Research
Research Profile
My research sits at the intersection of Cyber Threat Intelligence, cybercrime ecosystems, security operations, and risk governance.
I hold a Ph.D. in Information Technology for Engineering from the University of Sannio (2026), where my doctoral work examined the longitudinal dynamics and structural resilience of the ransomware economy. Alongside cybercrime research, I work on attack surface analysis, SIEM detection engineering, vulnerability prioritization, NIS2 governance, and EU AI Act readiness.
Doctoral Dissertation
- Title: Ecosystem Dynamics and Structural Resilience of the Ransomware Economy: A Longitudinal, Multi-Method Analysis of the Observable Disclosure Surface (2020–2025)
- Degree: Ph.D. in Information Technology for Engineering, University of Sannio (2026)
- Supervisor: Prof. Corrado Aaron Visaggio (University of Foggia)
- Co-supervisor: Prof. Andrea Di Sorbo (University of Sannio)
My doctoral work treats ransomware as an adaptive criminal economy made up of core operators, affiliates, initial access brokers, infrastructure providers, extortion mechanisms, and Data Leak Sites (DLS). Using longitudinal datasets built from observable victim disclosures and technical indicators, the dissertation analyzes:
- Evolution of Ransomware-as-a-Service (RaaS) models and multilayer extortion.
- Group churn, rebranding, affiliate mobility, and ecosystem survival after disruption.
- Attack patterns, exploited vulnerabilities, and MITRE ATT&CK technique distributions across gangs.
- Statistical and machine-learning methods for threat actor profiling and behavioral clustering.
A core output of this work is published in Journal of Information Security and Applications (Elsevier, Vol. 95, Dec 2025): The ransomware blueprint: Attack patterns and strategic variations across gangs.
Research Areas
| Area | Focus |
|---|---|
| Cyber Threat Intelligence & Adversary Analysis | Threat actor profiling, MITRE ATT&CK mapping, IoC/IoA lifecycle, intelligence correlation |
| Ransomware & Cybercriminal Ecosystems | RaaS economics, extortion models, victim disclosures, actor churn and resilience |
| Dark Web & Exposure Intelligence | Data Leak Sites, infostealers, underground forums, OSINT/CLOSINT methodology |
| Security Operations & Detection | SIEM correlation (IBM QRadar), threat hunting, adversary simulation detection |
| Attack Surface & Vulnerability Management | External exposure mapping, CVSS/EPSS prioritization, remediation governance |
| Governance, Risk & Compliance | NIS2 implementation, ISO/IEC 27001, supplier risk, executive risk reporting |
| AI Governance | EU AI Act risk classification, AI DPIA, LLM security controls, third-party AI risk |
Cyber Threat Intelligence & Dark Web Monitoring
I study structured methods for collecting, normalizing, and validating intelligence across open and closed sources (OSINT/CLOSINT):
- Threat actor tracking and infrastructure mapping across surface and dark web sources.
- Monitoring of Data Leak Sites, cybercriminal forums, and credential markets (including infostealer logs).
- Lifecycle management of Indicators of Compromise (IoCs) and Indicators of Attack (IoAs) to reduce noise and false positives.
- Methodological, ethical, and legal boundaries in underground intelligence collection.
Attack Surface, Vulnerability & Detection Engineering
Technical findings are most useful when tied to defensive action and risk prioritization:
- External Attack Surface & Vulnerability Prioritization: Combining domain/IP/service enumeration with CVSS, EPSS, exploit availability, and business criticality to guide remediation.
- Malware & Adversary Tooling: Early work on Android malware analysis (CyberDroid) and detection of dual-use adversary tooling such as Cobalt Strike in IBM QRadar.
- Threat Intelligence Platforms (TIPs): Design of modular, microservice-based intelligence pipelines (including the Deepye and Dark Web Monitor university projects) to automate enrichment, correlation, and evidence tracking.
Governance, Risk & AI Compliance
On the enterprise side, my applied work translates technical threat signals into governance decisions:
- NIS2 & ISO/IEC 27001: Risk assessment frameworks, incident handling procedures, supply-chain security controls, and board-level reporting.
- AI Governance: Practical alignment with the EU AI Act, covering AI system inventories, risk classification, DPIAs for AI workflows, API/third-party model security, and enterprise guardrails for generative AI.
Teaching & Supervision
Academic research feeds directly into my courses and thesis co-supervision at the University of Sannio, the University of Rome Tor Vergata, the Free University of Bozen-Bolzano, and the University of Trento. See the Teaching page for details.