Research

A YARA rule is easy to share. The malware sample used to prove that the rule works often is not. That gap matters in detection engineering. Teams need positive fixtures to test scanners, alerting, incident-response automation, disaster-recovery workflows, and CI pipelines. Using live malware for those tests creates a separate operational problem: isolated infrastructure, handling controls, retention policy, and specialist oversight. A useful test artifact must satisfy the rule without reproducing the behavior of the malware that originally triggered it. ...

High accuracy is not the same thing as robustness.[1] That was the question behind my master’s research on DNS over HTTPS (DoH) tunnel detection. Several machine-learning classifiers reported excellent performance when evaluated on conventional train/test splits. But an attacker does not need to draw another sample from the same dataset distribution. They can change how a tunnel behaves, observe the detector’s output, and search for a traffic pattern that still carries their data while the classifier labels the flow as benign.[1] ...