I build cyber defenses for real attackers.
PhD candidate in Computer Science at UTEP, advised by Christopher Kiekintveld. Before the PhD I spent five years running production infrastructure at a national scale mobile financial platform. Both halves show up in how I work, and my research is funded by IARPA ReSCIND and DEVCOM Army Research Laboratory.
Classical security games assume an attacker who always finds the best move. The attackers in my experiments do something messier. They skim dense tables, lean on two or three attributes, and settle for a target that looks good enough. I measure that behavior, model it with tools from cognitive science and game theory, and fold the models back into defensive planning.
| Repository | What it is |
|---|---|
| network-defense-rl | RL for sequential cyber defense benchmarked against a Quantal Stackelberg Equilibrium solver. Two negative results and the ablation that reframes both, documented rather than buried. Gymnasium, PPO, DQN, SciPy. |
| qse-cyber-deception | The research stack behind my GameSec 2026 paper. Gradient based QSE solver with analytical Jacobian and multi start restarts, reward matrix builders, and a 16 node cyber physical testbed built from real CVE and CVSS records. |
| nxdomain-sentinel | Domain threat classifier scored only on malware families it has never seen. PyTorch, family holdout evaluation, deployed on Cloud Run. |
| Choice-Overload-in-Cyber-Defense | Code and data for GameSec 2025. Behavioral experiment plus conditional logit, mixed logit, and accumulator models fit to attacker target selection. |
Beyond Best Response: Quantal Stackelberg Deception as Insurance Against Attacker Misspecification. GameSec 2026, accepted for oral presentation. Proves that quantal deception concedes little when the attacker model is right and protects substantial value when it is wrong, for any finite Stackelberg game with logit response.
Coordinated Multi-Domain Deception: A Stackelberg Game Approach. ICNC 2026, pages 85 to 89. arXiv:2601.02596
MAD-OOD: A Deep Learning Cluster-Driven Framework for Out-of-Distribution Malware Detection. TrustCom 2025. arXiv:2512.17594
Using Choice Overload to Degrade Cyber Attacks. GameSec 2025, LNCS vol. 16224, Springer, pages 23 to 42. doi:10.1007/978-3-032-08067-7_2
Fine-tuning Large Language Models for DGA and DNS Exfiltration Detection. ACSAC Workshops 2024. arXiv:2410.21723
Full list on Google Scholar.
Five years of production engineering in Bangladesh. At bKash, a mobile financial services platform serving in app banking at national scale, I ran a hybrid AWS and on premises environment, owned incident triage from first alert through diagnosis to engineering handoff, and integrated payment APIs between the banking platform and partner systems. At REVE Systems I administered the Linux and MySQL servers behind production VoIP services and diagnosed service disruptions by capturing and analyzing SIP signaling and media traffic.
That experience is why I care whether a model survives contact with traffic it was never trained on.
Languages Python, C++, Java, JavaScript, Bash
ML PyTorch, TensorFlow, scikit-learn, NumPy, SciPy, pandas, LoRA fine-tuning, Stable-Baselines3, Gymnasium
Modeling Stackelberg and quantal Stackelberg solvers, constrained and gradient based optimization, discrete choice and accumulator models, Gaussian discriminant analysis
Systems Linux, Git, Docker, Kubernetes, AWS, Google Cloud Run, PostgreSQL, MySQL
Security CVE, CVSS and NVD vulnerability data, malware and DGA detection, out of distribution evaluation, packet analysis
Program Committee, AI for Social Impact track, AAAI 2026 and 2027. Reviewer for AAMAS, ICNC, and ICECER.
Website · CV · Google Scholar · LinkedIn · ORCID
Reach me at arahman3@miners.utep.edu.