Nick Feamster

Intimate Partner Infiltration (IPI) refers to phone-side privacy infiltration in intimate or close relationships, often enabled by physical access to a person's smartphone and discussed in technology-facilitated Intimate Partner Violence (IPV) contexts. Unlike conventional cyberattackers, IPI perpetrators leverage proximity and personal knowledge to circumvent standard protection, underscoring the need for targeted interventions, motivating device-side tools that surface such risk evidence for later review. While prior works have extensively studied IPV, and some have provided tailored and effective solutions such as security clinics, they are necessarily episodic and human-expert-intensive, and offer limited automated visibility into what happens on a smartphone between support sessions. Guided by a formative interview with experts (n=5), we take the first exploration into gathering IPI-risk evidence from a mobile system perspective and present AID, A utomated I PI D etection, a data-driven system that continuously logs unauthorized access and suspicious behaviors on smartphones. In a controlled 27-participant study, AID achieves an end-to-end F1 score of 0.928 with a 7.0% false positive rate for Top-1 phone-side risk flagging; when preserving top-3 candidate action categories as report context, AID achieves an F1 score of 0.981 and a false positive rate of 1.6%. These findings demonstrate AID's potential as an evidence-support tool that complements current clinic-based interpretation and safety-planning.

Machine learning–based network intrusion detection systems (NIDS) monitor network traffic to identify malicious activity. While NIDS perform well in controlled environments, their effectiveness deteriorates in real-world deployments due to concept drift. As the underlying distribution evolves and new attacks emerge, benign traffic nevertheless remains dominant, so rare and emerging attacks are sparsely observed. This severe class imbalance makes it difficult to identify which data should be prioritized for model adaptation and often leads to high labeling cost, as identifying the few informative attacks requires extensive manual inspection. We present NetGuard, a generative active adaptation framework that enables robust and label-efficient adaptation of NIDS under dynamic network conditions. NetGuard combines density-aware active sampling to identify informative drifted traffic for annotation with deep generative modeling to synthesize diverse, minority-class samples with high-fidelity to expand coverage of rare attacks. By jointly selecting what to label and how to augment scarce data, NetGuard mitigates performance degradation caused by both distribution shift and long-tailed attack distributions. We carry out a comprehensive evaluation of NetGuard across intrusion detection datasets including a large-scale real-world ISP dataset. On average, NetGuard improves overall detection performance by 2×, while achieving 8–15× higher F1 and 4–7× lower false-negative rates for rare and emerging attacks compared to state-of-the-art sample selection baselines, using only 1% labeled data. NetGuard enhances rare attack detection while reducing labeling costs, rendering it scalable and practical for intrusion detection.

BACKGROUND Increasing physical activity, including exercise, for older adults (OAs) is an almost universally beneficial strategy for reducing frailty and improving management of multimorbidity, thereby preserving independence. However, homebound, frail, multimorbid OAs have very limited access to exercise programs in the U.S., and prior exercise intervention trials are frequently based on in-person classes / coaching and rarely involve care partners. Increasing exercise among multimorbid, frail, homebound [EC2.1]OAs requires testing innovative methods of intervention delivery. OBJECTIVE The EngAGE trial is a 6-month, double blind, randomized controlled, in-home trial powered to test the efficacy of the EngAGE program versus paper-based NIA Go4Life® exercises in multimorbid, frail, homebound African American OAs residing in the community along with their self-selected care partners (CPs). METHODS EngAGE is a custom, socially-motivated exercise program delivering NIA Go4Life® exercises to multimorbid, frail, homebound OAs and their CPs in the home. We co-designed EngAGE with end users using iterative participatory design. The program delivers daily exercise (resistance, balance and flexibility) routines to OAs over a voice-activated device with a screen. CPs can provide social reinforcement that is read aloud to the OA over the device to motivate adherence. OA-CP dyads were randomized to either the: 1) EngAGE program (EngAGE arm), or 2) the NIA “Workout to Go” Go4Life® exercise handout along with an out-of-the-box voice-activated device (paper arm). The primary outcome is change in the performance of five repeated chair stands from the Short Physical Performance Battery. Secondary study outcomes were selected to: (a) further assess individual-level factors that may contribute to exercise participation and response, (b) examine the OA-CP social factors that may impact exercise participation and response, and (c) assess technology-related factors. An intention-to-treat analysis principle will be applied to all outcomes. A two-part mixed model to compare chair stands over time will be used. The first part will model the probability of being able to perform chair stands by a random-effects logistic regression, and the second part will compare chair stands performance time among those who are able to perform the test by a linear mixed model. RESULTS Funding began in July 2021. Recruitment occurred from October 2022 to February 2025 (n = 69 OA and n = 68 care partner). Data collection concluded in April 2026. Data analysis and submission for publication are expected to conclude by summer 2026. CONCLUSIONS The EngAGE trial will be one of the first RCTs that tests the impact of mode of delivery on the efficacy of a health intervention for multimorbid, frail, homebound OAs. It is also among the first to include CPs as a target participant of an OA physical activity intervention. Trial findings will generate guidance for future randomized controlled trials with OAs at highest risk of disability. CLINICALTRIAL ClinicalTrials.gov NCT05337514; https://clinicaltrials.gov/study/NCT05337514

Traditional tools for verifying network configurations: (1) require high manual effort or lack semantic depth, and (2) lack interpretable, human-readable explanations to support diagnosis. Large Language Models (LLMs) present a promising alternative, but simple approaches like full-file, partition-based, or chain-of-thought prompting fail to handle the large, interconnected nature of configuration files. We introduce the Context-Aware Prompting (CAP) framework, which enables an LLM to reason about network configurations like a human expert. CAP first identifies all potentially relevant neighboring, similar, and referenced configuration segments. CAP then engages the LLM in a structured dialogue, where the model requests the specific context it needs before performing a focused analysis. This on-demand approach provides the necessary context for deep reasoning while avoiding overload. Our evaluation on production network configurations demonstrates that CAP reliably detects a wide range of known and previously unknown configuration errors. CAP outperforms existing LLM-based baselines, and achieves performance comparable to state-of-the-art non-LLM tools.

Despite extensive research measuring broadband quality, limited work has considered the interaction between residential Internet throughput and IP protocol. Public speed tests used to determine Internet quality do not, by and large, control for IP version; results, analysis, and recommendations are made using a hybrid of IPv4 and IPv6 data. Given the range of protocol designs, software stacks, and network infrastructure differences between the protocols, combined with the recent significant increase in IPv6 adoption, it is critical to understand what role the IP protocol plays in measuring Internet speeds. In this work, we systematically compare IPv4 and IPv6 speeds in residential access networks, examining differences in throughput experienced by households depending on IP version. Our findings demonstrate that IPv4 and IPv6 throughput differ in many instances and motivate a large-scale re-evaluation of our assumptions on IP version in future speed test analysis. Specifically, we find that IPv4 and IPv6 speeds differ in a significant number of cases, with up to 18.3% of our measurements differing by over 5%. Our findings indicate that substantial speed differences between IP versions can be driven by provider-specific factors such as speed tiers. Furthermore, we observe differences in IPv4 and IPv6 data depending on the speed-test software and testing infrastructure. Thus, this work guides future research about Internet speeds on how to consider and control for IP version.

Machine learning for network traffic analysis depends on labeled data, but the workflows used to construct training pipelines and evaluation datasets are often hard to reproduce. Labels are commonly stored outside the packet trace and attached later through dataset-specific reconstruction, thus the same raw traffic can yield different labeled datasets. We present pcapML, a system for constructing reproducible labeled network traffic datasets in PcapNG. pcapML stores label metadata inline with the packet trace so that the trace itself becomes the full dataset, rather than a packet file plus a separate reconstruction procedure. For new traffic, pcapML can assign labels during capture using eBPF-based process attribution in the Linux kernel. For existing datasets, it can ingest an explicit external label mapping and convert that mapping into the same packet-labeled format. We compare pcapML against conventional post-hoc labeling workflows and show that the differences are measurable even in controlled collection settings. The result is a common labeled trace format that makes dataset construction more reproducible and lets different studies build from an identical foundation.