Security researcher and software engineer. My master's thesis benchmarked locally hosted LLMs at identifying IoT devices from network scans — write-up, paper, and slides are under research. Everything here runs on my homelab, including the particle engine behind this text. Pick a section.
// index — click a section to expand
01~/about
who i am▸
// whoami
Cybersecurity professional and software engineer, currently pursuing a Master's degree in Cyber Defense. With a foundation in computer science and hands-on industry experience in software development, I work at the gap between secure coding practices and scalable software.
My focus is on building resilient systems that hold up against modern threats — combining academic research with practical engineering to approach problems from both the offensive and defensive side.
Graduate Assistant — University Cyber Defense Program
Cybersecurity research and curriculum support; building and maintaining lab environments for hands-on security exercises; contributing to research in network security and threat detection.
One-on-one tutoring in programming and CS fundamentals; mentoring students in debugging, algorithms, and development practice.
2020 – 2022
teaching
// education & certs
M.S. Cyber Defense
Network security, cryptography, digital forensics, security architecture. Research focus on modern threat detection and prevention.
in progress
degree
B.S. Computer Science
Software development, algorithms, data structures, system design.
completed
degree
CompTIA Security+ · CompTIA CySA+
Professional certifications.
certs
// home lab
Enterprise-grade infrastructure at home — used as a test range for everything on this page.
Proxmox VE — type 1 hypervisor; isolated VMs for security testing, LXC containers for services
Segmented VLANs — separate IoT, lab, and production networks with custom firewall rules
Pi-hole — network-wide DNS filtering
Nginx Proxy Manager — reverse proxy with SSL termination (this site is served from it)
Docker + monitoring stack — containerized deployment with system and network observability
03~/research
thesis & publications▸
// master's thesis
Evaluating LLMs for CPE Identification in IoT Reconnaissance
M.S. Cyber Defense · Eastern Washington University · Spring 2026
Vulnerability identification during penetration testing relies on rigid string matching to map network scan data to CPE identifiers and downstream CVE records — and it fails routinely on IoT devices, whose truncated, non-standard banners resist deterministic parsing. LLMs can reason through these fuzzy associations, but sending live reconnaissance data to a cloud model is an operational-security problem. The thesis asks: can locally hosted open-weight models do this job well enough to be useful, and what do you trade to keep the analysis on-premise?
Evaluated 36 LLMs across three deployment tiers — frontier hosted APIs, remotely hosted open-weight, and local vLLM serving — plus Nmap's native CPE extraction as a no-LLM baseline
Scored against hand-labeled ground truth from real Nmap scans of 16 IoT devices, with a tiered rubric separating exact, partial, and confidently-wrong identifiers
The best truly-local model (an 8B security fine-tune on a single 24 GB consumer GPU) approaches the weakest frontier model — local inference is viable for this task
The most dangerous failure isn't malformed output — it's a well-formed CPE that retrieves the wrong vulnerability list (21.9% of predictions overall)
Overleaf, minus the cloud. A browser-based, single-user LaTeX environment — open or import a project, edit .tex / .bib / .sty files, pick a root file, compile, preview, export. No account, no server, no cloud storage: your documents never leave your machine. v0.1 ships the editor shell (project import, file tree, editor, draft preview, autosave-in-browser); full WASM PDF compilation is the next milestone.
Interactive privacy demo — shows what any website can learn from your browser using standard APIs, what each data point means, and which ones require permission. Runs entirely locally. Live at the bottom of this section.
Thesis tooling — benchmarking locally hosted LLMs at generating CPE identifiers from raw Nmap scans of IoT devices. Write-up, paper, and slides under research.
You didn't log in. You didn't accept a cookie. You just opened a page — and already it can read your hardware, your settings, the page you came from, and roughly where you are on the planet. No malware, no permission prompts. This is the ordinary, invisible baseline of being online. Run the scan and see your own.
target: your browser | status: awaiting command
how this demo behaves: the device scan runs entirely in your browser —
no data is stored or uploaded. The optional network lookup is the one exception:
it makes a single request to a public IP-geolocation API to show what any server already
learns the instant you connect to it. That request is clearly marked and only fires when
you click it. Nothing here is saved or sent anywhere by this site.
the network already knows where you are
Your device scan never touches the network — but the moment your browser connects
to any server, it hands over your IP address, and an IP maps to a real-world location and
internet provider. The button below makes one real request to a public
geolocation API and shows what comes back. This is the request every site, ad, and tracker
pixel makes about you automatically.
requires explicit permission
The sensitive stuff — location, camera, microphone, notifications, clipboard — is gated
behind a browser permission prompt. A site can't read these silently. The button below uses the
Permissions API to check the current status of each permission for this site.
Checking status never triggers a prompt and never accesses the underlying data.
so what? none of these data points names you on its own. The danger is the
combination: your screen size, fonts, timezone, GPU, and language together form a
fingerprint that is often unique enough to recognize you across sites — no cookie
needed. Pair that with your IP, and a tracker can stitch your browsing into a profile that gets
bought and sold. You can push back: a content blocker (uBlock Origin), a VPN to mask your IP,
and a privacy-respecting browser (Firefox, Brave, Mullvad — Tor for the serious) each remove a
layer. Worth taking seriously.
05~/contact
reach me▸
// reach out
Always open to discussing opportunities, collaborations, or connecting with others in security and software engineering.