Research
I study how embedded and IoT systems fail under attack and how to make them fail less. That work runs from the memory errors in device firmware, through the botnets built from those errors and the traffic they leave on the network, to learning-based defenses that stay trustworthy once they are deployed. It rests on experiments at realistic scale: testbeds and emulators that reproduce an attack end to end before a detection method is judged against it. Recent work extends the same approach to drones and other cyber-physical platforms at the firmware, software, system, and network levels.
Firmware and software security
This line of work starts from memory errors in device firmware and follows one such error from discovery to defense: a memory corruption vulnerability in Connman, a connection manager used on IoT devices (DSN 2019); a short survey of control-hijacking vulnerabilities across IoT firmware (IoTSec 2018); and the question of how a single bug becomes a botnet at scale (DSN 2023). On the defensive side, DAEDALUS applies stochastic software diversity against firmware ROP exploits (arXiv preprint, 2024), and an earlier work-in-progress paper (ACSAC 2020) framed the same idea for large-scale memory exploits in IoT devices. Jadeite (Computers & Security 2022) turns to malware detection, combining image and behavior representations of Java programs.
- memory corruption
- control-flow hijacking
- return-oriented programming
- software diversity
- firmware analysis
- malware detection
Papers in this area
- DSN 2019Exploiting Memory Corruption Vulnerabilities in Connman for IoT Devices
- IoTSec 2018Control-Hijacking Vulnerabilities in IoT Firmware: A Brief Survey
- DSN 2023Creating a Large-Scale Memory Error IoT Botnet Using NS3DockerEmulator
- arXiv 2024DAEDALUS: Defense Against Firmware ROP Exploits Using Stochastic Software Diversity
- ACSAC 2020Work-in-Progress: Mitigating Large-Scale Memory Exploits in IoT Devices Using Software Diversity
- Comput. Secur. 2022Jadeite: A Novel Image-Behavior-Based Approach for Java Malware Detection Using Deep Learning
- FIE 2024Guided Learning and Interactive Visualization for Teaching & Learning Stack Smashing Attacks & Defenses: Experiences and Evaluation
Current directions. Software diversity as a deployable defense for firmware, following the DAEDALUS preprint, and its evaluation against realistic exploit chains.
IoT networks and attack experimentation
Several projects built the attack before studying detection. DDoSim, a simulation testbed that runs real binaries in Docker containers over an NS-3 network, created a large-scale memory-error IoT botnet (DSN 2023). DDoSimQ moved DDoS attack simulation from DDoSim onto full-system emulation (CPSIoTSec 2023), and DDoShield-IoT is a testbed for simulating IoT botnet DDoS attacks with lightweight detection alongside them (DSN-W 2024). A poster on exploit delivery to consumer IoT devices with a WiFi Pineapple (SPW 2019) covers the delivery side. The network foundations go back to completing the IEEE 802.11e implementation in NS-3 (ICICS 2016) and to cloud-supported wireless video surveillance systems (2017 and 2018).
- IoT botnets
- DDoS
- network emulation
- NS-3
- Docker
- testbeds
- intrusion detection
Papers in this area
- DSN 2023Creating a Large-Scale Memory Error IoT Botnet Using NS3DockerEmulator
- CPSIoTSec 2023From DDoSim to DDoSimQ: Enhancing DDoS Attack Simulations Through Full System Emulation
- DSN-W 2024DDoShield-IoT: A Testbed for Simulating and Lightweight Detection of IoT Botnet DDoS Attacks
- SPW 2019Poster: Exploit Delivery to Consumer IoT Devices Using WiFi Pineapple
- ICICS 2016Completing IEEE 802.11e Implementation in NS-3
- J. Supercomput. 2017Internet of Surveillance: A Cloud Supported Large-Scale Wireless Surveillance System
- IoTSMS 2018A Unified Key Distribution and Session Management Protocol for Mobile Video Surveillance Systems
- under review 2026Multi-LF: A Continuous Learning Framework for Real-Time Malicious Traffic Detection in Multi-Environment Networks
Current directions. Continuous, real-time detection of malicious traffic across multiple network environments (Multi-LF, under review).
Trustworthy AI for cyber defense
Learning-based detection has to survive contact with real networks: devices differ, labels are scarce, and the hardware is small. Recent papers take these constraints one at a time. A device-centric and temporal learning framework targets malicious IoT traffic (ICSC 2025); a single autoencoder targets anomaly detection in next-generation networks (GLOBECOM 2025); few-shot retrieval-augmented LLMs (CANS 2025), minimalist LLMs built with quantization and low-rank adaptation (ICAIT 2025), and lightweight fine-tuning for explainable intrusion detection in SDN (WiMob 2025) ask how much model is actually needed. Federated image-based detection runs in real time across participants (DSN-W 2026), and side-channel information from the device serves as a second signal alongside network traffic (DCAS 2026, DSN-S 2026 poster). Adjacent work applies the same tools to security operations (SecLM SOC Copilot poster, 2026) and to multimodal fake news detection (Journal of Big Data 2025).
- network intrusion detection
- side-channel analysis
- federated learning
- large language models
- anomaly detection
- domain adaptation
- explainability
Papers in this area
- ICSC 2025A Device-Centric and Temporal Learning Framework for Malicious IoT Traffic Detection
- GLOBECOM 2025One Model to Catch Them All: Autoencoder-Based Anomaly Detection in Next-Generation Networks
- CANS 2025Few-Shot Retrieval-Augmented LLMs for Anomaly Detection in Network Traffic
- ICAIT 2025Minimalist LLMs for Network Attack Detection via Quantization and Low-Rank Adaptation
- WiMob 2025Lightweight Fine-Tuning of LLMs for Explainable Intrusion Detection in SDN
- DSN-W 2026Seeing in Shades of Gray: Real-Time Federated Image-Based Malicious Traffic Detection
- DCAS 2026Real-Time Malicious Traffic Detection in IoT Networks Using Side-Channel Information
- DSN-S 2026On the Feasibility of Side-Channel Information for Malicious Traffic Detection in IoT Networks
- Applications of ML 2026Poster: SecLM SOC Copilot: A Retrieval-Augmented Large Language Model Copilot for APT Alert Analysis in Security Operations Centers
- J. Big Data 2025Truth Be Told: A Multimodal Ensemble Approach for Enhanced Fake News Detection in Textual and Visual Media
- under review 2026Scalable and Deployable Unsupervised Domain Adaptation for Trustworthy Network Intrusion Detection
- under review 2026Lightweight Hierarchical Detection and Classification of IoT Botnet Attacks Using Side-Channel Analysis
Current directions. Unsupervised domain adaptation for deployable intrusion detection and hierarchical side-channel detection of IoT botnet attacks (both under review).
Embedded systems and drone cybersecurity
The newest line of work, and the focus of the Fall 2027 Ph.D. opening, carries the firmware, side-channel, and network methods above onto embedded and cyber-physical platforms, including drones. The aim is security at every level at which a drone can be attacked: the firmware it boots, the software it runs, the system it controls, and the network it talks over. No publication specific to this line exists yet; the closest published work is listed below.
- cyber-physical systems
- drones
- embedded firmware
- side channels
- system security
Closest published work
- DCAS 2026Real-Time Malicious Traffic Detection in IoT Networks Using Side-Channel Information
- DSN-S 2026On the Feasibility of Side-Channel Information for Malicious Traffic Detection in IoT Networks
- arXiv 2024DAEDALUS: Defense Against Firmware ROP Exploits Using Stochastic Software Diversity
- under review 2026Lightweight Hierarchical Detection and Classification of IoT Botnet Attacks Using Side-Channel Analysis
Current directions. Drone cybersecurity at the firmware, software, system, and network levels, as described in the Fall 2027 Ph.D. call.
Software and testbeds
Systems built for the papers. Each card links to the paper that describes the system.
Simulation testbed
DDoSim
A simulation testbed for large-scale botnet DDoS attacks: real binaries run in Docker containers over a simulated NS-3 network, validated against hardware experiments and used to build a memory-error IoT botnet.
Simulation and emulation tool
DDoSimQ
Extends DDoSim with full-system emulation.
Testbed
DDoShield-IoT
A testbed for simulating IoT botnet DDoS attacks and evaluating lightweight detection alongside them.
Defense prototype
DAEDALUS
A defense against firmware return-oriented programming (ROP) exploits that uses stochastic software diversity.
Where to start
The Research Explorer arranges 15 of the 32 entries into 4 guided reading paths and Working with me lists the papers to read first.