Research software
Personal research projects connecting cybersecurity, workload identity and dependable systems with reproducible implementations.
Explore a small example, inspect its assumptions, then follow the code and evidence. All demonstrations run locally in your browser.
FaultGraph Lab
Python research software for graph-logical models of fault-tolerant systems. It evaluates connectivity and reliability, reproduces published examples, and checks finite-instance equivalence when transforming models into alternative Boolean representations. Its core runs offline.
Interactive browser example
Which failures can the system tolerate?
The published K12 model can tolerate some three-processor failures. Try two states with five working processors and different outcomes.
Selected state 00111011
All vertices connected
5 of 8 components working · 7 of 12 connections active.
Independent components with the same probability. Component buttons inspect one state; this slider weights all possible states.
Across all 256 possible states
How the exact calculation works
59 of 256 states work: 37 states with at most two failures, plus 22 specified states with three failures. Each working state contributes pᵏ(1 − p)⁸⁻ᵏ, where k is its working-processor count.
K12 model adapted from Romankevich et al. (2026), including L. Zacharioudakis; CC BY 4.0. Independent browser explainer of a finite public example. Reference model.
Research context, verification and reuse
Computational reproduction of published graph-logical modeling methods from coauthored research. The linked paper provides the eight-processor example explored in the public implementation.
Vitaliy Romankevich, Kostiantyn Morozov, Alexei Romankevich, Petro Malezhyk, Lefteris Zacharioudakis (2026). A Generalized Method for Constructing Graph-Logical Models of Non-Basic Fault-Tolerant Multiprocessor Systems via Model Combination.
Review checks. The public eight-processor examples were reproduced over all 256 states. The browser models were checked against the Python fixtures across 264 states and 202 probability settings.
Scope. Checks establish agreement for finite models under stated connectivity and probability assumptions; they do not demonstrate universal speedups or deployed-system reliability.
Reuse. Source available with rights reserved; no general software license has been selected. Cited articles and included Topology Zoo data retain CC BY 4.0.
CI run for the reviewed revision
Reviewed source and reproduction instructions · Revision b34dd1d · Reviewed 12 October 2026
Python research prototype for security-event triage. It checks proposed observations against authorized source records, preserves provenance and bounds read-only investigation. An offline synthetic demonstration separates supported observations, unsupported claims and cases requiring human review.
Synthetic evidence · recorded verifier outputs
Check what the evidence actually supports
Select a candidate claim and its evidence scope. These nine outcomes were reproduced with the public Python verifier.
Source record
Public synthetic fixture · tenant demo-a
- Event
- Windows authentication · 4625
- Outcome
- Failure
- Time
- Process observed
- None in this record
Inspect provenance
Hashes identify the synthetic fixture records; they do not independently certify the source.
- Event ID
1b032ca6-302f-5340-a4e5-dda432708238- Source row index
- 160
- Source SHA-256
6a7747caf6f52f4f20d6a32f730934c62129b9d48c347030d9a8681688e50cfe- Canonical SHA-256
3cb14cb3bb297d89b8e5088aa1dbf8c2576af24102863c610ef0aabbbcfd0dc8
Claim verification
VerifiedThe authorized source record contains a failed authentication event. That observation is supported.
observed_login_failure / predicate_supported
The original offline demo retains the supported observation and returns needs_review. Verifying a record does not establish that an incident is malicious. The browser displays recorded checks on a synthetic fixture; no logs or model services are submitted.
Research context, verification and reuse
Motivated by coauthored research on shared security operations and LLM applications in cyber defense. These publications provide context; they do not establish the prototype's efficacy.
Eleftherios Zacharioudakis, Elena Kakoulli (2025). A Scalable Cybersecurity Model for Shared SOCs in SMEs.
Elena Kakoulli, Eleftherios Zacharioudakis, Salomi Evripidou (2025). Intelligent Cyber Defense: Leveraging LLMs for Real-Time Threat Detection and Analysis.
Review checks. The reviewed public snapshot passed 274 offline tests. The synthetic demo and all nine displayed claim/scope checks were reproduced with its Python runtime. PostgreSQL integration remains a separate test path.
Scope. Historical model studies did not establish the incident-recall target; synthetic demonstrations do not establish real-world triage efficacy.
Reuse. Original code and synthetic fixtures use the MIT License. External data and optional dependencies retain their own licenses.
CI run for the reviewed revision
Reviewed source and reproduction instructions · Revision 3d81217 · Reviewed 12 October 2026
ProofMesh
Go research prototype for workload authorization under delayed trust updates. It combines deterministic policies, durable trust state and synthetic scenario replay, returning explicit decisions and explanations. Real SPIFFE integration is a separate optional component.
Synthetic source trace · F06_s17
When revoked trust still looks valid
A network partition starts at t=1. The issuer is revoked at t=2. Follow what the verifier knows at each request.
Freshness budget: 120 seconds
Strict mode maps uncertainty to rejection. It cannot reveal an unseen revocation.
Reference decision · request r10
ACCEPTOracle authorization: unauthorized (false)
AUTHORIZED
- Verifier’s observed trust
- a1 is still trusted
- Cached evidence age
- 10 seconds
- Authoritative trust
- Issuer a1 was revoked at t=2
- Oracle label
oracle_authorized: false
The issuer was revoked at t=2, but the partition hides that change. The verifier accepts using its still-fresh cached trust.
Reference outcomes and strict-mode behavior were reproduced with the reviewed Go core on October 12, 2026. This browser trace explorer does not execute Go or validate real credentials. All three unauthorized labels were reproduced with the repository’s Python oracle.
Research context, verification and reuse
Explores workload identity and trust management in distributed systems. The reviewed public repository does not identify a corresponding peer-reviewed project publication.
Review checks. The reviewed core passed its Go package tests. Normal and strict F06 runs reproduced the three displayed request decisions; the Python oracle confirmed their unauthorized ground-truth labels.
Scope. A verifier cannot detect a remote revocation before evidence arrives; explicit uncertainty does not eliminate stale authorization.
Reuse. Original-code reuse licensing is pending; public source visibility grants no reuse license. Upstream libraries retain their own licenses and notices.
CI run for the reviewed revision
Reviewed source and reproduction instructions · Revision 67acb97 · Reviewed 12 October 2026
Implementations used AI assistance. Original publications retain their full coauthorship; each repository documents attribution, assumptions and limitations. Repository revisions and demonstration scope are recorded in source notes.