # Next to being extra precautious with which images you run, sometimes it is necessary for certain security sensitive environments to have a guarantee that a container image cannot do any harm due to malicious behavior. This is easier said than done, because this requires better isolation between the container, the host and other running containers, which in turn causes extra overhead.\nSecure containers try to solve this with minimal overhead. They achieve better isolation while still offering the benefits of traditional containers, e.g., good boot times, portability, etc. A secure container does this by encapsulating each container in its own lightweight VM, appropriately named as microVM, as shown in the figure below. A microVM is a slimmed down version of a normal VM, where a lightweight and optimized guest-OS is utilized instead of a fully-fledged OS. A microVM reduces the overhead, e.g., booting times, CPU usage, memory usage, etc., that a traditional VM comes with. Using virtual hardware better isolates the workloads as shown in the figure below: when an attacker successfully escapes the container, they are still stuck in the microVM isolated environment. Ideally, secure container runtimes should also be OCI-compliant such that they can be used as a drop-in replacement for current container runtimes. A microVM-based secure container has the benefits of both worlds: the versatility of containers and the security of VMs.\nConclusion # After reading this article, I hope you understand the risks of running \u0026ldquo;untrusted\u0026rdquo; container images and to be extra cautious when you don\u0026rsquo;t recognize or trust the publisher of the image. We have discussed the potential for malicious code in container images and a solution to reduce the damage caused by malicious containers. Utilizing secure containers can significantly improve the security of your deployment without too much overhead. In a next post, I will be going more into detail about what a secure container runtime is and how it works. I will also analyse the overhead caused by using a secure container runtime, so you can determine if the (minimal) overhead is acceptable in your use-case to improve the security of your environment.\n","date":"25 October 2023","externalUrl":null,"permalink":"/blog/trusting-your-container-runtime/","section":"Our blog","summary":"Have you ever wondered if you should blindly run that Docker container image you found in some tutorial or guide? Can you trust every container image you find on the internet? What if that image you just pulled contains some malicious code? In this post, I will be going over the risks of blindly running any container image you find on the internet and why you may want to think twice when running that container image you just found.\n","title":"Trusting your containers - introduction","type":"blog"},{"content":"Bruno Volckaert (male) is professor advanced programming and software engineering in the Department of Information Technology (INTEC) at Ghent University and senior researcher at imec. He obtained his Master of Computer Science degree in 2001 from Ghent University, after which he worked on his PhD at Ghent University on data intensive scheduling and service management for Grid computing, which he obtained in 2006. His current research deals with reliable and high performance distributed cloud-based backend systems for Smart Cities and industry4.0, distributed decision support systems, autonomous optimization of cloud-based applications and cybersecurity by means of machine learning. He has worked on over 40 national and international research projects and is author or co-author of more than 100 papers published in international journals and conference proceedings.\n","externalUrl":null,"permalink":"/team/bruno-volckaert/","section":"Our team","summary":"Bruno Volckaert (male) is professor advanced programming and software engineering in the Department of Information Technology (INTEC) at Ghent University and senior researcher at imec. He obtained his Master of Computer Science degree in 2001 from Ghent University, after which he worked on his PhD at Ghent University on data intensive scheduling and service management for Grid computing, which he obtained in 2006. His current research deals with reliable and high performance distributed cloud-based backend systems for Smart Cities and industry4.0, distributed decision support systems, autonomous optimization of cloud-based applications and cybersecurity by means of machine learning. He has worked on over 40 national and international research projects and is author or co-author of more than 100 papers published in international journals and conference proceedings.\n","title":"Bruno Volckaert","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/casper-haems/","section":"Our team","summary":"","title":"Casper Haems","type":"authors"},{"content":" Address # We are located in the beautiful city of Ghent, Belgium.\nTechnologiepark-Zwijnaarde 126, 9052 Gent, Belgium\nThe IDLab secretariat is on the 10th floor, in front of the elevators. Get directions.\nHow to reach us # Our office is in the iGent tower in the Tech Lane Ghent Science Park, near the crossing of the E40 (Ostend-Brussels) and the E17 (Antwerp-Kortrijk) motorways.\nBy car: take the N60 towards Zwijnaarde and turn onto the Technologiepark campus. The iGent tower is the last tower: 12 floors high, with solar panels on its south side. Parking: use the parking building in section B1. For GPS navigation, enter Technologiepark-Zwijnaarde 105, 9052 Gent. Public transport: from Gent-Sint-Pieters station, take bus 70 or 71, or bus 48 or 49 to Zwijnaarde Technologiepark. Website # For additions, updates and changes to this website, please contact wiebe.vandendriessche@ugent.be.\n","externalUrl":null,"permalink":"/contact/","section":"IDLab's DISCOVER team","summary":"Address # We are located in the beautiful city of Ghent, Belgium.\nTechnologiepark-Zwijnaarde 126, 9052 Gent, Belgium\nThe IDLab secretariat is on the 10th floor, in front of the elevators. Get directions.\nHow to reach us # Our office is in the iGent tower in the Tech Lane Ghent Science Park, near the crossing of the E40 (Ostend-Brussels) and the E17 (Antwerp-Kortrijk) motorways.\n","title":"Contact us","type":"page"},{"content":"","externalUrl":null,"permalink":"/team/danial-hawari/","section":"Our team","summary":"","title":"Danial Hawari","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/elli-makdis-antoun/","section":"Our team","summary":"","title":"Elli Makdis Antoun","type":"authors"},{"content":"Femke De Backere is a part-time associate professor in the IDLab research group at Ghent University and a full-time research manager and senior scientist at imec. She obtained her Bachelor\u0026rsquo;s degree in Informatics and her Master\u0026rsquo;s degree in Computer Science Engineering from Ghent University, where she specialized in software engineering and healthcare applications. She completed her PhD at Ghent University, focusing on semantic technologies and personalized, context-aware systems in collaboration with intensive care units, homecare organizations, and industry partners. Her research focuses on interdisciplinary applications combining computer science, health psychology, and movement science across three core areas: explainable domain-expertise models, personalization and contextualization, and engagement techniques such as gamification and serious games. Additionally, she teaches Design Project at Ghent University to empower future engineers to become next-generation innovators.\n","externalUrl":null,"permalink":"/team/femke-de-backere/","section":"Our team","summary":"Femke De Backere is a part-time associate professor in the IDLab research group at Ghent University and a full-time research manager and senior scientist at imec. She obtained her Bachelor’s degree in Informatics and her Master’s degree in Computer Science Engineering from Ghent University, where she specialized in software engineering and healthcare applications. She completed her PhD at Ghent University, focusing on semantic technologies and personalized, context-aware systems in collaboration with intensive care units, homecare organizations, and industry partners. Her research focuses on interdisciplinary applications combining computer science, health psychology, and movement science across three core areas: explainable domain-expertise models, personalization and contextualization, and engagement techniques such as gamification and serious games. Additionally, she teaches Design Project at Ghent University to empower future engineers to become next-generation innovators.\n","title":"Femke De Backere","type":"authors"},{"content":"Filip De Turck obtained the degree of Master in Electrical Engineering from Ghent University, Belgium in 1997, and the PhD degree in Engineering from Ghent University in 2002. In 2003 (May-November), I was a visiting postdoctoral researcher at Columbia University, USA. I was appointed Assistant Professor at Ghent University in 2004, Associate Professor in 2009, and Full Professor in 2014. He leads the network and service management team at the Department of Information Technology at Ghent University, and has currently a strong research interest in resilient softwarized network and service infrastructures, efficient anomaly detection and adaptive large-scale data processing. He successfully supervised 38 PhD students and is currently supervising 8 PhD students. His current google h-index is 40, and his publications obtained 8952 citations. He co-authored 180 journal papers listed in the Web of Science, and in total co-authored over 500 peer-reviewed papers in proceedings of international conferences and journals.\n","externalUrl":null,"permalink":"/team/filip-de-turck/","section":"Our team","summary":"Filip De Turck obtained the degree of Master in Electrical Engineering from Ghent University, Belgium in 1997, and the PhD degree in Engineering from Ghent University in 2002. In 2003 (May-November), I was a visiting postdoctoral researcher at Columbia University, USA. I was appointed Assistant Professor at Ghent University in 2004, Associate Professor in 2009, and Full Professor in 2014. He leads the network and service management team at the Department of Information Technology at Ghent University, and has currently a strong research interest in resilient softwarized network and service infrastructures, efficient anomaly detection and adaptive large-scale data processing. He successfully supervised 38 PhD students and is currently supervising 8 PhD students. His current google h-index is 40, and his publications obtained 8952 citations. He co-authored 180 journal papers listed in the Web of Science, and in total co-authored over 500 peer-reviewed papers in proceedings of international conferences and journals.\n","title":"Filip De Turck","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/gregory-van-seghbroeck/","section":"Our team","summary":"","title":"Gregory Van Seghbroeck","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/jasper-vaneessen/","section":"Our team","summary":"","title":"Jasper Vaneessen","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/jerico-moeyersons/","section":"Our team","summary":"","title":"Jerico Moeyersons","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/jordi-thijsman/","section":"Our team","summary":"","title":"Jordi Thijsman","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/jose-santos/","section":"Our team","summary":"","title":"José Santos","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/laurens-dhooge/","section":"Our team","summary":"","title":"Laurens D'hooge","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/matthias-de-fre/","section":"Our team","summary":"","title":"Matthias De Fré","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/merlijn-sebrechts/","section":"Our team","summary":"","title":"Merlijn Sebrechts","type":"authors"},{"content":"","externalUrl":null,"permalink":"/projects/","section":"Our projects","summary":"","title":"Our projects","type":"projects"},{"content":"Last updated: 13 October 2026.\nThis website is maintained by the DISCOVER team of IDLab, a research group of Ghent University and imec. We keep data collection to a minimum. This page explains what happens to your data when you visit the site.\nNo cookies, analytics or tracking # This website does not set cookies, does not use analytics or advertising tools and does not track you across websites. Fonts, scripts and images are served from this website itself, not from external services.\nWhat is stored in your browser # Light or dark mode: when you switch the appearance, your choice is stored in your browser\u0026rsquo;s local storage so the next page uses it too. It never leaves your device and you can remove it by clearing your browser data. Search: the site search runs entirely in your browser, using an index downloaded from this website. Your search terms are not sent anywhere. Server logs # Like any website, the server that hosts this site may record standard technical data for each request, such as your IP address, the date and time, the page requested and your browser type. This data is used only to operate and secure the website.\nPublications # The publication lists are taken from the Ghent University Academic Bibliography (biblio.ugent.be) when the website is built, and are served from this website itself. Viewing them does not connect your browser to biblio.ugent.be. Only when you click a publication link do you visit that service, which is covered by the privacy statement of Ghent University.\nExternal links and share buttons # This website links to other websites, such as partner organisations, ORCID profiles, code repositories and social media share buttons. These sites are only contacted when you click a link, and from then on their own privacy policies apply.\nContacting us # If you contact us by email, we use your email address and message only to answer your question.\nPeople on this website # The team pages show names, photos, roles and professional links of current and former team members. If you are listed and want something changed or removed, please contact us.\nYour rights # Under the General Data Protection Regulation (GDPR) you have the right to access, correct or delete your personal data and to object to its processing. For questions about this website, contact wiebe.vandendriessche@ugent.be. For data protection questions you can also contact the data protection officer of Ghent University at privacy@ugent.be. If you are not satisfied with how your request is handled, you can lodge a complaint with the Belgian Data Protection Authority.\nChanges # We may update this policy when the website changes. The date at the top shows the latest version.\n","externalUrl":null,"permalink":"/privacy/","section":"IDLab's DISCOVER team","summary":"Last updated: 13 October 2026.\nThis website is maintained by the DISCOVER team of IDLab, a research group of Ghent University and imec. We keep data collection to a minimum. This page explains what happens to your data when you visit the site.\nNo cookies, analytics or tracking # This website does not set cookies, does not use analytics or advertising tools and does not track you across websites. Fonts, scripts and images are served from this website itself, not from external services.\n","title":"Privacy policy","type":"page"},{"content":"","externalUrl":null,"permalink":"/publications/","section":"Recent publications","summary":"","title":"Recent publications","type":"publications"},{"content":"","externalUrl":null,"permalink":"/team/robbe-haegeman/","section":"Our team","summary":"","title":"Robbe Haegeman","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/robin-verbeelen/","section":"Our team","summary":"","title":"Robin Verbeelen","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/sam-van-damme/","section":"Our team","summary":"","title":"Sam Van Damme","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/sander-borny/","section":"Our team","summary":"","title":"Sander Borny","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/sebastiaan-de-oude/","section":"Our team","summary":"","title":"Sebastiaan de Oude","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/stan-de-groeve/","section":"Our team","summary":"","title":"Stan De Groeve","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/stephanie-carlier/","section":"Our team","summary":"","title":"Stéphanie Carlier","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/thomas-dupont/","section":"Our team","summary":"","title":"Thomas Dupont","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/tim-wauters/","section":"Our team","summary":"","title":"Tim Wauters","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/tom-goethals/","section":"Our team","summary":"","title":"Tom Goethals","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/vincent-bracke/","section":"Our team","summary":"","title":"Vincent Bracke","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/wannes-kerckhove/","section":"Our team","summary":"","title":"Wannes Kerckhove","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/wiebe-vandendriessche/","section":"Our team","summary":"","title":"Wiebe Vandendriessche","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/wouter-pennings/","section":"Our team","summary":"","title":"Wouter Pennings","type":"authors"},{"content":"","externalUrl":null,"permalink":"/team/zack-slayton/","section":"Our team","summary":"","title":"Zack Slayton","type":"authors"},{"content":"","date":"28 May 2025","externalUrl":null,"permalink":"/categories/","section":"Focus areas","summary":"","title":"Focus areas","type":"categories"}]