Connecting attack evidence with graphs

At Academia Sinica, I worked on threat knowledge bases, graph-based attack correlation, and embedding-based representations of threat intelligence.

I also simulated APT campaigns across Linux and Windows, studied kernel-audit-log reduction, and applied BERT-based models to honeypot traffic and packet captures. This experience continues to shape the operational problems I study with AI agents.

Research approach

1. Combine intelligence with host and network telemetry.
2. Represent relationships using graphs and learned embeddings.
3. Preserve behavioral evidence for attack investigation.