A small open research practice in cybersecurity, generative AI, network discovery, cryptography, and public-sector technology.

The descriptive layer — what actually exists on the network? Build an asset inventory from ARP, mDNS, SSDP, SNMP and a TCP pilot, then reason about the three things that make an inventory trustworthy: vantage point, existence vs. identity, and completeness vs. soundness — measured against a known ground-truth network.

The diagnostic layer — what are these devices? Fingerprint each host through a cascade of independent evidence (OUI → banner → realm → RTSP), build a CPE, and score confidence with an honest ceiling. Four self-service tools and a difficulty-graded detective game with adversarial flips.

A teaching simulator for Chapter 3 — Vulnerability Assessment, Correlation & Prioritization. Turn a scan into prioritized findings: NVD/CVE association, CVSS decomposition, multi-protocol default-credential probing, KEV + EPSS overlays, and an evidence ledger — all behind an ROE / RBAC safety boundary. Same network and CVEs as the official Lab 3.

Why the lower-CVSS device is often the bigger risk. Build the attack graph, find the cheapest attacker paths (Yen's k-shortest), and score devices in context with the Breakwater Risk Score and a live SHAP-style attribution — then map findings to MITRE ATT&CK ICS and export a STIX 2.1 bundle.

Demonstration only. Synthetic network, real CVE / ATT&CK data. © Dr. Mallarapu / GWU.

The prescriptive layer — which offensive tests should we actually run, and are they safe? Turn Lab 4's attack paths into a ranked, ROE-bounded validation plan: what to test, in what order, and where the rules of engagement say stop. Interactive demo in progress.

Test every fix against a digital twin before production — catch cascading failures, schedule patch waves, and prove zero-disruption against a strengthened definition. Then the real question: is the twin even trustworthy? The showpiece is a live KL / Jensen-Shannon drift lab with a Trust / Resync / Rebuild / Block verdict.

Demonstration only. Synthetic twin, real divergence math. © Dr. Mallarapu / GWU.

A RayveLabs original that picks up where Chapter 6 stops. Distributional drift (KL/JS) is blind to the targeted changes that actually invalidate a remediation — so this adds a structural drift detector (typed graph-edit distance + a path predicate) that catches 8/8 where KL/JS catch 2/8, plus a value-of-information rule that turns the authority checklist into a real Act / Resync / Block decision.

An interactive network-security walkthrough. Three labs and a self-service toolkit in one place. Scan your network lab teaches discovery — vantage point, existence vs. identity, completeness vs. soundness — with a simulation against a known ground-truth network. Cascade Lab teaches device fingerprinting through four self-service tools and a difficulty-graded detective game. Web Log Lab teaches privacy-preserving request fingerprinting from raw Apache, Nginx, or Bro/Zeek access logs. Everything runs client-side.

A public portal where anyone can actually use the open cybersecurity data — no sign-up, no API keys, no install. Paste an IP, domain, URL, hash, or CVE and the atlas checks 11 free feeds at once (URLhaus, ThreatFox, Feodo, SSLBL, Spamhaus, Tor, DShield, DataPlane, KEV, EPSS, HIBP) and stitches the answer together. Plus a CVE explorer that joins KEV + EPSS + ATT&CK in one view, and an interactive map of how the open security databases connect to each other. Daily-refreshed via GitHub Actions cron.

Companion open-data registry with 41 catalogued datasets, citations, and one-click curl commands.