Alexandros Kapravelos
North Carolina State University, NC·Computer Science·Early-career
The web and the software supply chain behind it change faster than the tools built to secure them. Browsers gain new capabilities every release, websites exploit them in ways their users never see, and the automated scripts that build and ship software run with enough privilege to compromise everything downstream when misconfigured.
- Fields
Computer Science
Engineering
- Topics
web security
browser fingerprinting
stateless tracking
- Grants
- 3 known grants, through Jun 2027
What they work on
- Define the security properties that continuous integration workflows should satisfy and design a Workflow Intermediate Representation, a common format that workflows from any CI platform can be translated into for uniform analysis.
- Build a Workflow Analysis Framework that verifies workflow security properties through static analysis, which inspects code without running it, and dynamic analysis, which observes execution, over workflows encoded in the intermediate representation.
- Design the Workflow Specification Language, a platform-independent domain-specific language for expressing workflows and their security properties, informed by developer studies, plus a bidirectional compiler to and from platform-specific formats.
- Build browser instrumentation that records which web APIs a page calls, and use machine learning over these usage signatures to detect browser fingerprinting and quantify the privacy risk of individual APIs.
- Develop fine-grained countermeasures that infer the intent behind web API usage and apply mitigation only when needed, minimizing breakage of legitimate site functionality, with explainable machine learning decisions.
- Create a monitoring platform that records in detail how modern browsers interact with pages during real user visits, build abstract behavioral models of web applications from these traces, and use them to identify emerging web threats.
More about the research
Research here builds measurement and analysis infrastructure for these moving targets: platforms that watch what code actually does rather than what it claims to do, and methods for specifying and checking security properties that hold across many different platforms.
Why it matters
Supply-chain attacks through misconfigured build pipelines can compromise software used by millions, and the proposed intermediate representation and specification language could let developers state and automatically verify security requirements regardless of which CI platform they use. On the privacy side, better detection of fingerprinting and finer-grained defenses could be adopted in mainstream and privacy-focused browsers, protecting users from covert tracking without breaking the sites they visit.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Xing Gao
University of Delaware, DE·Computer Science·Early-career
Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
Junfeng Yang
Columbia University, NY·Computer Science
Detect model spoofing, where attackers upload malicious AI models under deceptive names, by developing anomaly detection based on naming conventions and model architectural signatures.
The school
North Carolina State University: 40 labs on PI Pages, $717M a year on research, 603 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.