Skip to content
ComputingAmerica

Engineering practice

What the people building it actually know.

Case studies show outcomes. This page shows the workings: the systems our engineers built to the metal, the research they published, and the limits of each one stated alongside it.

The systems on this page are reference implementations, published research and prior engagements built by the engineers who founded this firm, most of them before the firm existed. They are not client deliverables and we do not present them as such. They are here because a buyer choosing a software firm is choosing a bench of engineers, and a service page cannot tell you anything useful about one.

Systems built to the metal
3Systems built to the metalICS detector, ML pipeline, Research harness
Papers published and presented
5Papers published and presentedIncluding an IEEE publication on industrial anomaly detection
National laboratory briefings
2National laboratory briefingsFindings reviewed by researchers at Idaho National Lab and Los Alamos

Depth, and what it is for

Eight disciplines, each earning its place in commercial work.

Nobody hires us to build a compiler. They hire us to build the systems that turn out to be compilers with the name filed off, and the difference between an engineer who has seen that shape before and one who has not is most of the schedule.

  • Distributed state

    Consensus, replication, partition ownership and the reconfiguration problems that only appear when the topology changes underneath live traffic.

    Where it shows upDual-running a legacy system against its replacement, moving a tenant between shards without a maintenance window, and making a retried request from a bad connection safe to apply.

  • Compilers and language tooling

    Intermediate representations, dataflow analysis, and the discipline of choosing a model that makes every later stage cheap rather than merely correct.

    Where it shows upPricing engines, versioned rule sets a business user can edit, eligibility logic that has to explain its own output, and translation layers between two domains that must not leak into each other.

  • Operational technology security

    Industrial protocol traffic, anomaly detection on deterministic networks, and peer-reviewed research on why enterprise tooling does not transfer.

    Where it shows upPlant-floor and utility engagements crossing the OT/IT boundary, and judging whether a vendor’s monitoring claim is plausible for an industrial network.

  • Vulnerability research

    Attack-surface modelling, source review and variant analysis carried out against live third-party systems under public disclosure programs, where a claim is worth nothing until it reproduces.

    Where it shows upPenetration tests where the deliverable has to survive the client’s own engineers reading it, judging whether a reported vulnerability actually applies to your deployment, and knowing which classes of finding a scanner will never reach.

  • Applied machine learning

    End-to-end pipelines where the modelling is the last and smallest step, built around evaluation sets, honest baselines and calibrated confidence.

    Where it shows upDocument extraction with a human on the uncertain cases, classification with a defensible accuracy figure, and telling a client when a rules engine wins.

  • Embedded and hardware interfaces

    The full path from register-transfer logic through a bus interface and a kernel driver to a user-space program, with each layer brought up and verified in order.

    Where it shows upReading programmable controllers, serial and fieldbus integrations, and diagnosing a gateway that drops packets under load instead of escalating it to a vendor.

  • Concurrency

    Synchronization primitives implemented from the ground up, in both a forgiving runtime and an unforgiving one, until the higher-level tools stop being magic.

    Where it shows upJobs that ran twice, queues that stall weekly under load, and integrations that duplicate a record when the network is slow.

  • Geometry and optimization

    Computational geometry and graph search written from primitives, with benchmarking that regularly contradicts what the asymptotics suggested.

    Where it shows upRouting, scheduling and allocation problems where the objective everyone states is not the objective the operator actually holds.

Reference implementations

Built to the metal, limits included.

Each of these was built end to end rather than assembled from libraries, because the point was to understand the pipeline rather than to consume it. Every entry states what it does not do, which is the part that makes the rest worth reading.

  • Fuzzy-hash anomaly detection for industrial networks

    A rolling baseline of similarity hashes computed over clusters of industrial protocol traffic, scored against a sliding window to surface conversations that drift out of pattern.

    Why it earns its keepPublished, peer-reviewed evidence that we understand why enterprise detection tooling does not transfer to plant-floor networks.

    What it is notA primary indicator, not a verdict. It says something is off, not what, and belongs in front of a second-stage validator and a human.

    • Python
    • TLSH
    • Modbus
    • Packet clustering
    • Sliding window
    Read the write-up
    Published
    IEEE CARS 2024
    Hash
    TLSH, after three evaluated
    Unit
    Packet clusters, not packets
    Evaluated on
    CIC Modbus 2023, ICS_PCAPS
    detector/score.pyPython
    def score(cluster: list[Packet], window: Deque[str]) -> float | None:    """Score a conversation against the rolling baseline, not a packet    against a rule. Plant floors are periodic; the rule never fires."""    h = tlsh.hash(b"".join(p.payload for p in cluster))    if h is None:        return None          # under 50 bytes of entropy: no opinion offered    return min(tlsh.diff(h, prior) for prior in window) / DIFF_CEILING
    A detector that is allowed to return nothing is worth more on an industrial network than one that always produces a number, because a confident score on 12 bytes of Modbus is noise wearing a threshold.

  • Seven-stage network anomaly pipeline

    Raw capture to live detector: flow-level feature extraction, outlier treatment and class balancing, feature selection by ensemble vote across four methods, four classical models plus a convolutional network, and a real-time scorer with an alert threshold.

    Why it earns its keepThat we scope machine learning around the data engineering rather than the modelling, and that we will report the boring model winning when it wins.

    What it is notBuilt on public and donated captures. The pipeline generalizes; the trained classifier does not, and would need re-fitting per environment.

    • Python
    • scapy
    • XGBoost
    • scikit-learn
    • SMOTE
    • PyTorch
    Read the write-up

    Run it yourself

    Stages
    7, independently replayable
    Winner
    Gradient-boosted trees
    Largest single gain
    Outlier clipping, not tuning
    Live inference
    Sub-millisecond per flow
    stage 4/7: feature selection, ensemble votepipeline output
    feature               MI   chi2   RFE    L1   votesflow_iat_std           *      *     *     *      4fwd_pkt_len_max        *      *     *     .      3init_win_bytes_fwd     *      .     *     *      3bwd_pkt_len_mean       .      *     .     *      2   dropped--stage 6/7  gradient-boosted trees   F1 0.981stage 6/7  1D convolutional net     F1 0.974
    The convolutional network lost, and the largest single gain in the whole pipeline came from clipping outliers in stage 2 rather than from anything in stage 6. We report that because a client who is told the impressive model won learns nothing about where to spend the next dollar.

  • A scope-gated vulnerability research harness

    A recon and triage system run against public disclosure programs: a runner that refuses to emit a packet until an authorization document names the host, around 150 single-purpose probes for authorization matrices, object references, request smuggling, deserialization and source-map exposure, and a validator that refuses a draft which is structurally incomplete, still carries a template stub, or offers a proof section with no captured request behind it.

    Why it earns its keepThat we can tell a finding from a rumour at volume. The scarce skill in security work is not discovering candidates, it is discarding the ones that do not survive contact with the target’s actual threat model, and doing it before a client reads them.

    What it is notIt produces leads, not findings. Every lead is reproduced by hand before it goes anywhere, nothing is ever submitted automatically, and the disclosure record behind it is modest: most of what it surfaced was low severity, already known, or ruled out on the threat model. That is the honest shape of the work, and the ruling-out is the part that transfers to a paid engagement.

    • Python
    • Burp/Caido
    • Semgrep
    • nuclei
    • Static analysis
    • Coordinated disclosure
    Read the write-up
    Ruled out
    253 takeover candidates, 0 real
    Gate
    No scope document, no traffic
    Probes
    ~150, each single-purpose
    Programs worked
    40+, all authorized
    tools/scope_guard.pyPython
    def decide(self, url_or_host: str) -> ScopeDecision:    host = extract_host(url_or_host)     # Fail closed: no positive scope source means nothing is in scope.    if not self.has_positive_scope():        return ScopeDecision(False, host, "no in-scope definition loaded")     # Deny always wins.    for entry in self.out_rules:        if _directive_matches(host, entry):            return ScopeDecision(False, host, f"matched out: {entry}")
    The default answer is no. Every request the harness makes is routed through this, and with no authorization document loaded it refuses everything rather than everything it was not told to avoid. That is the same order the rules of engagement are written in on a paid test: what is permitted is enumerated, and silence means stop.

Published and briefed

Work that survived review by people with no reason to be kind.

Peer review is a weak signal about commercial delivery and a strong one about whether a technical claim holds. We put ours through it.

  1. IEEE CARS · GCRI

    Anomaly detection in ICS networks with fuzzy hashing

    Similarity-preserving hashes applied to control-network traffic, validated on a multi-vendor PLC bench.

  2. RST CON

    Securing interconnected IT and OT systems

    Exploitation and defense of programmable logic controllers across the enterprise boundary.

  3. ERAU · NASA · NSF Aero-Cyber

    Anomaly detection for satellite hardware tampering

    Hardware-level tamper indicators on systems that cannot be physically inspected after deployment.

  4. NSF INSuRE+E

    SCADA security in interconnected IT and OT environments

    Denial of service, man in the middle and packet manipulation against ladder-logic-driven PLCs.

  5. Los Alamos · Idaho National Laboratory

    Presented operational technology research

    Findings reviewed by laboratory researchers, which is a harder audience than an internal report gets.

  6. In review

    Automated code vulnerability detection using synthetic training data

    Plus reverse engineering of FPGA bitstreams, and applied vision and audio detection research.

Credentials on the bench

  • CompTIA Security+
  • CompTIA PenTest+
  • GIAC GFACT
  • Red Hat RH124
  • CISA ICS 301V / 100W
  • TEEX DHS-certified

Each of these is verifiable through its issuing body, and the detail behind them is on the about page.

The write-ups

Each one walked through in full.

Long, specific and occasionally unflattering. Where something did not work, or where a simpler approach beat the impressive one, that is in there too.

Next step

Want to test any of this?

Bring an engineer to the first call and point them at whichever of these is closest to your problem. We would rather be interrogated early than trusted on a brochure.

Bring your engineer to a callSee how we work