Research

Security and computer networks

My work sits at the intersection of computer security and networking. Much of it comes back to the same question in different forms: how do you know whether a defense is actually working, when the system it protects and the adversary it faces both refuse to hold still?

The complete record is on the publications page.

Areas

Current directions

Cyber threat intelligence

Threat intelligence is easy to consume and hard to trust. The work asks what a feed actually contains: how much distinct information it carries once you account for overlap with every other feed, how quickly an indicator decays into noise, and what sits outside anyone's view entirely. Recent results cover overlap and observability across IP intelligence, the temporal dynamics of indicators, bogon analysis and management, and intelligence-driven analysis of threat actors and their affiliates.

Answering any of this at scale is as much a data engineering problem as a security one. The measurements depend on stream processing, big-data pipelines, and machine learning embedded in them rather than bolted on afterward — which is where much of this line of work has been carried out in collaboration with industry.

Quantifying cyber risk

Most security posture is described qualitatively. This work tries to measure it: dynamic Bayesian models that estimate the risk carried by autonomous system networks, and studies of how exposure turns into exploitation across a whole sector — higher education in particular, where the institutions are numerous, networked, and unusually open by design.

Cost-aware and multi-stage classification

A classifier that is accurate but slow is useless at line rate. The recurring question is what detection looks like under a fixed compute budget: staging cheap tests ahead of expensive ones, trading accuracy against cost along a Pareto front, and letting a classifier decline to answer when it should. Applied to domain shadowing, passive DNS, and process behavior, but the interest is the method itself.

Evolutionary design of secure and resilient configurations

Configurations that no one would think to write by hand, found by evolution and kept diverse on purpose. The approach has produced more secure and efficient virtual local area networks, identified chains of insecure software configuration parameters, and yielded a patent on resilient computing services through systems diversity. Because the configuration keeps changing, it also works as a moving target defense. This line descends from earlier nature-inspired work — digital ants, swarming agents, genetic system management.

Background

Earlier work

Three earlier lines of research account for much of the publication record and are no longer active. Firewall and policy optimization produced function-parallel and data-parallel architectures, trie-based and DAG policy representations, and two patents. Failure prediction used system logs and support vector machines to anticipate hardware and software failures. Network pricing, going back to the dissertation, applied microeconomics to bandwidth allocation and quality of service.

Recent

Student research

Theses and projects completed over the last several years. The shift toward threat intelligence in my own work shows up here first — students tend to reach a new problem before the papers do.

Students

Student researchers

If you are a Wake Forest student interested in computer science research, come talk with me. I have been fortunate to work with the following undergraduate and graduate students on a range of projects.

Graduate

Robin Kester, Ryan Farley, Patrick Wheeler, Chris Kopek, Mike Horvath, Richard Hummel, Eddie Allan, Ashish Tapdiya, Chris Weitzen, Brian Williams, Wes Featherstun, Michael Crouse, Chaz Lever, Brad McDanel, Lee Bailey, David Sontheimer, Jacob White, Tess Stamper, Neal Dawes, Brian Lucas, Michael Nipper, Bryan Prosser, Scott Seal, Xin Zhou, Fletcher Hodnett, Caroline Odell, Sebastian Ramirez, Alina Pacheco, Arnav Bhandari, Nolan Hamilton, Christopher Atala, and Meredith Morrison.

Undergraduate

Cameron Kluth, Graham Kennedy, Adam Reilly, Jeff Shirley, Rob Haining, Katie Batten, Steve Tarsa, Joe Antrosio, Matt Steen, Andrew Schneider, Michael Crouse, Michael Marks, Ian McAuley, Mathew Simari, Bryan Prosser, Scott Seal, Matt McNiece, Sarah Gage, Austin Koeppel, Kyle Flaherty, Ruidan Li, Shucheng (Alex) Liu, Austin McMackin, Sam Embree, Matteo Spighi, Sarah Kate Thomas, Katherine Juarez, Andy Benson, Frank Whitworth, Alex Ross, AJ Aizpurúa, Rick Freedman, Zhengyu Yang, Ellie Wheatley, Raniery Mendes, Allison Christiano, and Christopher Atala.

Support

Research sponsors

This research has been sponsored by the following agencies, foundations, and corporations. I gratefully acknowledge their guidance and support.

• Centripetal Networks — current sponsor
• Air Force Office of Scientific Research
• Cisco Systems, Inc.
• Defense Advanced Research Projects Agency
• Lawrence Livermore National Laboratory
• National Science Foundation
• NEC C&C Research Laboratories USA
• Pacific Northwest National Laboratory
• Shively Family Fellowship
• U.S. Department of Energy
• Wake Forest University