Research Explorer
Four ways into the work. Each path is three to five papers in an order that makes the next one easier to read, with a sentence on why it is there.
From one memory bug to a botnet
How does a single memory corruption vulnerability in device firmware turn into a network-scale problem, and what stops it?
- Exploiting Memory Corruption Vulnerabilities in Connman for IoT Devices conference paper
The concrete case: a memory corruption vulnerability in Connman, exploited on IoT devices. Read it for the exploit mechanics and the constraints an embedded target imposes.
- Control-Hijacking Vulnerabilities in IoT Firmware: A Brief Survey workshop paper
The wider landscape: a short survey of control-hijacking vulnerabilities in IoT firmware that places the Connman case among its neighbors.
- Creating a Large-Scale Memory Error IoT Botnet Using NS3DockerEmulator conference paper
Scale: DDoSim builds a large memory-error IoT botnet so that the consequences of one bug can be measured rather than imagined.
- DAEDALUS: Defense Against Firmware ROP Exploits Using Stochastic Software Diversity preprint
The defense: DAEDALUS uses stochastic software diversity against firmware ROP exploits. It is a preprint, so read it as current work rather than settled results.
Build the attack before the defense
How do you get a DDoS experiment that is realistic enough to trust, and what does detection look like once you have one?
- Completing IEEE 802.11e Implementation in NS-3 conference paper
The foundation: completing the IEEE 802.11e implementation in NS-3, the simulator that later work builds on.
- From DDoSim to DDoSimQ: Enhancing DDoS Attack Simulations Through Full System Emulation workshop paper
From simulation to emulation: DDoSimQ moves DDoS attack simulation onto full system emulation.
- DDoShield-IoT: A Testbed for Simulating and Lightweight Detection of IoT Botnet DDoS Attacks workshop paper
The packaged testbed: DDoShield-IoT simulates IoT botnet DDoS attacks and evaluates lightweight detection on the same platform.
- A Device-Centric and Temporal Learning Framework for Malicious IoT Traffic Detection conference paper
Detection with the device in view: a device-centric and temporal learning framework for malicious IoT traffic.
How much model does a network defense need?
When learning-based detection has to run on real networks and small hardware, what is the smallest model that still works, and what evidence can it use?
- One Model to Catch Them All: Autoencoder-Based Anomaly Detection in Next-Generation Networks conference paper
One autoencoder for anomaly detection across next-generation networks: the case for a single compact model.
- Minimalist LLMs for Network Attack Detection via Quantization and Low-Rank Adaptation conference paper
Shrinking language models for attack detection with quantization and low-rank adaptation.
- Few-Shot Retrieval-Augmented LLMs for Anomaly Detection in Network Traffic conference paper
Few-shot retrieval-augmented LLMs, for when labeled traffic is scarce.
- Seeing in Shades of Gray: Real-Time Federated Image-Based Malicious Traffic Detection workshop paper
Federated, image-based detection in real time, so that participants keep their traffic to themselves.
- Real-Time Malicious Traffic Detection in IoT Networks Using Side-Channel Information conference paper
A different signal altogether: side-channel information from the device, alongside network traffic.
Teaching memory safety
How do you teach stack smashing so that students actually understand it, and what should they read once they do?
- Guided Learning and Interactive Visualization for Teaching & Learning Stack Smashing Attacks & Defenses: Experiences and Evaluation conference paper
Guided learning and interactive visualization for stack smashing attacks and defenses, with classroom evaluation (FIE 2024).
- Exploiting Memory Corruption Vulnerabilities in Connman for IoT Devices conference paper
A real-world instance of the class of bug the course teaches, on an IoT target.
- Work-in-Progress: Mitigating Large-Scale Memory Exploits in IoT Devices Using Software Diversity work in progress
Software diversity as a mitigation, in work-in-progress form: a short read that sets up DAEDALUS.
Timeline
One mark per publication in its year. An outlined mark is a preprint and a dashed mark is under review.
- 2026Fall 2027 Ph.D. call in embedded systems and drone cybersecurity
- 2025
- 2024Assistant Professor, North Carolina A&T State University
- 2023
- 2022
- 2021
- 2020
- 2019
- 2018First course as instructor at UNC Charlotte (ITIS 3200)
- 2017
- 2016
- 2015