Research / Paper Files

Paper Files

Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.

I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.

DAI & ADAI · 2026

AllDetectionDFIRAppSecDevSecOpsAI SecurityIAMCloudContainersIRCryptoResearchPhishingSecrets

25 papers

Detection

A Unified and Scalable Framework for Cybersecurity Detection: Theory, Algorithms, Systems, and Empirical Evaluation

bpf_get_current_pid_tgid`, `bpf_probe_read_kernel`, `bpf_map_lookup_elem`). We formally prove that none of these functions, when used with arguments validated by our static analyzer, have side effects that modify the security-relevant state of the observed process or the kernel outside of specific, safe scratch areas (e.g., eBPF maps). For example, `bpf_probe_read_kernel` is a read-only operation. Calls to helpers that do modify state, such as `bpf_map_update_elem`, are only permitted on maps owned by the program itself, ensuring that program execution only affects its own future internal st

Read paper →