Matthew Schurr

Proactively and reactively detecting compromised business accounts with the goal of limiting the harm bad actors can cause to Meta or its users, business owners, and advertisers while ultimately returning compromised accounts to their rightful owners.

Serving as the technical lead for the Machine Learning Infrastructure team (8-10 engineers) which maintains ExtraHop's cloud-based machine learning service (consisting of 1200+ AWS EC2 instances). Responsibilities include: build, testing, tooling, deployment, monitoring, and data warehousing. - Drove workflow improvements including: using containerization, testing against staging, reducing friction for small changes, adopting static typing with mypy, building data gathering tools, creating continuous integration diff tests (Gitlab CI), and improving observability (Prometheus/Grafana). - Implemented (directly or through delegation) detection capabilities for: BitTorrent, DNS Tunnels, SSL/TCP/UDP Scans, Data Exfiltration, Spoofed Certificates, Executable File Downloads, Retroactive IoCs, Unusual Connections, and Kerberos Enumeration (in C/Python). - Proposed and deployed a high-availability asynchronous job scheduling system (in Python) which addressed the team's long-standing performance, availability, observability, and code quality issues. Created and executed a plan for incrementally migrating workloads away from a monolithic legacy system into the asynchronous system. Worked with stakeholders to align company-wide engineering efforts (such as internationalization) with the migration while maximizing customer value. Ultimately, reduced on-call from a full-time job for 2 engineers to part-time for 1 while the customer base doubled.

Anomaly Detection (ADE) - A cloud-based platform for analyzing wire data with machine learning. - Proposed and implemented end-to-end diff testing infrastructure (for Gitlab CI) against a mock appliance which resulted in massive improvements to team velocity and service stability. - Coordinated the cross-team effort to use transaction records stored in BigQuery as additional input to the anomaly detection service. - Mentored a junior engineer through designing and implementing cross-appliance analysis. - Collaborated to create a VPN correlation service which tags internal VPN endpoints with their external IP address(es) (U.S. Patent #11652714). - Created a remote control detector which uses L3/L4 characteristics to identify machines being externally controlled via SSH, VNC, RDP, NetCat, and Web Shells (in C/Python). - Created a malware-agnostic command-and control beacon detector which ultimately led to the discovery and takedown of multiple malware-infected Chrome extensions affecting >775,000 users (in C/Python). Discover Appliance (EDA) - A real-time passive 100 Gbps+ network monitoring appliance. - Implemented detection of Metasploit Meterpreter (staging process/control protocol) (in C). - Implemented detection of executable file transfers (PE/EXE, ELF, etc) (in C). - Implemented detection of sensitive information transmission (e.g. credit cards, SSNs) (in C).

Trace Appliance (ETA) - A real-time passive 25Gbps+ network packet capture appliance - Added multi-disk support which improved worst-case lookback from 6 hours (~24 TB) to over 5 days (~600 TB) (in C). - Reduced search index memory usage by >90% by compressing chunks of the index and migrating them from RAM to SSD (in C). - Improved restart speed after clean shutdowns by >60x (in C). - Added crash/power failure recovery capable of restoring the device in <15s (in C). - Added support for securely storing and downloading TLS Session Keys alongside the corresponding TLS packets (in C). - Improved maximum ingest rate by 2.5x by striping of incoming packet data across multiple RAID arrays (in C, JS, React). - Added support for paginating packet search results across multiple Trace Appliances (in Go) enabling horizontal scaling of ingest and capacity. Other - Created a productivity tool to enable a frictionless commit-based workflow for branch-based code review tools (such as Gitlab) which was adopted across the company and led to tangible improvements in commit hygiene, code quality, and time spent in review.

Discover Appliance (EDA) - A real-time passive 100 Gbps+ network monitoring appliance - Implemented a bi-directional web socket parser which supports TLS and permessage-deflate (in C). - Implemented a GeoIP Trigger API backed by MaxMind which enables customers to create location-based metrics, alerts, and more (in C/C++). - Implemented a distinct count metric type backed by HyperLogLogs which is a key enabler for scalable detection of security issues (in C/C++). - Implemented the back-end (in Go) and portions of the front-end (in TypeScript/React) for Network Live Activity Maps. - Implemented a Java agent which forwards TLSv1.0-1.3 session secrets to an ExtraHop Appliance. Decryption capabilities are a major competitive advantage.

- Implemented a Chrome extension that automatically updates proxy settings when locally viewing a JavaScript unit test that utilizes Martian Proxy to mock XHR responses. - Designed and implemented a Closure JavaScript library that can capture the state of the HTML DOM, serialize/deserialize that state, and calculate a diff between two serialized DOM states (including capturing and diffing computed styles, installed event listeners, CSS properties, visibility, structure, etc.). - Designed and implemented a re-usable Closure UI component for displaying the aforementioned diffs (similar to what you would see with a traditional text diff of HTML source code but with extra features for displaying things not visible in the text such as event listeners). - Implemented a HTML DOM diff-testing and reporting infrastructure that allows developers to add JS API calls in their unit tests that will capture the state of a DOM tree (e.g. DomDiff.capture(name, element)), serialize that state, and save that state in their test outputs. The infrastructure automatically triggers during code review, executes each affected unit test both before and after the code changes, and provides a summary of differences found in the two runs in the code review thread along with a link to view those diffs using the UI component I created.

- Mentored students one-on-one and in groups every week, facilitating growth in their problem solving and programming skills; graded and provided feedback on homework and exams - Created a web application to simplify merging class participation grades with Coursera (https://github.com/mschurr/comp140-grading).

- Collaborated with team to fix bugs and implement new features on the then unreleased Chrome Bookmark Manager - Experimented with multiple back-end services and collaborated with several other teams to produce an integrated end-to-end demonstration of related content recommendation within Chrome Bookmark Manager - Quickly learned and leveraged new technologies including Google Web Server, Chrome Extensions, Protocol Buffers, Closure, Remote Procedure Calls, and many other internal technologies

Since early high school, I have worked on and off as an independent web designer and developer. I have used the skills I developed not only for profit, but also as a means of helping non-profit organizations and improving my programming skills.

- Designed and programmed the company’s website (from scratch) in a way that allows quick, easy management of content without requiring knowledge of a programming language - Created a user-friendly inventory management system for insurance purposes