White Papers
1. Immutable Execution Environment — A Minimal OS Modification to Permanently Stop Ransomware and Malware
The fundamental reason ransomware, malware, and the majority of cyberattacks succeed is that modern operating systems permit arbitrary code execution by default. Every reactive defense — antivirus, endpoint detection and response (EDR), behavioral heuristics, threat intelligence — exists to compensate for this single architectural flaw. This whitepaper proposes a different approach: eliminate the flaw itself.
The proposed architecture, called the Immutable Execution Environment (IEE), requires only three small, surgical modifications to an existing OS kernel — approximately 80 lines of new code — plus a short path-based whitelist of 15–25 directory entries. The result is a system where: only code in whitelisted directories can execute (including all scripts run by any interpreter); every whitelisted path is immutable and read-only (even root or Administrator cannot write to it during normal operation); critical data files can be whitelisted as permanently unencryptable; and system administration is restricted to a configurable Safe Mode whose network access — including complete TCP stack removal — is sealed in the system's trust anchor.
Because the defense is structural rather than knowledge-based, the IEE stops every ransomware strain — past, present, and future — without requiring any knowledge of what the threat is. Antivirus software is no longer needed, and its removal reduces attack surface further. Global ransomware damages reached an estimated $57 billion annually in 2025, a figure projected to grow to $275 billion by 2031 absent structural intervention. The IEE represents a viable, low-cost architectural path to ending this trajectory permanently.
Read full Wite Paper
2. Neutralizing Vulnerabilities Through Execution Prevention
The cybersecurity industry is locked in a perpetual arms race. Each year, tens of thousands of new software vulnerabilities are disclosed, and the pace is accelerating. In the first half of 2025 alone, over 21,500 Common Vulnerabilities and Exposures (CVEs) were cataloged — an 18% increase over the same period the prior year — with approximately 38% rated High or Critical in severity. Attackers now routinely weaponize newly disclosed CVEs within hours of publication, far outpacing the ability of most organizations to test and deploy patches. The traditional model of reactive security — discover, patch, monitor, respond — is failing under the sheer volume and velocity of modern threats.
This whitepaper presents a fundamentally different approach. It argues that the vast majority of cybersecurity vulnerabilities — including remote code execution (RCE), privilege escalation, buffer overflows, injection attacks, and malware delivery — share a common prerequisite: they require the execution of unauthorized code on the target system. Whether an attacker injects shellcode through a buffer overflow, delivers a ransomware binary via phishing, or exploits a deserialization flaw to instantiate a malicious object, the attack succeeds only when unauthorized executable code runs on the victim machine.
The architectural security model described herein, developed and patented by Daniel Chien across 16 U.S. patents, eliminates the conditions under which unauthorized code can execute. By combining three reinforcing architectural principles — the elimination of listening network ports, the prevention of unauthorized program execution, and strict outbound connection whitelisting — this model neutralizes entire classes of vulnerabilities at the architectural level rather than chasing individual exploits one by one.
This approach represents a paradigm shift from reactive patching to proactive architectural immunity. It does not depend on signature databases, heuristic detection, or the speed of patch deployment. Instead, it removes the foundational prerequisites that attackers depend upon to convert a software flaw into a successful compromise. In a landscape where AI is accelerating vulnerability discovery and exploit development, and where the volume of CVEs has long exceeded human capacity to remediate, architectural solutions that structurally eliminate attack surfaces are no longer optional — they are essential.
Read full Wite Paper
3. The Unhackable Endpoint
This whitepaper presents a rigorous technical analysis of Zero Attack Surface Architecture (ZASA) — a security model for internet-connected endpoint devices that achieves near-theoretical immunity to all known categories of remote attack by eliminating the structural preconditions on which those attacks depend, rather than attempting to detect or mitigate them after they are initiated.
The central argument is as follows: every known class of remote cyberattack against an endpoint requires at least one of four preconditions to be satisfied — (1) an inbound listening port or service reachable from the network, (2) a remote access interface (SSH, RDP, or VNC) that accepts inbound connections, (3) the ability of code to communicate outbound to attacker-controlled infrastructure, or (4) the ability to execute an attacker-supplied binary. A device from which all four preconditions have been systematically eliminated cannot be remotely compromised by any attack technique presently documented in the MITRE ATT&CK framework or the NIST National Vulnerability Database.
Read full Wite Paper
4. Buffer Overflow Attacks
Buffer overflow attacks represent one of the most studied and historically significant vulnerability classes in computer security. First systematically documented by Aleph One in 1996, these vulnerabilities exploit the absence of bounds checking in C/C++ programs to overwrite critical stack structures — most notably the saved return address — redirecting program execution to attacker-controlled code. While conceptually elegant, the practical exploitation of buffer overflows is subject to a constellation of technical constraints that textbook treatments routinely understate.
This white paper provides a rigorous technical analysis of buffer overflow mechanics, addressing the complete exploit chain: call stack structure, vulnerability mechanics, address discovery techniques, threading race conditions, and the virtual/physical memory distinction. Crucially, this paper also presents an honest assessment of practical limitations — including why private, closed-source applications are not trivially exploitable, why shared threaded memory creates genuine reliability problems for shellcode injection, and why the layered defense stack present on any modern operating system (ASLR, Stack Canaries, NX/DEP, PIE) renders classic techniques impractical without chaining multiple independently sophisticated attacks.
The paper concludes with a survey of post-classic exploitation techniques (return-to-libc, Return-Oriented Programming, heap exploitation, use-after-free) and corresponding modern defenses including Control Flow Integrity (CFI) and hardware shadow stacks.
Read full Wite Paper
5. Adaptive DDoS Defense Architecture
Threat Landscape Overview
Distributed Denial-of-Service (DDoS) attacks represent one of the most operationally disruptive and rapidly evolving threats facing Internet-connected organizations in 2025 and 2026. The attack surface has broadened considerably as adversaries leverage increasingly accessible tooling, commoditized botnet infrastructure, and AI-assisted automation to launch campaigns of unprecedented scale, sophistication, and duration.
Industry telemetry for 2025 paints a stark picture: total DDoS attack volume more than doubled year-over-year to approximately 47.1 million discrete events, with an average of 5,376 attacks automatically mitigated every hour across major scrubbing providers. Network-layer attacks — encompassing volumetric SYN floods, UDP amplification, and multi-vector campaigns — more than tripled in 2025 compared to 2024, with peak recorded attack volumes reaching 31.4 Terabits per second (Tbps). Simultaneously, malicious application-layer and API transaction volumes increased by 128%, confirming that the application tier has become a primary battleground alongside traditional volumetric vectors. Bad bot activity — a key enabler of low-and-slow and credential-stuffing attacks — surged 91.8%, driven in significant part by generative AI tooling that has substantially lowered the barrier to entry for threat actors.
Three primary attack categories now define the modern DDoS threat model:
-
Volumetric Attacks: These seek to saturate upstream bandwidth and overwhelm edge infrastructure through sheer packet volume. UDP amplification techniques exploiting DNS, NTP, and SSDP protocols remain prevalent, with amplification ratios enabling small botnet clusters to generate terabit-scale floods. Hyper-volumetric attacks exceeding 3 billion packets per second have been observed in active campaigns against global infrastructure providers.
-
Protocol-Layer Attacks: Targeting the TCP/IP stack directly, these attacks exploit the three-way handshake to exhaust connection state tables, half-open connection buffers, and kernel memory. TCP SYN flood attacks remain the most commonly observed protocol attack vector, often combined with volumetric components in multi-vector campaigns designed to defeat single-layer defenses.
-
Application-Layer Attacks: These are semantically valid requests that appear indistinguishable from legitimate traffic at the network layer, yet are designed to exhaust application resources — database connections, compute cycles, or thread pools. HTTP floods, Slowloris-style slow-read attacks, and database query floods fall within this category. Their sophistication makes them the hardest to mitigate without legitimate-user collateral impact.
Geopolitical factors continue to amplify the DDoS threat. Hacktivist campaigns tied to geopolitical conflict accounted for sustained, high-volume targeting throughout 2025, with European infrastructure bearing approximately 48.4% of all claimed attacks. State-sponsored actors have demonstrated capability to coordinate botnet infrastructure across multiple autonomous systems, defeating conventional single-provider scrubbing approaches. Technology, telecommunications, and financial services organizations have emerged as the most frequently targeted sectors, with the technology sector alone representing 45% of all observed network-layer DDoS attacks globally.
Read full Wite Paper
6. Dual-Clock Time-Derived Cryptographic System
We present the Dual-Clock Time-Derived Cryptographic System (DC-TDCS), a novel authenticated encryption framework in which all session key material is derived from a consensus value computed across two independent, heterogeneous time sources: a device-resident hardware real-time clock (Clock A) and a server-authoritative network timestamp (Clock B). Unlike time-based one-time password schemes, which use temporal state solely for user authentication codes, DC-TDCS extends time-binding to the full cryptographic key schedule. Session keys are computed via HKDF (RFC 5869) over the consensus time value, a shared long-term seed, an epoch counter, and a method-type index drawn from a pre-negotiated method array — introducing a second, independently secret dimension into every key derivation event.
The system provides three headline security properties. First, forward secrecy: session keys are erased at each epoch boundary, and past keys are irrecoverable from current state. Second, stolen-device resistance: without access to the server's clock authority, a physically stolen device cannot generate valid consensus time values or pass server-side epoch verification. Third, clock-manipulation resistance: forging or rolling back either clock alone is detectable via the disagreement between the two independent sources, which suspends the session and triggers re-synchronization.
We describe the full protocol design, dual-clock consensus function, method-array construction, stolen-device behavior, and a security analysis covering indistinguishability under chosen-ciphertext attack (IND-CCA2), forward secrecy, and resistance to clock-manipulation adversaries. We compare DC-TDCS to static PKI, TOTP/HOTP, TLS session tickets, and the Signal Protocol double ratchet, and outline a path toward formal verification using ProVerif.
Read full Wite Paper
7. Private-Keyless Passwordless Time-Based Authentication
This paper presents a novel authentication protocol that eliminates both passwords and private cryptographic keys from the authentication flow entirely. The scheme — designated Private-Keyless, Passwordless, Time-Based Authentication (PKTBA) — leverages precisely synchronized wall-clock time, obtained via hardened Network Time Protocol (NTP) infrastructure, as a coordinating ephemeral reference shared between client and server. Authentication tokens are derived deterministically from the current UTC time window, the user's identity, and an active method selected from a rotating server-defined array. Because both parties observe the same time window and apply the same public derivation function, no secret value ever needs to be exchanged, stored, or transmitted.
PKTBA is contrasted against TOTP (RFC 6238), FIDO2/WebAuthn passkeys, and magic-link systems. Unlike TOTP, PKTBA requires no per-user seed on either client or server. Unlike FIDO2, no private key material is ever stored on a device. The core security properties of the protocol include: an analog of forward secrecy (no persistent secret exists to steal), strict time-bounded token validity, stolen-device resistance, and cryptographic replay attack immunity via a per-user consumed-token ledger. The protocol's sole trust anchor is a hardened NTP layer secured using Network Time Security (NTS, RFC 8915), which is analyzed extensively. Threat modeling follows the STRIDE framework, and a reference implementation sketch is provided for protocol engineers.
Read full Wite Paper
8. The Bottom-Most Received Header — Deterministic Sender Verification via Unforgeable SMTP Network Metadata
Every email message that traverses the public internet carries a chain of Received headers — trace fields prepended by each Mail Transfer Agent (MTA) that handles the message in transit. Among these, the bottom-most Received header occupies a uniquely privileged position: it is inserted by the first server outside the sender's control — the first receiving MTA at the boundary of the recipient's network — and it records the TCP source IP address of the connection it accepted. This IP address is an OS-level network observation, not a protocol field the sending client can populate, override, or suppress. It is, accordingly, the single most forgery-resistant piece of metadata available in an email message, requiring no cryptographic infrastructure and no cooperation from the sending domain.
Policy-based authentication frameworks — Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC) — represent meaningful advances in email security but are fundamentally contingent on correct deployment by the sending domain. As of Q2 2025, 61.9% of the top ten million domains publish no SPF record, 81.6% lack any DMARC record, and of those with DMARC, more than half enforce no policy whatsoever. These frameworks can be misconfigured, absent, bypassed via forwarding, or circumvented through documented protocol-level attacks such as SMTP Smuggling (CVE-2023-51764). The bottom-most Received header requires none of this cooperation: it is a structural property of TCP/IP that defending infrastructure can exploit unilaterally. This paper describes the mechanism, its evidentiary value, its limitations, and how email administrators, security operations teams, and vendors should integrate it into layered defenses.
Read full Wite Paper
9. Tracing Robocallers via SIP Metadata and IP Analysis
Voice over Internet Protocol (VoIP) robocall fraud has become one of the most pervasive forms of consumer crime in the United States, with Americans receiving 52.8 billion robocalls in 2024 alone — averaging 1,627 calls per second. Fraudsters exploit a fundamental weakness in telephone infrastructure: the Caller ID system, which relies on the easily-spoofed SIP From header to display an arbitrary phone number to the recipient, regardless of the actual call origin.
What fraudsters cannot hide, however, is the network-layer truth: every SIP-based call carries the originating IP address in its Via and Contact headers, as mandated by RFC 3261. This IP address — unlike the displayed phone number — reflects the actual source of the call and is structurally resistant to falsification without control of BGP routing infrastructure. When combined with GeoIP geolocation, WHOIS/ASN ownership lookup, and IP reputation intelligence, this IP data enables attribution of fraudulent callers to their true network source with high confidence.
This whitepaper documents a disproportionate and urgent targeting of Asian-American and diaspora communities — particularly Chinese-, Vietnamese-, Korean-, and South Asian-language speakers — by organized robocall fraud operations. In November 2025, the FBI issued PSA I-111325-PSA warning specifically of schemes where criminals impersonate both U.S. health insurers and Chinese law enforcement (公安), threatening victims with extradition and demanding payment under 24-hour video surveillance. These campaigns exploit cultural deference to authority, language isolation, and unfamiliarity with U.S. legal norms.
The STIR/SHAKEN cryptographic call authentication framework, mandated for U.S. carriers since 2021, represents important progress but remains severely limited by incomplete international adoption, TDM network gaps, and the exploitability of Gateway-level (C) attestation. Effective defense requires a multi-layer approach.
This whitepaper presents: (1) a forensic framework for SIP header and IP metadata analysis; (2) a composite IP-based caller risk-scoring model with weighted factors spanning GeoIP, ASN reputation, STIR/SHAKEN attestation, and behavioral patterns; and (3) a proposed smartphone display standard that surfaces IP-layer caller identity — including origin country, network owner, and risk badge — to end users in their preferred language, providing an accessible protection layer for communities most at risk.
Action is required from telecom carriers, smartphone platform developers (Apple iOS, Google Android), regulators, and law enforcement. The technical foundation exists today. What is lacking is coordinated implementation.
Read full Wite Paper