Research interests
Observe -> Understand -> Connect -> Act & Measure
Cyberattack & Cybercrime Observation
What is happening?
Observe real-world cyberattacks and cybercriminal activity through honeypots, internet-scale measurement, and online platforms and communities.
Cybercrime Ecosystems & Threat Actors
Who is behind it, and how do they operate?
Investigate cybercriminals, their behavior, relationships, markets, and the online ecosystems in which they operate.
Cyber Threat Intelligence & AI
How can we connect the evidence and turn it into actionable intelligence?
Connect evidence from attacks, cybercriminal activity, and other data sources, using AI where appropriate, to produce actionable intelligence at scale.
Intervention & Impact Measurement
Can intelligence lead to effective action?
Use intelligence to support real-world action, from notifying potential victims to reporting abuse to relevant stakeholders, and measure the resulting impact.