PhD Researcher · Threat Hunter
I’m Joshua Berkoh, a PhD researcher at the University of Cincinnati and a former security engineering intern. I publish network-measurement research on anonymous overlays and CTI reports mapped to MITRE ATT&CK.
Featured Research
Illustrative representation of an eepsite relationship graph, not study data.
A three-study, cross-layer measurement program using a directed multiplex graph framework. Study 1 is complete; Study 2 is underway.
Read about the research →Latest Investigations
What I Do
Measuring how I2P hidden services link, churn and cluster, using crawling and graph analysis that others can reproduce.
Research →Working intrusion scenarios end to end: scoping, IOC pivoting, timeline reconstruction and ATT&CK mapping, written as finished reports.
Case files →KQL and Splunk hunting from SOC work, and a detection-engineering study turning investigation findings into tested rules.
Background →
SOC analyst turned researcher. I started in incident triage, did security engineering, and now study how anonymous networks are structured.
Hiring
I’m open to internships and full-time roles. Email is the fastest way to reach me.