A Research Program in AI Security
Detection models report near-perfect accuracy that disappears under realistic evaluation. Defenses update themselves faster than anyone can validate the change. Published results are difficult for a reader to verify at all. His research treats these as one problem, the problem of evidence, and builds the benchmarks, validation frameworks, and publication formats the problem demands.
01 Thesis
This page documents a long-term research program on evidence in AI security. The systems change; the three questions underneath do not.
Does an evaluation measure the threat, or an artifact of its own design? Ransomware models that score near 100% on single events fall to 75–82% when judged against whole attack sequences.
Evidence →Defenses now change themselves faster than any person can review the change. What does validation have to look like before that autonomy deserves trust?
Evidence →A published claim should hold up when the reader tests it. Manuscript, dataset, and evaluation code belong together, in a form that can be executed.
Framework →02 Research Journey
The sequence of problems that produced the current program, and the evidence each one left behind.
Federal Reserve Bank of Atlanta · Supervision & Regulation, May – Nov 2025
Building automation for cybersecurity examinations inside Supervision & Regulation showed how much of enterprise risk assessment depends on data most people never see directly. It set the question that still drives this work: how do you build a system that improves a decision before a human is asked to make it?
Georgia Tech Research Institute · Undergraduate Researcher, Embedded Systems Security, VIP Program, Aug – Dec 2025
As an undergraduate researcher on an embedded-security team in Georgia Tech's Vertically Integrated Projects program, side-channel and fault-injection work on firmware carried the same discipline below the operating system: question the signal, not the summary. The instrument was the ChipWhisperer-Nano platform, fielded in the CSAW 2025 Embedded Security Challenge.
University of North Georgia · AI/ML Research Assistant, Jan – Jun 2026
Analyzing the update-validation failures behind the 2024 CrowdStrike Falcon content-update outage motivated a validation framework for that class of failure, the basis of a first-author paper accepted to IEEE SoutheastCon 2026. The same research assistantship produced a harder result. Benchmarked on more than 6,200 labeled Sysmon events, ransomware models scored one event at a time reported near-100% accuracy. Evaluated the way an analyst reads a full attack sequence, the same models landed at 75–82%.
Operation North Guard · UNG Capstone, submitted to ISCAP 2026
A capture-the-flag platform built as a UNG capstone met a familiar problem in a new setting: when students share flags, a score stops measuring what it claims to measure. Flags generated per student, salted and hashed, restore the link between the result and the work. The architecture became the basis of the next paper.
RAVA · Ongoing
The recurring problem across this work is the same one: a finding reported in prose is hard to verify. RAVA (Reproducible, Auditable, Verifiable Articles) is a publication format being developed alongside the research: manuscript, dataset, and evaluation code released together as a single interactive object, so a reader can audit the pipeline and test the claim. The format stands apart from any one study. Its first implementation, an interactive edition of the Sysmon evaluation manuscript, is live.
Explore RAVAWhat's Next
The direction from here: defenses that combine behavioral telemetry with AI reasoning to detect threats earlier, evaluated with the scrutiny this work argues for, and able to justify a decision when asked.
03 Publications
Three first-author papers, one argument: evaluation is where security succeeds or fails. An interactive edition of the Sysmon manuscript is the first implementation of RAVA, described in the next section.
Proposes an AI-driven validation framework for the class of update-integrity failures exemplified by the 2024 CrowdStrike Falcon content-update outage. If defenses are trusted to change themselves, validation has to precede the change.
Read on IEEE Xplore →A per-student, salted-hash flag architecture that makes cybersecurity coursework resistant to answer-sharing without adding grading overhead. Assessment is an evaluation system, and it deserves the same integrity guarantees.
Explore the platform →Shows that near-perfect ransomware-detection accuracy is commonly a measurement artifact of event-level data representation rather than a stable result, and that temporal aggregation exposes the gap.
04 Research Direction
A PDF fixes a result at the moment of submission. Verifying a claim usually means re-implementing the pipeline described in a methods section, work few readers do, for a step few papers make easy. RAVA (Reproducible, Auditable, Verifiable Articles) is a format built to close that gap: a paper's manuscript, dataset, and evaluation code are released as a single interactive object, so its results can be audited and tested by the reader, not only read by them.
This is not a replacement for peer review or the written record. It is additional infrastructure around them, and it builds on existing work in augmented scholarly communication, including Living Papers (Heer et al., UIST 2023) and the wider explorable-explanations literature. Where those systems are authoring toolkits, RAVA specifies a reading protocol: the reader commits to a prediction before running the experiment. The format applies to any computational result; the Sysmon evaluation manuscript, currently under review, is its first implementation, with the update-validation paper to follow.
First implementation · Misleading Performance in Sysmon-Based Machine Learning
This is what most Sysmon-based ransomware classifiers report when scored one event at a time.
Illustrative reproduction of the paper's central finding · 6,200+ labeled Sysmon events · 5 models benchmarked · full methodology →
05 Instruments
Software built in service of the program. The stack is a detail; the question is the point.
06 Background
M.S. Cybersecurity (Information Technologies), Atlanta, GA · beginning August 2026
B.S. Cybersecurity, Minor in Entrepreneurship · GPA 3.82/4.00 · Honors Thesis on AI-driven endpoint security
07 Methods
The toolkit is deliberately plain. Python for modeling and evaluation; Sysmon and endpoint telemetry for behavioral data; Ghidra, IDA Pro, and x64dbg when a binary needs taking apart; ChipWhisperer hardware for side-channel capture; SQL, PowerShell, and Bash as connective tissue. Public-facing instruments are built with ordinary web technology, chosen to stay readable and maintainable for years. One rule holds throughout: prefer tools whose behavior can be inspected, because inspection is what the research is about.
08 Research Profiles
This site is the canonical record of the research program. The profiles below mirror parts of it for different readers, and each one links back here.
Persistent researcher identifier · 0009-0002-8147-9123
Publications and the citation record.
Machine-readable profile in the open research graph.
Publications, preprints, and discussion.
The published record, at the publisher.
Research code, instruments, and implementations.
Professional background and affiliations.
09 Contact
Open to research collaboration, replication attempts, and correspondence about the work above. Disagreement with any claim on this page is particularly welcome.
Profiles and published records are listed under Research Profiles.
M.S. Cybersecurity, Georgia Institute of Technology, beginning August 2026.
Two manuscripts, at ISCAP 2026 and EAI Endorsed Transactions, alongside continued work on the RAVA format.