Vishva Teja Chikoti
AI systems engineering with security and reliability as first-class constraints. New Haven, CT.
Rexi: Voice AI ordering infrastructure
Voice AI without giving the model control.
Pipeline: Call → VAD → STT → Interpreter → FSM → Pricing → Confirm → POS
Stack: LiveKit, SIP, Python, LLM tool calling, Postgres
MalTrace: Behavioural malware intelligence
Classify malware by what it does, then show why.
Pipeline: Hash → Sandbox → API calls → Features → Random forest → SHAP → ATT&CK
Stack: Python, Sandbox, scikit-learn, SHAP, MITRE ATT&CK
- 94,958 api calls, wannacry sample
- 54 behavioral + pe features
- 95% malicious confidence on this sample
Teardown
00 SEALED state
wannacry.exe, 3,514,368 bytes
SHA-256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
PE32 executable (GUI) Intel 80386, for MS Windows
01 X-RAY hierarchy
4 PE sections
In section-table order: .text, .rdata, .data, .rsrc.
02 EXPLODE hierarchy
| ID | Section | Raw size, bytes | Virtual size, bytes | Entropy | Note |
|---|---|---|---|---|---|
| 1 | .text | 28,672 | 27,056 | 6.40 | |
| 2 | .rdata | 24,576 | 24,432 | 6.66 | |
| 3 | .data | 8,192 | 6,488 | 4.46 | |
| 4 | .rsrc | 3,448,832 | 3,448,736 | 8.00 | HIGH ENTROPY |
03 DETONATE flow
94,958 API calls across 17 processes
| API | Calls |
|---|---|
| NtClose | 10,733 |
| NtQueryInformationToken | 6,663 |
| NtWaitForSingleObject | 5,380 |
| NtQueryInformationFile | 5,223 |
| NtReleaseMutant | 5,062 |
| GetSystemTimeAsFileTime | 5,048 |
| NtOpenFile | 4,424 |
| FindResourceExW | 4,155 |
| SizeofResource | 4,118 |
| LoadResource | 4,116 |
| RegOpenKeyExW | 4,083 |
| RegQueryValueExW | 3,542 |
| All other APIs | 32,411 |
04 DISTILL cause
54 features
46 dynamic behavioral + 8 static PE.
Static PE features: pe_entropy pe_num_sections pe_has_upx pe_wx_section pe_is_64bit pe_is_signed pe_has_tls pe_num_imports
05 DECIDE dependency
Random forest
The 54 features feed one model.
06 VERDICT change
95% malicious confidence on this sample
A single-sample prediction, not model accuracy.
SHAP base value 0.501
07 EXPLAIN cause
| Feature | Value | SHAP | Direction |
|---|---|---|---|
| malscore | 10 | +0.0885 | malware |
| sig_severity_sum | 54 | +0.0589 | malware |
| has_rat | 1 | +0.0502 | malware |
| pe_num_sections | 4 | +0.0473 | malware |
| pe_is_64bit | 0 | +0.0399 | malware |
| file_size | 3514368 | -0.0158 | benign |
| num_strings | 15894 | -0.0148 | benign |
| num_mutexes | 40 | -0.0086 | benign |
| num_dropped_files | 59 | -0.0051 | benign |
| suspicious_api_ratio | 0.0105 | -0.0026 | benign |
08 MAP dependency
| Signature | Severity |
|---|---|
| antivm_checks_available_memory | 1 |
| queries_computer_name | 1 |
| queries_keyboard_layout | 1 |
| queries_locale_api | 1 |
| accesses_public_folder | 1 |
| antidebug_setunhandledexceptionfilter | 1 |
| dll_load_uncommon_file_types | 1 |
| exec_crash | 1 |
| stealth_timeout | 1 |
| language_check_registry | 1 |
| privilege_elevation_check | 2 |
| mountpoints_volume_discovery | 2 |
| creates_suspended_process | 2 |
| resumethread_remote_process | 2 |
| reads_self | 2 |
| Stage | Result |
|---|---|
| Hash | ed01ebfb… |
| Sandbox | 17 processes |
| API calls | 94,958 |
| Features | 54 features |
| Random forest | 95% |
| SHAP | malscore |
| ATT&CK | 13 techniques |
QualityMesh: Release assurance infrastructure
Can this build ship?
Pipeline: Artifact → Evidence → Policy → Decision
Stack: CI/CD, Policy, Evidence binding
Enterprise SOC Detection Lab: Security detection and incident investigation
Simulate, detect, investigate, and tune.
Pipeline: Simulation → Telemetry → SPL detection → Investigation → Tuning
Stack: Splunk, Sysmon, Active Directory, Kali Linux
CloudShield: Cloud security detections
Audit events into explainable cloud detections.
Pipeline: Audit event → Normalize → Rule → Finding → Evaluation
Stack: Python, GCP audit logs, Kubernetes audit logs