Research
I work on adaptive security systems for observing attacker behavior. The agenda below groups ongoing threads by research question -- not by tool names -- so intent stays visible alongside artifacts.
Research themes
Adaptive deception systems
- Problem
- Attackers adapt quickly; fixed honeypots provide diminishing returns and weak experimental controls.
- Why it matters
- If deception surfaces can change with context, we can study how attackers probe, persist, and exfiltrate under different incentives.
- Current work
- ADLAH: multi-layer architecture, telemetry schema, and evaluation hooks described in the arXiv preprint and reference implementation.
Behavioral telemetry for attacker analysis
- Problem
- Raw logs are noisy; without structure, two deployments are not comparable and findings do not accumulate.
- Why it matters
- Comparable event streams are prerequisite for longitudinal studies and for ML that augments (not obscures) analyst judgment.
- Current work
- Standardizing what is captured at each honeynet layer and how sessions are segmented for downstream analysis.
Escalation logic in honeynet environments
- Problem
- Real attackers chain small edges; synthetic environments must expose believable escalation paths without unsafe blast radius.
- Why it matters
- Understanding escalation choices requires environments that are both tempting and contained.
- Current work
- Documenting escalation templates and safe containment boundaries used in lab deployments.
Vulnerability research and exploit understanding
- Problem
- Defense improves when root causes in parsers, kernels, and package ecosystems are explained with reproducible artifacts.
- Why it matters
- Patches need precise reasoning; the same reasoning informs detectors, fuzz targets, and secure design patterns.
- Current work
- Coordinated disclosures in pjproject, Linux Bluetooth L2CAP, and npm/simple-git; public writeups on this site.
Publications
Full bibliographic entries with abstracts and outbound links.
An Adaptive Multi-Layered Honeynet Architecture for Threat Behavior Analysis via Deep Learning
Johannes Moeller · arXiv, 2025 · Preprint
Proposes a layered honeynet architecture instrumented for structured telemetry, with deep learning used to summarize and compare attacker trajectories across deployments. Positions deception not as a static trap but as an adaptive observation surface whose configuration can be informed by measured behavior.
The Megayacht's Digital Achilles' Heel
Johannes Moeller · Zenodo, 2025 · Published
Examines how networked systems on large vessels expand attack surface for yards and operators, and argues for treating maritime cyber risk as a design and procurement constraint rather than an afterthought.