Research

Which defence is worth its cost against a particular attacker? Robert’s attacker/defender meta-model connects real attack patterns, vulnerabilities and countermeasures (from CAPEC, MITRE ATT&CK and NIST SP 800-53) in one model with time, cost and uncertainty.

Formalised as Markov decision processes and stochastic games, the model lets defenders compare planned controls before investing in them and estimate the odds of real attack scenarios. Turned into a game, it becomes PenQuest, which students and practitioners play to learn how attacks and defences interact.

• Gamifying information security: Adversarial risk exploration for IT/OT infrastructures · Computers & Security, 2025
• Quantifying the Odds in Real World Attack Scenarios · IEEE CSR, 2024
• Comparing the Effectivity of Planned Cyber Defense Controls in Order to Support the Selection Process · Conference paper, 2024
• Formalizing Real-world Threat Scenarios · Conference paper, 2022
• PenQuest: a gamified attacker/defender meta model for cyber security assessment and education · Journal of Computer Virology and Hacking Techniques, 2020

Timestamps are among the most used and most misread artefacts in an investigation. Together with his students, Robert examined how Windows applications change NTFS timestamps, which is distinctive enough to tell which application last touched a file.

Another study looked at Linux environments running inside Windows through WSL2: how to detect them on a seized machine, analyse them and bring them back up as a working virtual machine. Current interests include anti-forensics, anti-evasion and mobile forensics.

• Timestamp-based Application Fingerprinting in NTFS · Conference paper, 2024
• WSL2 Forensics: Detection, Analysis & Revirtualization · Conference paper, 2022
• Time for Truth: Forensic Analysis of NTFS Timestamps · ARES, 2021

Signature-based detection struggles with attacks it has never seen, and anomaly detection on its own leaves the interpretation to an analyst. Robert’s doctoral work, Advanced Threat Intelligence: Interpretation of Anomalous Behavior in Ubiquitous Kernel Processes, closed that gap.

The system learns how common Windows kernel processes normally behave, flags the deviations within a user session and then explains them: which kind of activity it is likely to be and which stage of an attack it fits. An ontology of targeted attacks (TAON), natural-language and graph-based methods, and a survey of semantics-aware detection systems laid the groundwork.

• AIDIS: Detecting and Classifying Anomalous Behavior in Ubiquitous Kernel Processes · Computers & Security, 2019
• Advanced threat intelligence: detection and classification of anomalous behavior in system processes · e & i Elektrotechnik und Informationstechnik, 2019
• LLR-Based Sentiment Analysis for Kernel Event Sequences · IEEE AINA, 2017
• Semantics-aware detection of targeted attacks: a survey · Journal of Computer Virology and Hacking Techniques, 2017
• TAON: An ontology-based approach to mitigating targeted attacks · Conference paper, 2016

To detect malware by what it does, “what it does” needs a precise description. Early work defined a schema that describes malicious software from its high-level goals down to individual operating-system functions, and used data mining to classify and cluster samples.

Later work turned long system-call traces into something an analyst can read: SEQUIN infers grammars from event traces to surface recurring behaviour, and visual-analytics tools built with colleagues from St. Pölten let analysts explore the patterns. Related studies covered how malware hides its processes and how rootkits persist in BIOS/UEFI firmware.

• SEQUIN: a grammar inference framework for analyzing malicious system behavior · Journal of Computer Virology and Hacking Techniques, 2018
• Visual Analytics: Foundations and Experiences in Malware Analysis · Empirical Research for Software Security, CRC Press, 2017
• The Evolution of Process Hiding Techniques in Malware – Current Threats and Possible Countermeasures · Journal of Information Processing, 2017
• Longkit – A Universal Framework for BIOS/UEFI Rootkits in System Management Mode · Conference paper, 2017
• A Survey of Visualization Systems for Malware Analysis · EuroVis STARs, 2015
• Malicious Behavior Patterns · Conference paper, 2014