Greg Templeman Email & Phone Number

Foster City, Ca, Us

Sunnyvale, Ca, Us

* Designed and implemented a generic, hierarchical feature-tree library, based on key-value atom pairs appended in multiple depths and with multiple, optional attribute modifiers. This library provides a simple, flexible way to specify a feature-file vocabulary, and provides plugins to both generate a list of candidate, aggregate (hierarchical) features for statistical filtering and model training, and to navigate the hierarchical, feature tree, configured for a deep-learning model’s inputs, to output a feature vector for AI analysis.* Designed and implemented an executable-file scanner/feature-extractor module for analyzing Unix “ELF” executable files, with a template-based approach to both produce candidate features during training, and serve model-selected features during real-time, file analysis, reusing the same code for both purposes. Added detection and extraction of UPX-packed executables so their features are also observable.* Designed and implemented a machine-language-level, static-analysis module for Linux x86/x64 ELF executables, capable of forward and backward data-flow analysis to determine Linux kernel calling sequences (or other instruction sequences of interest). By limiting analysis to specifically-targeted instructions and imposing parameterized graph-traversal restrictions, most executables (even very large ones) can be analyzed accurately in under a second. Complex scenarios, e.g. where a kernel call number is a stack or register parameter and the actual kernel trap instruction happens in another function, are trivially exposed by this approach, even with many intervening instructions, function calls, or code obfuscations. Dramatically improved detection of Unix ELF malware, by providing many high-quality, critical features to the AI model. Enabled our software to instantly identify unknown malware that had been lurking in VirusTotal over 6 months, undetected.

Sunnyvale, Ca, Us

* Designed and implemented a high-performance, vectorized, multi-format, obfuscated-file scanner, able to detect and extract all Windows, Unix, and Mac executables, PDF documents, Microsoft Office CDF and OXML format documents, Java class and JAR files, ZIP files, and all three Adobe-Flash variants. Detection and extraction occur no matter where such objects are embedded within a larger file, and even if the data is XOR obfuscated. Additional research allowed an extremely-low false-positive rate by verifying non-obvious and undocumented characteristics of file formats required for loading by their parent applications.* Designed and implemented a high-performance, vectorized, Base64 scanner, able to detect and extract all of the major, Base64 variants in common use, from any embedded locations in a file. Decoded objects in turn are filtered based on their file format and/or any embedded (even XOR obfuscated or nested Base64) files they may contain, thus allowing any arbitrarily-deep objects to be detected and extracted.* Designed and implemented a file filtering and data-extraction rule engine utilizing regular expressions, simple scripting support (variables, conditional evaluation, progress-guaranteed loops), and output-formatting directives, to provide a general Secrets Scanning framework which selects files by metadata (or by content), scans them for data of interest (such as AWS secret keys or other hidden security/malware artifacts), and format extracted results to human-readable database entries. The simple and compact design allows sophisticated file selection, file scanning, and metadata extraction, without the complexity (or security risk) of a Turing-complete language.* Designed and implemented a multi-round, pseudo-random, data-mixing algorithm to encode/decode potentially-large, private files in billions of operations, as defense in depth against at-rest observation.

Sunnyvale, Ca, Us

* Designed and implemented a PDF feature extractor, which looks at the entire hierarchy of PDF-file objects, considers their relationships to one another, and generates a multi-level feature tree, with additional attribute modifiers at the leaf nodes. Designed to run in both training mode (generating billions of candidate features) and model mode (generating an arbitrary, culled list of features selected externally by machine learning). This design enabled deep-learning models to achieve over 99% accuracy in malware detection.* Enhanced Blue Hexagon’s Microsoft Office feature extractor to add hierarchical, container-manifest and pseudo-filesystem directory features, boosting MS Office malware detection and reducing false positive rates. Added Excel “BIFF” (Binary Interchange File Format) parsing to provide feature coverage for detecting Excel-4-macro-based malware.* Implemented an RTF (Rich Text Format) document feature scanner and embedded-object extractor, which allowed detection of malicious, Microsoft-Office exploits embedded within RTF documents.* Modified Bro HTTP parsing code to capture header details (upper/lower case, white space, line breaks), and created an HTTP feature-extraction architecture that includes these attributes along with other HTTP information, to feed deep-learning, network-traffic models in order to detect suspicious traffic.* Mentored and assisted more-junior engineers implementing defense-in-depth software security, detecting malware evasion behaviors, URL whitelisting strategies, and lock-free design/debugging of fast, IPC queuing logic, enabling them to quickly learn and adapt to the network cybersecurity problem domain.

Milpitas, California, Us

* Implemented X-macro based, automatic table generation/maintenance design to speed development and eliminate substantial human error maintaining interrelated logic tables. This dramatically simplifies adding / changing compiled features, state machines, and configuration parameters.* Refactored the streaming, network-analysis engine to work with a custom, shared-library interface for Suricata, with header-hash-based version control and security handshakes to resist oracle, MITM, and replay attempts. The feature-recording and querying interface was designed so that Suricata rules could work interchangeably with built-in logic and custom, run-time rules.* Further abstracted the shared-library interfaces to the network-analysis engine to allow arbitrary parsing of data from within any FireEye program, deploying it for pre-filtering PDF files in the system back-end and scanning for executables within other files (e.g. files extracted from ZIP files during static analysis).* Proposed and worked on an ongoing redesign of the email-analysis engine to utilize the network-analysis engine’s parsing/scanning, feature observation and scoring systems, and URL parsing / normalization functionality to implement a machine-learning system for email and attachment scanning.* Proposed and implemented techniques to select starting URL pages for multi-object, “sandbox” replays, including multi-flow / multi-object “stage” tracking.* Implemented a general-purpose, notification-registration system for intra- and inter-process communications via sockets or direct function calls and callbacks.* Implemented extra, flexible content encoding/decoding schemes required for on-system content on virtual-machine images (since it’s possible to see through file encryption on a mounted, virtual image).

Milpitas, California, Us

Main architect and software engineer for the multi-flow network-analysis engine sub-system of FireEye’s network appliances. Developed and improved high-performance HTTP and application-file parsing “on the wire” to observe features and render a pre-filtering verdict about suspiciousness of HTML, Javascript, PDF, GIF, Flash (SWF), and various operating-system executable formats.* Invented and patented (pending) a new, pre-compiled, high-performance combination-rule evaluator: “Cyber-Security Framework for Application of Virtual Features”, utilizing complex feature-decision logic (arbitrary AND/OR/NOT/nested grouping) at constant runtime cost, using pre-computed set operations.* Implemented the current Flash parser in FireEye’s streaming network-analysis engines, including tag correlations, ActionScript 2/3 parsers, and rules to detect code-snippet sequences (rolling-hash based).* Implemented a multi-algorithm, fuzzy-logic, high-performance (vectorized and statistical), cross-packet EXE/Flash file detector. Various single-byte/multi-byte XORs, displacements, “magic” header hiding techniques, etc., are detected for Window EXEs, MacOS MACH-O / universal binaries, Unix ELF, and all 3 Adobe Flash file variants. Invoked this algorithm in strategic places at the front of files, within images / PDFs / Flash files, and as steganographic detection at the end of container files. Also implemented a fast “executable reconstructor” module to reverse all the detected stealth features so executables can be extracted for submission to dynamic analysis.* Implemented a high-performance (vectorized), multi-Base64-variant (superset) detector, for finding and sizing non-trivial, Base64 blocks within other data. Also implemented fast, vectorized bigram and doublet scanning algorithms that improve performance over standard C-library string-search functions.

Milpitas, California, Us

* Designed and led implementation of a persistent, new-second-level-domain tracking system, with learning-mode heuristics and adaptive-limitation mechanisms to avoid over-submission of samples from these domains. This code now regularly catches malware that used to require signatures to detect.* In-house, Hack-a-thon project successfully demonstrating utilization of correlations telemetry and non-deterministic detection data (from situational heuristic submissions, such as new-second-level domain or off-hours, expanded checking) to automatically generate and deploy new combination rules in realtime from a centralized server, thus allowing an automated machine-learning feedback loop.* Reimplemented the streaming-network-parsers’ architecture to use “temporal” data structures and “sub-state” machine techniques to improve performance and reduce the time parsing data is retained. Refactored data structures to dramatically reduce the required memory overhead for tracking flows and objects, saving hundreds of megabytes of memory under load on even the lowest-end appliances.* Rewrote memory management and timeout logic for the network-analysis component, utilizing thread-local caching and lock-free programming techniques (e.g. look-aside reorder lists, RCU libraries).* Refactored observed-feature tracking to allow run-time-supplied content rules for keywords, alternate-feature categories for special behaviors (context-sensitive, e.g. escaped or concatenated keywords), patented combination rules, configurable quantized-value (range bucket) features, dynamically-sized feature vectors (vs. pre-compiled), and faster statistical scoring logic. Added additional object/sub-object feature scopes to allow rules to focus on different granularities of grouped data.

Londonderry, Nh, Us

Developed and improved code underpinning Fiery Server and embedded controllers, including file and data security, multi-process / multi-thread management and communication, application-startup sequence, built-in debugging and diagnostics facilities, and field engineering logs. Built and extended OS-abstraction layer allowing optimal, system-independent code for Windows, Linux, VxWorks, or Mac.* Designed and implemented multi-thread / multi-process, fault-tolerant, file-shredding security module, replacing prior code that caused customer stability / performance crisis. Performance gains from 200% to 600% and elimination of frequent crashes / hangs prevented suspension of product shipments.* Designed and implemented flexible, high-performance read-write locks that accelerated multithread database access more than 12 times faster than standard locks.* Created high-speed, read-write, application-transparent, file encryption module, resulting in increased security of user data necessary for government certification of products.

Londonderry, Nh, Us

* Designed and extended networking / socket abstraction libraries, including proprietary, inter-system communication protocol and in-house-network detection / security. Leveraged to implement remote, interactive debugging tools for embedded and auto-test systems, and to split code between user mode / Session-0 for Windows 7 compatibility (allowing quick transition from XP to Windows 7 Embedded OS).* Invented multi-process-safe / fault-tolerant approach to handling encrypted program files, eliminating slow, insecure, error-prone database design. Mentored and supervised programming by India engineers, performing code reviews and collaborating in global engineering discussions to drive optimal implementation. Design eliminated all stability defects while speeding entire system performance by 5%.* Used generic programming and CRTP techniques to implement high-performance template libraries for thread safety and driver-safe, text management, allowing rapid development of several important security features.* Invented and implemented "multi-route" binary-search trees, an efficient mechanism always traversing shortest route between nodes with specific attributes. Used to create high-speed, decentralized inter-module messaging and self-organizing module paradigm solving "static initialization order fiasco". Led to faster feature development, simpler and more decentralized initialization, and more-effective code reuse.

Londonderry, Nh, Us

Continually extended and optimized rasterizing / compression software to improve functionality, flexibility, performance, and reliability. Developed novel imaging / compression implementations and algorithms for faster / better raster rendering and printed output.* Architected and implemented back-end code for working prototype of arbitrarily-extensible, RPC-based, network distributed-computing version of existing rendering / compression software, resulting in an unscheduled bonus being awarded.* Designed / implemented flexible, stand-alone, “data-pipe” framework for arbitrary filtering / manipulation of raster data in several architectures, allowing standardized imaging and compression modules to be quickly / transparently deployed in different products. Quick adaptability allowed several customized controllers to be completed in record time simply by adding special filters to existing systems.* Implemented EFI’s 1st “trapping” (misregistration correction) algorithm, optimizing with SIMD (MMX / SSEx) and other techniques to be 20 to 90 times faster than original, acquired technology. Architected / implemented EFI’s multi-pixel, parameterized “GA-2 trapping” algorithm, with aggressive optimizing (e.g. SIMD MMX / SSE) resulting in 3-pixel-radius trapping faster than the earlier design.* Invented rich-black edge-detection / correction method resulting in greater ranges of recognizable rich-black colors with high performance, allowing feature to support end-user-produced rich black.* Invented a simple, general solution to "Double Checked Locking Is Broken" problem, allowing fast, safe "just in time" singleton instantiation on any platform.

Londonderry, Nh, Us

Redesigned and converted rasterizing / compression software to multithreaded architectures. * Redesigned and re-implemented rendering / compression sub-system creating EFI’s 1st multi-CPU architecture, including refactoring for thread safety, advanced memory management, and system flexibility. Resulted in 35% faster system performance overall.* Designed and wrote raster subsystems for EFI’s first 2 general-purpose, variable-data-printing systems, including transparency / overprint, layers, reusable raster creation / merging, and memory management / data caching. Led to EFI’s early and continuing market leadership in VDP functionality and performance.* Refactored rendering and compression code to use ASIC / FPGA co-processing support, including Windows and VxWorks device drivers, allowing throughput to rival faster competitors’ systems.* Architected and implemented back end for working prototype of arbitrarily-extensible, RPC-based, network distributed-computing version of existing rendering / compression software, resulting in an unscheduled bonus being awarded.* Invented new "run-span sorter" for flattening / merging z-sorted raster objects, replacing prior, adaptive, 2-algorithm implementation with just one module while improving speed by 10% to 35%.

* Designed, managed, programmed, and maintained multi-threaded, multi-network, industrial-control interfaces and embedded-control systems. Implemented several custom, communication protocols.* Designed / coded high-performance, 3D video game engines and custom, streaming movie format/creator/player.