A state-sensitive syscall-filtering framework that tracks PHP script execution and updates the kernel-enforced allow-list as the application moves between execution states.
Projects
Selected research and engineering projects in computer systems and security.
An isolation architecture that assigns each client a disposable application container with permissions tailored to that user, limiting the reach and persistence of a server compromise.
A research prototype that separates WebAssembly guest execution from host-function execution across OS processes and marshals guest-memory arguments across the process boundary.
A host-based SDN design that combines endpoint flow rules with VLAN-specific spanning trees to provide traffic engineering using ordinary managed switches.