Selected work

Representative Papers

Tempo: Reconstructing Synchronous Reactive Programming with OCaml 5 Effects

Jul 26, 2026

This work presents the first purely library-based implementation of core synchronous reactive programming mechanisms in standard OCaml 5, without requiring any language extensions. Building upon algebraic effects and deep effect handlers, we introduce the Tempo runtime, which delineates reactive suspension points via effect operations and reifies captured continuations into tasks scheduled according to logical instant semantics. This approach supports cooperative threads, broadcast signals, and dynamic process creation while fully reproducing the core semantics of ReactiveML. Through empirical evaluation, we quantify the runtime overhead incurred by this library-level implementation and identify the key mechanisms responsible for the dominant performance costs.

0 citationsRead paper

Kairos: Generating Tick-Indexed Proof Obligations for Synchronous Temporal Contracts

Jul 25, 2026

This work addresses the challenge of verifying temporal safety contracts for synchronous programs, which involve global properties spanning multiple clock cycles and are not amenable to direct handling by conventional deductive verification tools. The authors present Kairos, a novel toolchain that, for the first time, automates the generation of tick-indexed Why3 proof obligations from synchronous programs paired with assume-guarantee contracts expressed in Linear Temporal Logic (LTL). Their approach leverages automata theory by compiling LTL specifications into bad-state automata and constructing their product with the program. The correctness of this framework is formally mechanized in Rocq. Experimental evaluation successfully verifies a medical infusion controller, demonstrating that under given environment assumptions, every input trace induces a unique execution satisfying the temporal guarantees—highlighting the method’s effectiveness in supporting temporal contracts for reactive systems.

0 citationsRead paper

Anonymous YARA Rules Are Not Anonymous

May 26, 2026

This study demonstrates that merely stripping metadata from shared YARA rules is insufficient to preserve contributor anonymity. For the first time, it systematically reveals that YARA rules themselves constitute a quantifiable OPSEC attack surface, enabling adversaries to infer sensitive attributes—including author identity, source repository, malware family, and temporal drift—directly from rule content. Leveraging stylistic analysis through lexical n-grams (Burrows’ Delta), syntactic abstract syntax tree (AST) features (Caliskan-Islam), and a fine-tuned CodeBERT model, the authors achieve 76% accuracy in re-identifying rule authors even after controlling for malware family, alongside 99% accuracy in identifying the originating repository and 95% accuracy in malware family classification. These results expose significant privacy risks in current YARA rule anonymization practices.

0 citationsRead paper

Converging Zero Trust and IoT Security: A Multivocal Literature Review

Apr 27, 2026

This study addresses the fragmented understanding and critical research gaps at the intersection of IoT security and Zero Trust principles, where academic and industrial perspectives remain largely disconnected. Employing a multivocal literature review (MLR) methodology, the work synthesizes 68 academic and 36 industrial sources through qualitative content analysis and a cross-domain comparative framework, systematically evaluating them against NIST’s Zero Trust standards. The analysis reveals that while academic research primarily focuses on redesigning IoT architectures to align with Zero Trust tenets, industry efforts concentrate on integrating Zero Trust into existing infrastructures—approaches that are complementary yet divergent in emphasis. The study identifies three key research gaps: sociotechnical comprehension, cost-benefit assessment, and interdisciplinary collaboration, offering a structured roadmap to foster synergistic innovation across academia and industry.

0 citationsRead paper

Zero Trust in the Context of IoT: Industrial Literature Review, Trends, and Challenges

Apr 07, 2026

This study addresses the lack of unified standards for integrating Internet of Things (IoT) devices into Zero Trust architectures, a gap that has led to widespread discrepancies between nominal compliance and actual implementation, thereby disconnecting policy from practice. By systematically analyzing non-academic industrial sources—including whitepapers, technical reports, and vendor solutions—and comparing real-world deployment cases, this work identifies instances of superficial compliance and clarifies the core barriers and evolutionary trends in aligning IoT with Zero Trust principles. The research distills actionable, empirically grounded practices tailored to real-world constraints, offering a clear pathway and evidential foundation for future standardization efforts and academic inquiry in this domain.

0 citationsRead paper

Recent publications

Latest Papers

Tempo: Reconstructing Synchronous Reactive Programming with OCaml 5 Effects

Jul 26, 2026

This work presents the first purely library-based implementation of core synchronous reactive programming mechanisms in standard OCaml 5, without requiring any language extensions. Building upon algebraic effects and deep effect handlers, we introduce the Tempo runtime, which delineates reactive suspension points via effect operations and reifies captured continuations into tasks scheduled according to logical instant semantics. This approach supports cooperative threads, broadcast signals, and dynamic process creation while fully reproducing the core semantics of ReactiveML. Through empirical evaluation, we quantify the runtime overhead incurred by this library-level implementation and identify the key mechanisms responsible for the dominant performance costs.

0 citationsRead paper

Kairos: Generating Tick-Indexed Proof Obligations for Synchronous Temporal Contracts

Jul 25, 2026

This work addresses the challenge of verifying temporal safety contracts for synchronous programs, which involve global properties spanning multiple clock cycles and are not amenable to direct handling by conventional deductive verification tools. The authors present Kairos, a novel toolchain that, for the first time, automates the generation of tick-indexed Why3 proof obligations from synchronous programs paired with assume-guarantee contracts expressed in Linear Temporal Logic (LTL). Their approach leverages automata theory by compiling LTL specifications into bad-state automata and constructing their product with the program. The correctness of this framework is formally mechanized in Rocq. Experimental evaluation successfully verifies a medical infusion controller, demonstrating that under given environment assumptions, every input trace induces a unique execution satisfying the temporal guarantees—highlighting the method’s effectiveness in supporting temporal contracts for reactive systems.

0 citationsRead paper

Anonymous YARA Rules Are Not Anonymous

May 26, 2026

This study demonstrates that merely stripping metadata from shared YARA rules is insufficient to preserve contributor anonymity. For the first time, it systematically reveals that YARA rules themselves constitute a quantifiable OPSEC attack surface, enabling adversaries to infer sensitive attributes—including author identity, source repository, malware family, and temporal drift—directly from rule content. Leveraging stylistic analysis through lexical n-grams (Burrows’ Delta), syntactic abstract syntax tree (AST) features (Caliskan-Islam), and a fine-tuned CodeBERT model, the authors achieve 76% accuracy in re-identifying rule authors even after controlling for malware family, alongside 99% accuracy in identifying the originating repository and 95% accuracy in malware family classification. These results expose significant privacy risks in current YARA rule anonymization practices.

0 citationsRead paper

Converging Zero Trust and IoT Security: A Multivocal Literature Review

Apr 27, 2026

This study addresses the fragmented understanding and critical research gaps at the intersection of IoT security and Zero Trust principles, where academic and industrial perspectives remain largely disconnected. Employing a multivocal literature review (MLR) methodology, the work synthesizes 68 academic and 36 industrial sources through qualitative content analysis and a cross-domain comparative framework, systematically evaluating them against NIST’s Zero Trust standards. The analysis reveals that while academic research primarily focuses on redesigning IoT architectures to align with Zero Trust tenets, industry efforts concentrate on integrating Zero Trust into existing infrastructures—approaches that are complementary yet divergent in emphasis. The study identifies three key research gaps: sociotechnical comprehension, cost-benefit assessment, and interdisciplinary collaboration, offering a structured roadmap to foster synergistic innovation across academia and industry.

0 citationsRead paper

Zero Trust in the Context of IoT: Industrial Literature Review, Trends, and Challenges

Apr 07, 2026

This study addresses the lack of unified standards for integrating Internet of Things (IoT) devices into Zero Trust architectures, a gap that has led to widespread discrepancies between nominal compliance and actual implementation, thereby disconnecting policy from practice. By systematically analyzing non-academic industrial sources—including whitepapers, technical reports, and vendor solutions—and comparing real-world deployment cases, this work identifies instances of superficial compliance and clarifies the core barriers and evolutionary trends in aligning IoT with Zero Trust principles. The research distills actionable, empirically grounded practices tailored to real-world constraints, offering a clear pathway and evidential foundation for future standardization efforts and academic inquiry in this domain.

0 citationsRead paper