APPLIED ML · DDoS DEFENCE
DDoS detection.
Built for the real world.
I develop statistical and machine-learning detection with production engineering teams. This work has resulted in multiple patent filings.
INTERNET SECURITY · APPLIED ML
BERLIN CET
Researching
the Internet.
Building systems
that protect it.
I am Marcin Nawrocki Freiherr von Enzberg. I combine Internet measurements, DDoS security, and applied machine learning to understand threats and build systems that protect critical networks.
At NETSCOUT, I develop ML-based DDoS detection for core and transit networks, informed by threat intelligence covering roughly half of global Internet traffic.
01 / WORK AREAS
DDoS detection.
INTERNET RESEARCH · RESILIENCE
Internet measurements.
Assumptions, validated.
I study attacks, protocols, and protective mechanisms in deployed networks. I publish and review research at leading Internet measurement and security conferences.
02 / SELECTED PUBLICATIONS
Evidence worth
building on.
01 An Empirical Comparison of Industry and Academic DDoS Assessments
Bringing industry and academic observations together to examine what different vantage points can tell us about DDoS trends.
Read full paper ↗02 On the Interplay between TLS Certificates and QUIC Performance
Why certificate deployment choices can undermine QUIC’s promise of fast, secure connections; and what operators can change.
Read full paper ↗03 Tracing the DDoS Attack Ecosystem from the Internet Core
Combining Internet exchange and honeypot observations to map DNS amplification attacks, identify blind spots and reveal how attackers exploit reflection infrastructure.
Read full paper ↗04 Dismantling Operational Practices of BGP Blackholing at IXPs
Testing whether a widely deployed DDoS mitigation mechanism behaves as expected in an operational Internet exchange.
Read full paper ↗What can we observe,
and what are we missing?
Which decisions does
the evidence justify?
How do we turn findings
into proven protection?
03 / MISSION & BACKGROUND
A researcher’s curiosity.
An engineer’s responsibility.
Mission
I want an Internet that stays resilient, open and decentralized, where critical infrastructure remains accessible without any single party controlling it all.
Purpose
I turn complex Internet data into trustworthy, actionable evidence. I believe protection should be measurable, decisions should be explainable, and failed assumptions should become lessons learned.
For me, integrity means validating what works, describing the limits and changing course when the evidence demands it.
Selected milestones
Full CV (PDF) ↗- NOW · NETSCOUT ASERT
From research to operational DDoS detection
Driving research and development of patented ML-based DDoS detection alongside Arbor Sightline engineering teams.
- 2024 · FREIE UNIVERSITÄT BERLIN
Doctorate, summa cum laude
DDoS Attacks: Coverage, Mitigation, and Prevention. Supervised by Matthias Wählisch; assessed by Thomas C. Schmidt and KC Claffy.
- 2022 · ACM CONEXT
Best Paper & Community Awards
Research on TLS certificate choices and QUIC performance, awarded twice at ACM CoNEXT 2022 and presented at IETF 116.
- ONGOING
Research community & mentoring
I review for leading conferences, including ACM IMC and ACM CCS, and mentor researchers and engineers.
04 / DOMAINS & tools.
Internet & protocols
Threats & protection
Statistical methods & ML
Engineering & evaluation
LET’S CONNECT