PhD Candidate — Software Engineering / Computer Engineering
Islamic Azad University, Tehran · Expected defense: 2027
Graph representation learning for software and network security —
malware, botnet C2, and metamorphic-code detection.
Email · Google Scholar · ORCID · LinkedIn · CV (PDF)
I study how structural representations of programs and network behaviour can be learned to detect adversarial software that defeats signature- and feature-based defenses. My work sits between graph machine learning and applied systems security: I build models on graph-native representations (call graphs, communication/flow graphs, semantic control-flow abstractions) and evaluate them under the conditions that actually break deployed detectors — topology shift, concept drift, and metamorphic transformation.
Three questions drive my current agenda:
- Representation. When does graph topology carry detection signal that flow- or content-level features do not, and when is fusion of the two strictly better than either?
- Generalization. Do detectors trained on one botnet topology or malware family transfer to unseen ones, or are reported gains an artifact of dataset-specific structure?
- Accountability. Can a detector's decision be reduced to a small, human-auditable set of flows or code regions that an analyst can act on?
I hold an integrity-first policy on empirical work: no reported number exists in my manuscripts or repositories that is not reproducible from the released code and public data.
Graph neural network over communication graphs that fuses network topology with flow-level edge features, extending topology-only baselines. Contributions: (a) an ablation isolating topology / features / fusion, (b) a cross-topology generalization matrix quantifying transfer across botnet structures, (c) GNNExplainer-based flow-level forensics that reduces a graph-level verdict to a ranked evidence set.
Datasets: Zhou et al. botnet graphs, CTU-13, IoT botnet corpora · Status: manuscript in preparation (Springer venue)
Hybrid convolutional encoder with gradient-boosted classification for algorithmically generated domains. The headline result is inference throughput (~2.8× over a CNN-SVM baseline at statistically indistinguishable accuracy), positioning the model for line-rate deployment rather than leaderboard accuracy. Includes 5-fold cross-validation, significance testing, per-family breakdown, and a 45-cell encoding ablation — the ablation refuted my own initial hypothesis, and the paper reports it. Status: under revision
Semantic abstraction of control flow that is invariant to metamorphic rewriting, deployed as a three-tier edge–fog–cloud detection pipeline where tier placement is driven by latency and privacy constraints rather than accuracy alone. Status: implementation complete, manuscript drafting
I am seeking a postdoctoral position (from 2027) in one of:
- Graph learning for security — program analysis, binary similarity, provenance graphs
- Robustness of learned detectors — adversarial evasion, concept drift, distribution shift
- Explainable and auditable ML for security operations
- Empirical software engineering for security-critical systems
I am equally interested in groups where the research must survive contact with production systems — I have spent 18 years shipping and operating software, and I can build the infrastructure a lab's experiments run on.
Reproducibility artifacts accompanying the work above. Each repository ships environment pinning, a single-command experiment runner, and the exact scripts that produce the tables in the corresponding manuscript.
| Repository | What it is | Stack |
|---|---|---|
p2p-botnet-gnn |
Graph construction (CTU-13, Zhou), fused GNN with topology/feature/fusion ablation switch, cross-topology evaluation matrix, GNNExplainer forensics | PyTorch, PyTorch Geometric |
dga-detection-bench |
CNN + gradient boosting pipeline, encoding ablation, k-fold CV, significance tests, throughput benchmarking harness | PyTorch, XGBoost, scikit-learn |
metamorphic-semantic-detect |
Semantic CFG abstraction and tiered edge–fog–cloud inference pipeline | Python, angr/LLVM tooling |
Eighteen years building and operating production software — relevant here because it is why my research runs end-to-end rather than in a notebook.
- Senior Full-Stack Engineer, Iranian Offshore Engineering & Construction Co. (IOEC), Tehran — financial, administrative, and organizational platforms in operational use across the enterprise.
- Prior remote engagements with teams in the US, UK, Canada, and Turkey.
- Systems designed and delivered: an RTL-first enterprise communication platform, an AI document-intelligence layer for EPC specification/datasheet compliance, a national-scale emergency dispatch design, and an agentic penetration-testing runtime with a human-approval gate.
Technical foundation: Python (PyTorch, PyTorch Geometric, scikit-learn) · TypeScript / Angular / Node.js · C# / .NET · Swift · PostgreSQL, SQL Server, MongoDB · Docker, CI/CD · distributed system design, API design, threat modeling.
- Teaching: TODO — courses, labs, or workshops taught; number of terms.
- Supervision: TODO — MSc/BSc theses co-supervised.
- Peer review: TODO — journals/conferences reviewed for.
- Talks: TODO — invited talks or seminars.
hossein.payami@iau.ac.ir — open to collaboration on graph learning for security, and to postdoc conversations for 2027 starts.