BZPEERReading, trust and collaboration for research
Menu

Discover

GraphFollow connections around a paper, topic or saved view.

Workspaces

HomePick up where your research flow left off.InboxHandle requests, replies and notifications from one place.CollectionsCurate reading lists, evidence sets and shareable dossiers.ResearchSee your private provenance graph, trail and imports.CollaborationMove from discovery into focused discussion rooms.PublishDraft, preview and publish full-text research articles.

Network

ExpertsFind specialists worth following or asking for help.CommunitiesJoin research circles organized around shared work.PartnersSee external organizations active around the same topics.

Opportunities

ListingsBrowse roles, calls and collaborations with clearer fit signals.

Account

Log inReturn to your reading and collaboration workspace.Create accountStart saving work, following people and joining teams.
Log inCreate account

Researcher profile

Gabi Dreo Rodosek

Gabi Dreo Rodosek contributes to research discovery and scholarly infrastructure.

ResearcherAffiliation not importedOpen to collaborate
Distributed, Parallel, and Cluster ComputingNetworking and Internet ArchitectureCryptography and SecurityArtificial IntelligenceComputation and LanguageComputational Complexityeess.SYMultiagent SystemsSystems and Controlcs.CYeess.SPInformation RetrievalInformation TheoryMachine Learningmath.ITphysics.soc-ph

Trust snapshot

Quick read

Trust 21 - EmergingVerification L1Unclaimed author
12works
0followers
16topics
4close collaborators

Actions

Decide how to stay connected

Follow researcher0

Identity and collaboration

How to connect with this researcher

Claiming links this public author record to a researcher profile and unlocks direct collaboration workflows.

Log in to claim

Direct collaboration

Open a focused conversation when the fit is right

Claim this author entity first to unlock direct invitations.

Research graph

See the researcher in context

Open full explorer

Inspect adjacent work, topics, institutions and collaborators without jumping out to a separate graph page.

Building this graph slice

BZPEER is loading the nearby papers, people, topics and institutions for this page.

Published work

12 published item(s)

preprint2026arXiv

GRASP -- Graph-Based Anomaly Detection Through Self-Supervised Classification

Advanced persistent threat (APT) attacks remain difficult to detect due to their stealth, adaptability, and use of legitimate system components. Provenance-based intrusion detection systems (PIDS) offer a promising defense by capturing detailed relationships between system components and actions. However, current PIDS rely on predefined or subset-determined thresholds, which limit detection stability and the ability to detect any anomalous behavior in general. Furthermore, related work often neglects the role of process executables, which describe system activity by interacting through a process with files, network components, and other processes. We introduce GRASP, a PIDS based on masked self-supervised classification. GRASP masks the executable information of processes and learns to infer it from their two-hop provenance graph neighborhood, marking misclassified processes as anomalies. It captures behavior patterns for the learned executables without thresholding, making it robust against interference and unknown activities. Evaluations on the DARPA TC and OpTC datasets demonstrate that GRASP consistently detects anomalous behavior, including known attack-related activities, outperforming existing systems. Our PIDS identifies all documented attacks on datasets where the behavior of executables is learnable. In addition, compared to existing systems, GRASP uncovers potentially malicious anomalous behavior not labeled as an attack in the documentation.

0 citations0 reviewsNo code linkedOpen access
preprint2026arXiv

Ideology Prediction of German Political Texts

Elections represent a crucial milestone in a nation's ongoing development. To better understand the political rhetoric from various movements, ranging from left to right, we propose a transformer-based model capable of projecting the political orientation of a text on a continuous left-to-right spectrum, represented by a normalized scalar d between -1 and 1. This approach enables analysts to focus on specific segments of the political landscape, such as conservatives, while excluding liberal and far-right movements. Such a task can only be achieved with multiclass classifiers, provided that the desired orientation is incorporated within one of their predefined classes. To determine the most suitable foundation model among 13 candidate transformers for this task, we constructed four distinct corpora. One corpus comprised annotated plenary notes from the German Bundestag, while another was based on an official online decision-making tool, Wahl-O-Mat. The third corpus consisted of articles from 33 newspapers, each identified by its political orientation, and the fourth included 535,200 tweets from 597 members of the 20th and 21st German Bundestag. To mitigate overfitting, we used two distinct corpora for training and two for testing, respectively. For in-domain performance, DeBERTa-large achieved the highest F1 score F1=0.844 as well as for the X (Twitter) out-of-domain test ACC=0.864. Regarding the newspaper out-of-domain test, Gemma2-2B excelled (MAE = 0.172). This study demonstrates that transformer models can recognize political framing in German news at the level of public opinion polls. Our findings suggest that both the model architecture and the availability of domain-specific training data can be as influential as model size for estimating political bias. We discuss methodological limitations and outline directions for improving the robustness of bias measurement.

0 citations0 reviewsNo code linkedOpen access
preprint2026arXiv

LLM-based Detection of Manipulative Political Narratives

We present a new computational framework for detecting and structuring manipulative political narratives. A task that became more important due to the shift of political discussions to social media. One of the primary challenges thereby is differentiating between manipulative political narratives and legitimate critiques. Some posts may also reframe actual events within a manipulative context. To achieve good clustering results, we filter manipulative posts beforehand using a detailed few-shot prompt that combines documented campaign narratives with legitimate criticisms to differentiate them. This prompt enables a reasoning model to assign labels, retaining only manipulative narrative posts for further processing. The remaining posts are subsequently embedded and dimensionality-reduced using UMAP, before HDBSCAN is applied to uncover narrative groups. A key advantage of this unsupervised approach is its independence from a predefined list of target categories, enabling it to uncover new narrative clusters. Finally, a reasoning model is employed to uncover the narrative behind each cluster. This approach, applied to over 1.2 million social media posts, effectively identified 41 distinct manipulative narrative clusters by integrating prompt-based filtering with unsupervised clustering.

0 citations0 reviewsNo code linkedOpen access
preprint2022arXiv

Realizable Universal Adversarial Perturbations for Malware

Machine learning classifiers are vulnerable to adversarial examples -- input-specific perturbations that manipulate models' output. Universal Adversarial Perturbations (UAPs), which identify noisy patterns that generalize across the input space, allow the attacker to greatly scale up the generation of such examples. Although UAPs have been explored in application domains beyond computer vision, little is known about their properties and implications in the specific context of realizable attacks, such as malware, where attackers must satisfy challenging problem-space constraints. In this paper we explore the challenges and strengths of UAPs in the context of malware classification. We generate sequences of problem-space transformations that induce UAPs in the corresponding feature-space embedding and evaluate their effectiveness across different malware domains. Additionally, we propose adversarial training-based mitigations using knowledge derived from the problem-space transformations, and compare against alternative feature-space defenses. Our experiments limit the effectiveness of a white box Android evasion attack to ~20% at the cost of ~3% TPR at 1% FPR. We additionally show how our method can be adapted to more restrictive domains such as Windows malware. We observe that while adversarial training in the feature space must deal with large and often unconstrained regions, UAPs in the problem space identify specific vulnerabilities that allow us to harden a classifier more effectively, shifting the challenges and associated cost of identifying new universal adversarial transformations back to the attacker.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

A Novel Approach to Solve K-Center Problems with Geographical Placement

The facility location problem is a well-known challenge in logistics that is proven to be NP-hard. In this paper we specifically simulate the geographical placement of facilities to provide adequate service to customers. Determining reasonable center locations is an important challenge for a management since it directly effects future service costs. Generally, the objective is to place the central nodes such that all customers have convenient access to them. We analyze the problem and compare different placement strategies and evaluate the number of required centers. We use several existing approaches and propose a new heuristic for the problem. For our experiments we consider various scenarios and employ simulation to evaluate the performance of the optimization algorithms. Our new optimization approach shows a significant improvement. The presented results are generally applicable to many domains, e.g., the placement of military bases, the planning of content delivery networks, or the placement of warehouses.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

A Novel Multi-Agent System for Complex Scheduling Problems

Complex scheduling problems require a large amount computation power and innovative solution methods. The objective of this paper is the conception and implementation of a multi-agent system that is applicable in various problem domains. Independent specialized agents handle small tasks, to reach a superordinate target. Effective coordination is therefore required to achieve productive cooperation. Role models and distributed artificial intelligence are employed to tackle the resulting challenges. We simulate a NP-hard scheduling problem to demonstrate the validity of our approach. In addition to the general agent based framework we propose new simulation-based optimization heuristics to given scheduling problems. Two of the described optimization algorithms are implemented using agents. This paper highlights the advantages of the agent-based approach, like the reduction in layout complexity, improved control of complicated systems, and extendability.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Dragoon: Advanced Modelling of IP Geolocation by use of Latency Measurements

IP Geolocation is a key enabler for many areas of application like determination of an attack origin, targeted advertisement, and Content Delivery Networks. Although IP Geolocation is an ongoing field of research for over one decade, it is still a challenging task, whereas good results are only achieved by the use of active latency measurements. Nevertheless, an increased accuracy is needed to improve service quality. This paper presents an novel approach to find optimized Landmark positions which are used for active probing. Since a reasonable Landmark selection is important for a highly accurate localization service, the goal is to find Landmarks close to the target with respect to the infrastructure and hop count. Furthermore, we introduce a new approach of an adaptable and more accurate mathematical modelling of an improved geographical location estimation process. Current techniques provide less information about solving the Landmark problem as well as are using imprecise models. We demonstrate the usability of our approach in a real-world environment and analyse Geolocation for the first time in Europe. The combination of an optimized Landmark selection and advanced modulation results in an improved accuracy of IP Geolocation.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Modeling the Location Selection of Mirror Servers in Content Delivery Networks

For a provider of a Content Delivery Network (CDN), the location selection of mirror servers is a complex optimization problem. Generally, the objective is to place the nodes centralized such that all customers have convenient access to the service according to their demands. It is an instance of the k-center problem, which is proven to be NP-hard. Determining reasonable server locations directly influences run time effects and future service costs. We model, simulate, and optimize the properties of a content delivery network. Specifically, considering the server locations in a network infrastructure with prioritized customers and weighted connections. A simulation model for the servers is necessary to analyze the caching behavior in accordance to the targeted customer requests. We analyze the problem and compare different optimization strategies. For our simulation, we employ various realistic scenarios and evaluate several performance indicators. Our new optimization approach shows a significant improvement. The presented results are generally applicable to other domains with k-center problems, e.g., the placement of military bases, the planning and placement of facility locations, or data mining.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Modelling of IP Geolocation by use of Latency Measurements

IP Geolocation is a key enabler for many areas of application like Content Delivery Networks, targeted advertisement and law enforcement. Therefore, an increased accuracy is needed to improve service quality. Although IP Geolocation is an ongoing field of research for over one decade, it is still a challenging task, whereas good results are only achieved by the use of active latency measurements. This paper presents an novel approach to find optimized Landmarks positions which are used for active probing and introduce an improved location estimation. Since a reasonable Landmark selection is important for a highly accurate localization service, the goal is to find Landmarks close to the target with respect to the infrastructure and hop count. Current techniques provide less information about solving this problem as well as are using imprecise models. We demonstrate the usability of our approach in a real-world environment. The combination of an optimized Landmark selection and advanced modulation results in an improved accuracy of IP Geolocation.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Optimized Travel to Meetings on a Common Location of Geographical Distributed Participants

Members of international organizations often meet in person at a common location for discussions. There is frequently disagreement over the place and time of the meeting due to the different travel efforts of the members. They usually travel by plane and their travel expenses depend on the flight connections. This paper presents an approach to calculate the optimized location and time, where and when distributed partners should meet. The presented system considers the requirements and specifications of each individual member. It respects earliest starting time of an event and non night flights. The optimized result is evaluated with regard to multiple objectives. We focus on the minimization of costs and travel time. Our search algorithm identifies individual travel data for all members for a potential event. The output provides recommendations for the global best appointments and offers further information for the partners. Our system saves expenses and time for all members and allows adjustment as well as compensation.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Simulation and Optimization of Content Delivery Networks considering User Profiles and Preferences of Internet Service Providers

A Content Delivery Network (CDN) is a dynamic and complex service system. It causes a huge amount of traffic on the network infrastructure of Internet Service Providers (ISPs). Oftentimes, CDN providers and ISPs struggle to find an efficient and appropriate way to cooperate for mutual benefits. This challenge is key to push the quality of service (QoS) for the end-user. We model, simulate, and optimize the behavior of a CDN to provide cooperative solutions and to improve the QoS. Therefor, we determine reasonable server locations, balance the amount of servers and improve the user assignments to the servers. These aspects influence run time effects like caching at the server, response time and network load at specific links. Especially, user request history and profiles are considered to improve the overall performance. Since we consider multiple objectives, we aim to provide a diverse set of pareto optimal solutions using simulation based optimization.

0 citations0 reviewsNo code linkedOpen access
preprint2020arXiv

Tracemax: A Novel Single Packet IP Traceback Strategy for Data-Flow Analysis

The identification of the exact path that packets are routed on in the network is quite a challenge. This paper presents a novel, efficient traceback strategy named Tracemax in context of a defense system against distributed denial of service (DDoS) attacks. A single packet can be directly traced over many more hops than the current existing techniques allow. In combination with a defense system it differentiates between multiple connections. It aims to letting non-malicious connections pass while bad ones get thwarted. The novel concept allows detailed analyses of the traffic and the transmission path through the network. The strategy can effectively reduce the effect of common bandwidth and resource consumption attacks, foster early warning and prevention as well as higher the availability of the network services for the wanted customers.

0 citations0 reviewsNo code linkedOpen access