Research
I design and build practical systems that deliver security and privacy on today's networks — without compromising performance.
The Internet was not designed with security in mind. Its protocols were built on the premise that all participants act in good faith — an assumption that simply does not hold in practice. This creates two fundamental challenges my work directly addresses: users and services cannot control who can send them traffic, enabling DDoS and protocol-abuse attacks at scale; and users cannot control how their own traffic is routed, leaving them subject to interception and path manipulation by adversarial intermediate networks. Most defenses patch these problems from outside the network, sacrificing performance or burdening end users. My approach pushes security into the network itself.
Securing Against Volumetric Attacks
Adversaries exploit the Internet's open sender model to flood victims with traffic — over 8 million DDoS attacks disrupted critical services in the first half of 2025 alone. I build in-network defenses that intercept and filter attacks at hardware line rate, before they can saturate servers or upstream links, and identify new attack surfaces in emerging mobile infrastructure.
The first hardware–software split-proxy defense against SYN flood attacks on a P4 programmable switch. SmartCookie offloads high-speed cryptographic verification to switch hardware and exact stateful tracking to a lightweight eBPF server proxy — achieving 100% defense accuracy while scaling attack handling by up to 100× beyond any server-side defense, without degrading user performance.
A principled framework for layering in-network defenses against large-scale attacks. A P4 switch provides coarse-grained hardware filtering at 100 Gbps; a software proxy applies fine-grained stateful inspection to the residual traffic. Sieve generalizes SmartCookie's split-proxy design into a template applicable to a broader class of volumetric attacks.
Network hardware lacks native cryptographic support — a fundamental barrier to secure in-network processing. This work implements and open-sources a lightweight keyed hash function (SipHash) directly on P4 programmable switches, creating an essential building block for SmartCookie and future in-network security systems.
The first systematic study of integrity vulnerabilities in 5G fronthaul — the high-speed link between a base station's radio head and its baseband processor. In collaboration with Microsoft Research, we demonstrate practical packet-based attack scenarios that enable large-scale disruption, and advocate for mandatory end-to-end integrity protections in 5G standards.
Securing the Routing Infrastructure
Traffic traverses a sequence of independently operated Autonomous Systems (ASes) following paths determined by BGP — built around economic agreements rather than security or privacy needs. Edge networks cannot view, evaluate, or select alternate routes to avoid adversarial or unreliable intermediate networks. I design cooperation frameworks that expose and leverage path diversity using Internet-native mechanisms, without requiring changes to core routers or global coordination.
The first framework enabling cooperating edge networks to jointly discover, measure, and select real Internet paths. TANGO exploits BGP community attributes to uncover hidden AS-level paths, and integrates active in-network measurements on programmable hardware to dynamically select among BGP-compliant alternatives in real time. Deployed and validated on a global testbed spanning 25 cities.
Website fingerprinting (WFP) lets adversaries infer users' browsing activity from encrypted traffic patterns alone. PraxiGuard builds on TANGO's route-control framework to split traffic across multiple paths, obfuscating the revealing patterns WFP exploits. Its key innovation is a principled, network-aware model of privacy risk and performance cost, enabling edges to jointly optimize both without sacrificing either.
At Amherst
I am building a research group at Amherst centered on three directions designed for meaningful undergraduate participation:
Treating campus, home, and community networks as living laboratories to identify real vulnerabilities in IoT sensors, drones, and connected devices — including game-based "build-it, break-it, fix-it" competitions.
Generalizing SmartCookie and Sieve into a principled framework for hardware–software co-designed defenses, using eBPF and SmartNICs as accessible platforms for student researchers.
LLM inference creates novel network-layer traffic patterns and attack surfaces. Students explore both performance optimizations and new security vulnerabilities in next-generation AI-driven networking.
Reach out if you are interested in collaborating or joining my research group.