Topological ManifoldsMarzio De Corato
Topological ManifoldsCybersecurity and software behaviour analysis
02 / Cybersecurity and software behaviour analysis

Cybersecurity and software behaviour analysis.

Security applications

Research problem

Which execution traces can identify malicious behaviour?

Information collected during program execution, including hardware counters and calls to system functions or libraries, describes software behaviour through measurable features on which malware and ransomware detection methods can be built and evaluated, examining whether observed differences persist when new data are considered.

Approach and tools

In the 2025 work on ransomware detection, sample entropy describes the temporal evolution of signals, while graphical models allow dependencies between the selected features to be examined. Other activities have investigated library calls and the interpretability of classification methods. The co-supervised theses address low-level feature analysis and the relationship between generative AI and malicious software.

Sample entropyBehavioural tracesLibrary callsLow-level features

Related activities

Statistics and Data Science Conference 2025: “Detection via Library Calls using Markov Random Fields: a XAI-Driven Approach to Cybersecurity”.

Co-supervision of theses on ransomware, malware detection, Explainable AI and system-feature analysis.

Related work

← All research topics

Explore Topological Manifolds

Complete search page ↗

Graph theory and cyber-attacks

Unaffected nodeCompromised node

When devices, services and identities are described through their relationships, system security can be studied as a structural problem in which both a vulnerability and the paths through which it could expose other resources matter.

From connections to attack paths

A graph G = (V, E) consists of vertices V and edges E. In an asset network, vertices may represent devices or services, while edges describe connections, dependencies or trust relationships. An attack graph instead represents conditions, actions or system states, depending on the model, to examine how several steps can combine into a compromise.

G = (V, E)

The analogy with an epidemic helps illustrate how a compromise can spread between nodes, provided that the conditions for each transition are considered. Credentials, permissions, vulnerabilities and configurations determine which paths are feasible; a connection alone describes a possibility of communication.

How this supports defence

Path analysis helps identify the resources reachable from an initial position and the connections that form critical passages. Comparing the graph before and after a change shows how network segmentation, reduced privileges or a vulnerability fix can interrupt particular sequences. A node’s importance depends on its role and context, so its number of connections gives only a partial account of risk.

Reading this figure

Red nodes marked with a cross represent compromised systems in the scenario; green nodes remain unaffected, while pale pulses follow the propagation paths. The map provides a conventional geographical layout for an illustrative network whose links and timing are constructed to clarify the phenomenon. It does not show observed attacks or estimate compromise probabilities.

References

Sheyner et al. — Automated Generation and Analysis of Attack Graphs, Carnegie Mellon University

NIST IR 7788 — Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs

Natural Earth cartography — public-domain data

Explore the model

The model loads when opened.

Drag or use the arrow keys to orient the model; + and − control zoom. Hold Ctrl or ⌘ to zoom with the wheel. Esc closes the dialog.

Topological Manifolds

Interface preferences

Sound remains optional and is controlled by the speaker in the header. Background music has its own player below.

Card entry, clicks and page changes use soft accents; scrolling stays silent.

Original soundtrack · 4:30

Descending Fields

0:00 / 4:30

Music starts when you press Play.

About the composition ↗
Topological Manifolds

Scientific formulas

Relations, assumptions and study references. These are not empirical results from the author’s research.

Research · Teaching · Exploration

Topological
Manifolds

Marzio De Corato

Follow the code, explore the forms. Choose how to enter.

Music and effects have separate volume controls.
topological-manifolds / terminal
Visual transition

Opening the laboratory

Opening the laboratory…

0%

Destination

Open now