APPLIED ML · DDoS DEFENCE
DDoS detection.
Built for the real world.
I develop statistical and machine-learning detection with production engineering teams. This research has led to multiple patent applications.
INTERNET SECURITY · APPLIED ML
BERLIN CET
Researching
the Internet.
Building systems
that protect it.
I am Marcin Nawrocki Freiherr von Enzberg. I combine Internet measurement, DDoS security, and applied machine learning to understand threats and build systems that protect critical networks.
At NETSCOUT, I develop ML-based DDoS detection for core and transit networks, informed by threat intelligence covering roughly half of global Internet traffic.
01 / WORK AREAS
DDoS detection.
INTERNET RESEARCH · RESILIENCE
Internet measurements.
Assumptions, validated.
I study attacks, protocols, and protective mechanisms in deployed networks. I publish and review research at leading Internet measurement and security conferences.
02 / SELECTED PUBLICATIONS
Evidence worth
building on.
01 An Empirical Comparison of Industry and Academic DDoS Assessments
Bringing industry and academic observations together to examine what different vantage points can tell us about DDoS trends.
Read full paper ↗02 On the Interplay between TLS Certificates and QUIC Performance
Why certificate deployment choices can undermine QUIC’s promise of fast, secure connections; and what operators can change.
Read full paper ↗03 Tracing the DDoS Attack Ecosystem from the Internet Core
Combining Internet exchange and honeypot observations to map DNS amplification attacks, identify blind spots and reveal how attackers exploit reflection infrastructure.
Read full paper ↗04 Dismantling Operational Practices of BGP Blackholing at IXPs
Testing whether a widely deployed DDoS mitigation mechanism behaves as expected in an operational Internet exchange.
Read full paper ↗What is the full picture,
and where are its blind spots?
Which decisions does
the evidence justify?
How do we turn findings
into proven protection?
03 / MISSION & BACKGROUND
A researcher’s curiosity.
An engineer’s responsibility.
Mission
I want an Internet that stays resilient, open and decentralized, where critical infrastructure remains accessible and no single party has to control it all.
Purpose
I turn complex Internet data into trustworthy, actionable evidence. I believe protection should be measurable, decisions should be explainable, and failed assumptions should lead to better systems.
For me, integrity means validating what works, describing the limits and changing course when the evidence demands it.
Selected milestones
- NOW · NETSCOUT ASERT
Turning research into operational detection
Applied ML and threat intelligence, developed alongside Arbor Sightline engineering teams.
- 2024 · FREIE UNIVERSITÄT BERLIN
Doctorate, summa cum laude
DDoS Attacks: Coverage, Mitigation, and Prevention. Supervised by Matthias Wählisch; assessed by Thomas C. Schmidt and KC Claffy.
- 2022 · ACM CONEXT
Best Paper & Community Awards
Research on TLS certificate choices and QUIC performance.
- ONGOING
Research community & mentoring
Reviewer for top-tier conferences, including ACM IMC and ACM CCS.
04 / DOMAINS & tools.
Internet & protocols
Threats & protection
Statistical methods & ML
Engineering & evaluation
LET’S CONNECT