School of Computing Science

Dr Marco Cook

  • Research Associate (School of Computing Science)

email: Marco.Cook@glasgow.ac.uk

School of Computing Science, Sir Alwyn Williams Building

Import to contacts

ORCID iDhttps://orcid.org/0000-0002-5232-2381

Biography

Dr. Marco Cook is a Research Associate in cybersecurity within the School of Computing Science, and a member of the GLAsgow Systems Section (GLASS). His research focuses on addressing challenges with detecting, mitigating and explaining anomalies and intrusions, giving particular attention to cyber-physical systems (CPS) and industrial environments found in Critical National Infrastructure (CNI) (e.g. Industrial Control Systems (ICS) and Programmable Logic Controllers (PLCs). Within the school, he a senior member of the Netlab and Cyber Defence Lab groups. He completed his PhD at the University of Glasgow in 2023, which was funded through an EPSRC iCASE studentship award, supported by the Defence Science and Technology Laboratory (Dstl) as the industrial partner. His PhD research explored anomaly detection and diagnosis for ICS, specifically in the context of digital forensics.

Research interests

Research Interests:

  • Cybersecurity
  • Industrial Control System (ICS) Security
  • Anomaly Detection
  • Anomaly Explainability
  • Digital Forensics
  • Security of Programmable Logic Controllers (PLCs)

Research groups

Publications

List by: Type | Date

Jump to: 2026 | 2025 | 2024 | 2023 | 2022 | 2020 | 2017
Number of items: 20.

2026

McGugan, Robbie, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Multi-agent reinforcement learning for DoS mitigation in industrial control systems. Computer Networks, 288, 112668. (doi: 10.1016/j.comnet.2026.112668)

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Stoica, Andrei, Shah, Awais ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) With power comes responsibility: attack synthesis for industrial control systems using large language models. ACM Transactions on Privacy and Security, 29(3), 31. (doi: 10.1145/3815116)

Molloy, Robert, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Not All Who Wander are Lost: Industrial Network Topology Inference via Tomography Probing. In: IEEE International Conference on Communications (IEEE ICC 2026), Glasgow, UK, 24-28 May 2026, ISBN 9798319542106 (doi: 10.1109/ICC59461.2026.11587632)

Nahalka, Martin, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Heterogeneous Graph Fusion for Multi-Modal Industrial Anomaly Detection. In: 2026 IEEE International Conference on Cyber Security and Resilience (IEEE CSR), Lisbon, Portugal, 3-5 Aug 2026, (Accepted for Publication)

2025

Fraser, Douglas, Miller, Alice ORCID logoORCID: https://orcid.org/0000-0002-0941-1717, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Online Model Checking for Anomaly Detection in Industrial Control Systems. In: 20th International Conference on Integrated Formal Methods (iFM 2025), Paris, France, 17-18 November 2025, pp. 162-181. ISBN 9783032107947 (doi: 10.1007/978-3-032-10794-7_9)

Rose, Joe, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) We’re eBPF’d: Exploring Adversarial Manipulation of ELF Files in eBPF-based Programmable Network Stacks. In: IEEE Conference on Communications and Network Security (IEEE CNS 2025), Avignon, France, 8–11 September 2025, ISBN 9798331538569 (doi: 10.1109/CNS66487.2025.11194984)

Chyzy, Jan, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) On the Cost of Asset Discovery Techniques for Industrial Control Systems. In: 8th IEEE Conference on Industrial Cyber-Physical Systems (ICPS), Emden, Germany, 12-15 May 2025, ISBN 9798331542993 (doi: 10.1109/ICPS65515.2025.11087898)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Network-Wide Service Deployment Using Centrally Orchestrated, eBPF-Based Programmable Dataplanes. In: 2025 EuCNC & 6G Summit, Poznan, Poland, 03-06 Jun 2025, pp. 351-356. ISBN 9798350391817 (doi: 10.1109/EuCNC/6GSummit63408.2025.11036869)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Deol, Bikram Singh ORCID logoORCID: https://orcid.org/0009-0004-5675-7499, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios P. ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Dashboard Orchestration of eBPF-based Programmable OT Networks. In: IEEE International Conference on Computer Communications (INFOCOM 2025), London, UK, 19-22 May 2025, ISBN 9798331543709 (doi: 10.1109/INFOCOMWKSHPS65812.2025.11152767)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Resilient Network Architecture with eBPF-based Programmability and Centralised Orchestration. In: IEEE International Conference on Computer Communications (INFOCOM 2025), London, UK, 19-22 May 2025, ISBN 9798331543709 (doi: 10.1109/INFOCOMWKSHPS65812.2025.11152786)

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Artefact Provenance Graphs for Anomaly Inference in Industrial Control Systems. In: 40th International Conference on ICT Systems Security and Privacy Protection – IFIP SEC 2025, Maribor, Slovenia, 21-23 May 2025, pp. 136-150. ISBN 9783031928826 (doi: 10.1007/978-3-031-92882-6_10)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Li, Xicheng, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Programmable data planes for increased digital resilience in OT networks. IEEE Communications Magazine, (doi: 10.1109/MCOM.001.2400446) (Early Online Publication)

2024

Nahalka, Martin, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2024) The Good, the Bad and the Ugly: Investigating the Effectiveness of Graph Deep Neural Networks for Anomaly Detection in Industrial Control Systems. In: IFIP International Internet of things (IoT) Conference, Nice, France, 6-8 November 2024, pp. 21-36. ISBN 9783031819001 (doi: 10.1007/978-3-031-81900-1_2)

Niu, Xianghao, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2024) Examining the Suitability of Stream Ciphers for Modbus-TCP Encryption on Resource Constrained Devices. In: EuroSec '24, Athens, Greece, 22 Apr 2024, pp. 51-57. ISBN 9798400705427 (doi: 10.1145/3642974.3652287)

Feng, Kai, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 (2024) Sizzler: sequential fuzzing in ladder diagrams for vulnerability detection and discovery in Programmable Logic Controllers. IEEE Transactions on Information Forensics and Security, 19, pp. 1660-1671. (doi: 10.1109/TIFS.2023.3340615)

2023

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216, Johnson, Chris and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2023) A survey on industrial control system digital forensics: challenges, advances and future directions. IEEE Communications Surveys and Tutorials, 25(3), pp. 1705-1747. (doi: 10.1109/COMST.2023.3264680)

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 and Pezaros, Dimitrios P. ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2023) PLCPrint: fingerprinting memory attacks in programmable logic controllers. IEEE Transactions on Information Forensics and Security, 18, pp. 3376-3387. (doi: 10.1109/TIFS.2023.3277688)

2022

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Paterson, Cory, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2022) Anomaly Diagnosis in Cyber-Physical Systems. In: ICC 2022 - IEEE International Conference on Communications, Seoul, South Korea, 16-20 May 2022, ISBN 9781538683484 (doi: 10.1109/ICC45855.2022.9838968)

2020

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Stavrou, Ioannis, Dimmock, Sarah and Johnson, Chris ORCID logoORCID: https://orcid.org/0000-0002-1052-9851 (2020) Introducing a Forensics Data Type Taxonomy of Acquirable Artefacts From Programmable Logic Controllers. In: 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 15-19 Jun 2020, ISBN 9781728164281 (doi: 10.1109/CyberSecurity49315.2020.9138879)

2017

Johnson, Chris W. ORCID logoORCID: https://orcid.org/0000-0002-1052-9851, Saleem, Mohammed Hashim, Evangelopoulou, Maria ORCID logoORCID: https://orcid.org/0000-0002-6536-4708, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Harkness, Rob and Barker, Tom (2017) Defending Against Firmware Cyber Attacks on Safety-Critical Systems. Proceedings 35th International System Safety Conference, Albuquerque, NM, USA, 21-25 Aug 2017.

This list was generated on Tue Aug 18 15:36:06 2026 BST.
Jump to: Articles | Conference or Workshop Item | Conference Proceedings
Number of items: 20.

Articles

McGugan, Robbie, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Multi-agent reinforcement learning for DoS mitigation in industrial control systems. Computer Networks, 288, 112668. (doi: 10.1016/j.comnet.2026.112668)

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Stoica, Andrei, Shah, Awais ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) With power comes responsibility: attack synthesis for industrial control systems using large language models. ACM Transactions on Privacy and Security, 29(3), 31. (doi: 10.1145/3815116)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Li, Xicheng, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Programmable data planes for increased digital resilience in OT networks. IEEE Communications Magazine, (doi: 10.1109/MCOM.001.2400446) (Early Online Publication)

Feng, Kai, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 (2024) Sizzler: sequential fuzzing in ladder diagrams for vulnerability detection and discovery in Programmable Logic Controllers. IEEE Transactions on Information Forensics and Security, 19, pp. 1660-1671. (doi: 10.1109/TIFS.2023.3340615)

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216, Johnson, Chris and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2023) A survey on industrial control system digital forensics: challenges, advances and future directions. IEEE Communications Surveys and Tutorials, 25(3), pp. 1705-1747. (doi: 10.1109/COMST.2023.3264680)

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 and Pezaros, Dimitrios P. ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2023) PLCPrint: fingerprinting memory attacks in programmable logic controllers. IEEE Transactions on Information Forensics and Security, 18, pp. 3376-3387. (doi: 10.1109/TIFS.2023.3277688)

Conference or Workshop Item

Johnson, Chris W. ORCID logoORCID: https://orcid.org/0000-0002-1052-9851, Saleem, Mohammed Hashim, Evangelopoulou, Maria ORCID logoORCID: https://orcid.org/0000-0002-6536-4708, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Harkness, Rob and Barker, Tom (2017) Defending Against Firmware Cyber Attacks on Safety-Critical Systems. Proceedings 35th International System Safety Conference, Albuquerque, NM, USA, 21-25 Aug 2017.

Conference Proceedings

Molloy, Robert, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Not All Who Wander are Lost: Industrial Network Topology Inference via Tomography Probing. In: IEEE International Conference on Communications (IEEE ICC 2026), Glasgow, UK, 24-28 May 2026, ISBN 9798319542106 (doi: 10.1109/ICC59461.2026.11587632)

Nahalka, Martin, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2026) Heterogeneous Graph Fusion for Multi-Modal Industrial Anomaly Detection. In: 2026 IEEE International Conference on Cyber Security and Resilience (IEEE CSR), Lisbon, Portugal, 3-5 Aug 2026, (Accepted for Publication)

Fraser, Douglas, Miller, Alice ORCID logoORCID: https://orcid.org/0000-0002-0941-1717, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Online Model Checking for Anomaly Detection in Industrial Control Systems. In: 20th International Conference on Integrated Formal Methods (iFM 2025), Paris, France, 17-18 November 2025, pp. 162-181. ISBN 9783032107947 (doi: 10.1007/978-3-032-10794-7_9)

Rose, Joe, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) We’re eBPF’d: Exploring Adversarial Manipulation of ELF Files in eBPF-based Programmable Network Stacks. In: IEEE Conference on Communications and Network Security (IEEE CNS 2025), Avignon, France, 8–11 September 2025, ISBN 9798331538569 (doi: 10.1109/CNS66487.2025.11194984)

Chyzy, Jan, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) On the Cost of Asset Discovery Techniques for Industrial Control Systems. In: 8th IEEE Conference on Industrial Cyber-Physical Systems (ICPS), Emden, Germany, 12-15 May 2025, ISBN 9798331542993 (doi: 10.1109/ICPS65515.2025.11087898)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Network-Wide Service Deployment Using Centrally Orchestrated, eBPF-Based Programmable Dataplanes. In: 2025 EuCNC & 6G Summit, Poznan, Poland, 03-06 Jun 2025, pp. 351-356. ISBN 9798350391817 (doi: 10.1109/EuCNC/6GSummit63408.2025.11036869)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Deol, Bikram Singh ORCID logoORCID: https://orcid.org/0009-0004-5675-7499, Shah, Awais Aziz ORCID logoORCID: https://orcid.org/0000-0002-1656-739X and Pezaros, Dimitrios P. ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Dashboard Orchestration of eBPF-based Programmable OT Networks. In: IEEE International Conference on Computer Communications (INFOCOM 2025), London, UK, 19-22 May 2025, ISBN 9798331543709 (doi: 10.1109/INFOCOMWKSHPS65812.2025.11152767)

Holik, Filip ORCID logoORCID: https://orcid.org/0000-0001-6595-0419, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Resilient Network Architecture with eBPF-based Programmability and Centralised Orchestration. In: IEEE International Conference on Computer Communications (INFOCOM 2025), London, UK, 19-22 May 2025, ISBN 9798331543709 (doi: 10.1109/INFOCOMWKSHPS65812.2025.11152786)

Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2025) Artefact Provenance Graphs for Anomaly Inference in Industrial Control Systems. In: 40th International Conference on ICT Systems Security and Privacy Protection – IFIP SEC 2025, Maribor, Slovenia, 21-23 May 2025, pp. 136-150. ISBN 9783031928826 (doi: 10.1007/978-3-031-92882-6_10)

Nahalka, Martin, Cook, Marco M. ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2024) The Good, the Bad and the Ugly: Investigating the Effectiveness of Graph Deep Neural Networks for Anomaly Detection in Industrial Control Systems. In: IFIP International Internet of things (IoT) Conference, Nice, France, 6-8 November 2024, pp. 21-36. ISBN 9783031819001 (doi: 10.1007/978-3-031-81900-1_2)

Niu, Xianghao, Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2024) Examining the Suitability of Stream Ciphers for Modbus-TCP Encryption on Resource Constrained Devices. In: EuroSec '24, Athens, Greece, 22 Apr 2024, pp. 51-57. ISBN 9798400705427 (doi: 10.1145/3642974.3652287)

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Paterson, Cory, Marnerides, Angelos K. ORCID logoORCID: https://orcid.org/0000-0002-7996-6216 and Pezaros, Dimitrios ORCID logoORCID: https://orcid.org/0000-0003-0939-378X (2022) Anomaly Diagnosis in Cyber-Physical Systems. In: ICC 2022 - IEEE International Conference on Communications, Seoul, South Korea, 16-20 May 2022, ISBN 9781538683484 (doi: 10.1109/ICC45855.2022.9838968)

Cook, Marco ORCID logoORCID: https://orcid.org/0000-0002-5232-2381, Stavrou, Ioannis, Dimmock, Sarah and Johnson, Chris ORCID logoORCID: https://orcid.org/0000-0002-1052-9851 (2020) Introducing a Forensics Data Type Taxonomy of Acquirable Artefacts From Programmable Logic Controllers. In: 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 15-19 Jun 2020, ISBN 9781728164281 (doi: 10.1109/CyberSecurity49315.2020.9138879)

This list was generated on Tue Aug 18 15:36:06 2026 BST.

Supervision