This master's capstone project studies hypervisors from three connected angles: hypervisors used as security mechanisms, the security of hypervisors themselves, and the risks introduced by insecure hypervisor designs or deployments. The project aims to build a systematic knowledge base that clarifies threat models, isolation assumptions, vulnerability classes, measurement methods, and open research problems across commodity, cloud, embedded, and security-oriented virtualization systems.

This master's engineering project builds a recursive self-improvement workflow for proof-of-concept generation. Based on Magma, ground-truth bug benchmarks, and a workflow DSL, the project designs and evaluates an agentic pipeline that can generate POCs, execute them against known vulnerable targets, diagnose failures, revise its workflow, and accumulate reusable strategies over time. The goal is to turn benchmark-backed POC generation into a measurable engineering loop for studying how LLM-based security agents improve through execution feedback.

This PhD research project studies defense-in-depth architectures for process-based and VM-based sandboxes. The project investigates how sandbox escapes and policy bypasses emerge across system-call interfaces, shared resources, runtime services, and hardware boundaries, then develops layered defenses that combine behavioral monitoring at security-relevant interfaces, exploit prevention, and compartmentalization. It further explores techniques such as pattern matching, hardware-assisted enforcement, and hardware-software co-design to make sandboxed execution more resilient against both known attack patterns and previously unseen exploitation strategies.